Using Charles Proxy to Debug
Android SSL Tra c
Hack Upstate Follow
Jun 20, 2017 · 5 min read
The following is from Odd Networks, Erik Straub
I’ve been a longtime user of Charles for checking requests and responses
from the web applications I write.
Charles as described on its site:
Charles is an HTTP proxy / HTTP monitor / Reverse Proxy that enables a
developer to view all of the HTTP and SSL / HTTPS tra c between their
machine and the Internet. This includes requests, responses and the HTTP
headers (which contain the cookies and caching information).
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Lately, however, I’ve been doing a lot more work on Android apps than I
have on server-side applications. I gured it would be similarly helpful to
debug some of the requests we were making from our apps without logging
out to Logcat and cluttering our app code.
The requests I wanted to check happened to be protected by SSL, so in
addition to adding the proxy information to my device’s networking
con guration, I also needed to install Charles’ root certi cate. It turns out
that this is possible, but requires a bit of work. Luckily I have now done this
enough times to feel good about writing it up.
First o , this setup will not work on an emulator without an additional step
(see below). I admittedly haven’t needed to do any proxy debugging
without a test device, though.
Also, as of this post, we are targeting Android SDK version 25 in our
applications, but this speci c setup should work with all versions. If not, feel
free to correct me so that I can update this post.
Now on with the show.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Setting Up Your Project
If your test device is running Android 7.0 or newer, there are a few extra
steps to ensure that you are able to trust the Charles CA Certi cate. To
ensure Android trusts the certi cate, you’ll need to specify a Network
Security Con guration for your application. There are a few di erent ways
of adding your certi cate to the application’s trusted con guration, but I
found that the easiest was not to include Charles’ certi cate within my
application code, but to simply trust the user-installed CA certi cates (like
previous versions of Android used to do).
Specifying the android:networkSecurityConfig property within your
AndroidManifest.xml le:
<application android:allowBackup=”true”
android:icon=”@mipmap/ic_launcher”
android:label=”@string/app_name”
android:roundIcon=”@mipmap/ic_launcher_round”
android:supportsRtl=”true” android:theme=”@style/AppTheme”
android:networkSecurityCon g=”@xml/network_security_con g”>
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
view rawAndroidManifest.xml hosted with ❤ by GitHub
Specifying the res/xml/network_security_config.xml le:
<?xml version=”1.0" encoding=”utf-8"?><network-security-con g>
<debug-overrides> <trust-anchors> <! — Trust user added CAs while
debuggable only → <certi cates src=”user” /> </trust-anchors>
</debug-overrides></network-security-con g>
view rawnetwork_security_con g.xml hosted with ❤ by GitHub
Setting Up Charles
Open up Charles on your Mac and then open Proxy > Proxy Settings from
the toolbar. You’ll need to make note of the HTTP Proxy Port that is
speci ed.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Then open up Proxy > SSL Proxying Settings from the toolbar and add the
appropriate Locations (host/port) for the requests you wish to debug. I
usually just add a wildcard route like *.myapidomain.com but speci c
domains like whatever-app.herokuapp.com work ne as well.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Setting Up Your Android device
First, make note of your Mac’s IP address within your local network. You’ll
need it in the next step.
Also make sure Charles is open and that the Mac is on the same wi
network as the Android device you’ll be setting up.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Go to your device’s settings and wi con guration.
Press and hold on the network you’re going to use and select Modify
network from the alert modal.
Then check Advanced Options and scroll until you see Proxy .
Tap the Proxy dropdown and select Manual .
For the Proxy hostname input your Mac’s IP address that you noted above.
Then for the Proxy port use the HTTP Proxy Port that you noted from
Charles’ Proxy Settings from above.
Tap Save .
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
After saving, you may notice a pop-up on your mac like this:
You should now click Allow to let your Android device connect to Charles
via the proxy it has set up.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
If you don’t see this prompt, you can ensure that your device can use the
proxy from within Charles by going to Proxy > Access Control Settings
and adding your Android device’s IP address on the wi network.
One more step!
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Now on your Android device, open up the browser and go to the following
URL chls.pro/ssl . You can also see these instructions from within the
Charles app - go to Help > SSL Proxying > Install Charles Root
Certificate on a Mobile Device or Remote Browser .
The browser should download the cert and once nished, tap to open the
le. Then Android should prompt you to install the le.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
After you’ve named the certi cate and tapped “OK”, you will either be
prompted to input your device’s pin/password or prompted to set up your
device’s pin/password. Once that process is complete, you should be ready
to debug some requests.
Note Until you remove the manual proxy from this device’s wi
con guration, whenever you use this network again you will need to have
Charles open and running on the same IP address. You can always set the
network con guration back to “Proxy: None” once you’re done debugging.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Using An Emulator
According to Charles’ site you can start the emulator with a ag in order to
use the proxy.
In the Android emulator run con guration add an Additional Emulator
Command Line Option: -http-proxy http://LOCAL_IP:8888
Where LOCAL_IP is the IP address of your computer, not 127.0.0.1 as that is
the IP address of the emulated phone.
EDIT: Thanks to Brandon Davis for pointing out that the full command would
be
emulator -avd EMULATOR_NAME -http-proxy IP_ADDRESS:PORT
In addition, Android Studio 3.0 will now allow managing proxy settings for
your emulator images. Read all about the new features here and if you can’t
wait for a stable release, 3.0 is currently available in the dev channel.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Debugging requests
Now that you’re set up, you should see Charles recording tra c from your
device. As long as you’re con gured properly, you should see those SSL
request details from the domains you speci ed in Charles’ SSL Proxying
Settings.
Feel free to discuss your results and let me know if I missed anything
obvious.
Android Proxy Ssl Https Android Emulator
1.2K 13
WRITTEN BY
Hack Upstate Follow
Advancing Upstate New York's tech community through events
and education. http://hackupstate.com/ &&
https://careersincode.org/
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
More From Medium
What is Ransomware? Q&A: Data Thieves Exploit COVID-19
Ferdinand Ramos in Query.AI Sen. Chuck Grassley
The Encyclopedia of Smart Contract Attacks and Understanding End User Security Decisions
Vulnerabilities
Jacob Davis
Kaden Zipfel in Better Programming
Facebook Meeting Audio Leaked: The Week in Data News What is SQL Injection and how to x it
BIGtoken Team in BIGtoken Bootsity
Here Are the Biggest Online Privacy Threats Facing Your Digital Privacy Matters: Here Are Some Basic Steps
Companies and Consumers (and Covering Your… You Can Take to Protect It
inc. magazine in Inc Magazine Shayan Shokrgozar in Predict
Discover Medium Make Medium yours Become a member
Welcome to a place where words matter. On Follow all the topics you care about, and we’ll Get unlimited access to the best stories on
Medium, smart voices and original ideas take deliver the best stories for you to your Medium — and support writers while you’re at
center stage - with no ads in sight. Watch homepage and inbox. Explore it. Just $5/month. Upgrade
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
About Help Legal
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
