yashsingh1/xdaforums huggingface dataset:
[Android Software Development] SandroBSupp:
Just for http/https.

It can act as

proxy -> you must specify proxy in browser settings

transparent proxy -> you must somehow change where tcp packets are going (iptables)

http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html

Now I am working on tab where redirection on phone can be done from gui for all processes that have network permissions.

It creates iptable rules as:

iptables -t nat -A OUTPUT -m owner --uid-owner <xxxxx> -p tcp --dport 80 -j DNAT --to 127.0.0.1:8009

But still long way to make it work properly...
[Android Software Development] SandroBSupp:
It can track any app that uses http/https.

Not quite sure about ports. Probably just 80/433 but I could change that can be value in preferences.
[Android Software Development] SandroBSupp:
New feature: gui for process->trasparent proxy redirection

It activated additional iptables rules so the process is redirected to transparent proxy.

iptables -t nat -A OUTPUT -m owner --uid-owner <xxxxx> -p tcp --dport 80 -j DNAT --to 127.0.0.1:8009
[Android Software Development] SandroBSupp:
new feature: browser cache on/off

There is setting that removes browser cache headers.
[Android Software Development] chareos12:
dumb question: would your app help to make gTalk work on corporate networks protected by Forefront ?

Many thanks
[Android Software Development] SandroBSupp:
Sorry, not yet.

Probably you need NTLM authentication to proxy?

Chaining Sandroproxy to ntlm proxy is on the list of future features.
[Android Software Development] MemoryController:
I can't find it on the Market/Play crap.

Device: GT-i9100 on 4.0.3 rooted. Country: Greece

Current Operator:Vodafone GR, tried also with GR COSMOTE. Any ideas?
[Android Software Development] Pons:
I'm assuming you clicked on he link in the OP? Have you tried searching the Play Store from a browser while logged into Google? It will tell you if your device is compatible or not.
[Android Software Development] SandroBSupp:
It should work on all devices from 2.3 OS up.
[Android Software Development] SandroBSupp:
New feature: user custom proxy plugins

You can make your own custom plugin to handle http request/response flow

http://code.google.com/p/sandrop/issues/detail?id=31#c3
[Android Software Development] SandroBSupp:
New feature: user custom CA certificate, import CA to android store

User can set custom CA for generating site certificates.

Or use generated one.

Password can be set. if not, default ("password") will be used.

There is option to store SandroProxy certificate in android store.

If custom, not generated is used, be careful that it contains BasicConstraints with isCA flag set to true.

Otherwise will not be recognised as CA certificate.
[Android Software Development] SandroBSupp:
New feature: user custom search critera on show request/responses

User can specify with scripting (BeanShell) which request/responses are show on the list

http://code.google.com/p/sandrop/issues/detail?id=23
[Android Software Development] Publiuss:
It does nothing...

Hi

I'm on a rooted xperia SK17i, I set it as transparent proxy, but it does collect nothing, does not display any app...

Should I use an external proxy app to redirect traffic on a specific port (for ex. 8008) on which sandroproxy is listening?
[Android Software Development] SandroBSupp:
Transparent proxy setup for app

How to redirect app on device to local sandroproxy:

1. first you check on which app would you like to redirect to transparent proxy. APPS tab

2. check in preferences that transparent proxy is enabled. Transparent proxy = ON

3. check version of iptables. It should not be 1.3.x because have problems with nat table.

----You can fix iptables with this app from market

----https://play.google.com/store/apps/details?id=com.mgranja.iptables

4. start proxy

You can check iptables rules when proxy is active with Info Menu action.

Or from adb shell:

iptables -L

iptables -t nat -L
[Android Software Development] SandroBSupp:
Capturing https is more tricky. It can be done but with some additional stuff.

When app make ssl request it states hostname.

If ssl server side certificate is not for the same hostname, by default connection is not trusted and dropped.

Sandroproxy has in settings that you can state name for generated certificate.

http://code.google.com/p/sandrop/issues/detail?id=40

Also you should put sandroproxy CA to android store.

http://code.google.com/p/sandrop/issues/detail?id=2

You can test if app will work if you make same request from browser and no popup that something is wrong with ssl appears.

If you redirect browser (native, opera, ...) to sandroproxy, and click continue on ssl popup, it will proceed.

To find out what kind of request app makes on ssl you should check in /proc/kmsg where iptables puts some info.

Or with this app.

https://play.google.com/store/apps/details?id=com.googlecode.networklog

FIX ME is from iptables command and will probably be gone in some new version.
[Android Software Development] Losik:
Unfortunately...

I verified hostname by the NetworkLog app that you gave me... set it up in SandroProxy, checked HTTPS next to App, started service, exported and loaded sandroproxy CA... but app doesn't let me through, anyway. In Logs, app seems like trying to change SSL, maybe succeeds, maybe fails, I don't know:

Reading reqest from browser
Finished negotiating SSL - algorithm is SSL_RSA_WITH_RC4_128_MD5
Intercepting SSL connection!

However, browser works, and says certificate is valid for that hostname.

So... something's wrong with SSL. I guess I'll have to find other ways around (

Anyway, thanks for trying to help me, I appreciate donate it.
[Android Software Development] SandroBSupp:
Sorry to hear that.

I just make fresh install of SandroProxy from market and tried with some apps and it's working.

For example imdb. Put app.imdb.com as hostname and it should work also through SandroProxy as transparent proxy.

But some app can be more strict about ssl handshake. It could verify in code for issuer of certificate and not trust OS.

Will try to make one simple SandroProxy client and put it on google code so you can play with different scenarios.

Thnx for donation. It will be for one large cold beer ;).
[Android Software Development] Losik:
I've found the other way: decompiled, replaced "https" in APK with "http" and still had to use your program, because android emulator's -http-proxy didn't work :) Thanks again. Works like a charm now :)

Hehe. Enjoy)
[Android Software Development] SandroBSupp:
New feature: manual request

Captured request can be changed, replayed.

http://code.google.com/p/sandrop/issues/detail?id=37
[Android Software Development] Publiuss:
Hi

Thanks for this app, look interesting, looking forward for further developement.

Just a question: there is a way to handle https sites without asking tens of times to accept untrusted certificates?

I use https facebook, and is impossible to browse for the continuous requests of continuing on certificates; i've only to unceck https for browser totally...

Would be useful to accept once an unknown certificate, as we do in desktop browsers.

Thanks.

Bye.
[Android Software Development] SandroBSupp:
You should put SandroProxy CA certificate to trusted authorities certificate store.

So browser will trust all certificates generated by SandroProxy.

CA certificate is generated on the first time and there is also option Menu action to put it to Android CA store. Works on ICS.

You can also use your own CA if you wish. Just specify it in Settings->CA CERTIFICATE->File location

Try it also with desktop browser. It should remove all certificate warnings.

http://code.google.com/p/sandrop/issues/detail?id=2

If you will stuck somewhere in the process send me mail an I will help you more.
[Android Software Development] SandroBSupp:
New feature: chain proxy -> connect SandroProxy to another proxy

SandroProxy can connect to another proxy.

Basic, Digest, NTLM authentication supported.

Tested with Squid and ISA proxy. Probably works with others too.
[Android Software Development] doctorow:
This is really cool, thank you!

Sent from my GT-I9100
[Android Software Development] SandroBSupp:
New feature: web interface

http://code.google.com/p/sandrop/issues/detail?id=44

SandroProxy can expose captured data through web server interface.

On top of that api, html application can be build.

Currently active root dir is :

http://sandrop.googlecode.com/git-history/web_interface_1_1/projects/SandroProxyWeb/web-gui/

Currently active first page :

http://sandrop.googlecode.com/git-history/web_interface_1_1/projects/SandroProxyWeb/web-gui/index.html

http://<hostname>:<port>/data/conversation/list.json -returns list of all captured request/responses, basic data

http://<hostname>:<port>/data/request/list.json -returns list of all captured requests

http://<hostname>:<port>/data/request/headers.json?id=<request_id> -> returns request headers

http://<hostname>:<port>/data/request/content.json?id=<request_id> -> returns request content

http://<hostname>:<port>/data/response/headers.json?id=<response_id> -> returns response headers

http://<hostname>:<port>/data/response/content.json?id=<response_id> -> returns response content

http://<hostname>:<port>/action/proxy/start start proxy

http://<hostname>:<port>//action/proxy/stop stop proxy
[Android Software Development] SandroBSupp:
New feature: intercept and change request/response before goes further

You can intercept and change http data before is send to server and client.

Triggering this is done with bash scripts.
[Android Software Development] SandroBSupp:
New feature: can connect to insecure sites

There is switch in preferences to allow connections to insecure ssl sites.

http://code.google.com/p/sandrop/issues/detail?id=49
[Android Software Development] kostas66:
Hi,

I would like to ask some questions about using this proxy for accessing the internet through a "company APN with proxy".

First of all I must say that SandroProxy is, as far as I know (I tried almost all the free app in the store... if it is not agains some forum rule I could detail the names of the apps...), the only app that actually really worked and somehow improved my internet access ! Thanks !

Now my problem:

The configuration of my device:

Device: Samsung Galaxy S III

Android version: Jelly Bean (Android 4.1.1), last official version for italian umbranded devices (PDA: I9300XXDLJ4, MODEM: I9300XXDLID, CSC: I9300ITVDLJ1)

Some details about our company proxy and the phone APN configuration:

The proxy: it should be an ISA server (almost sure about this...), it has obviously an address ad a port (for example 10.1.2.3:8080), it uses authentication (same account and password used to connect with the company APN), it handles http and https requests, and actually using the "chain proxy" option almost everything works fine.

The APN configuration without SandroProxy:

- In the APN configuration panel I have obviously inserted the APN address, and the account and password to connect with the APN itself

- Using Android 4.1.1 I can explicitely also configure the proxy details (inserting the IP and the port)

- With the above configuration only Gmail, the company mail (exchange server, secure access, ssl...) and the browser (after inserting account and password in the popup...) are working properly

- Any other app doesn't work... Maps, Play store, any weather or news app, ... no way !

The APN configuration with SandroProxy:

- In the APN configuration panel I have obviously inserted the APN address, and the account and password to connect with the APN itself

- In the proxy and port fields I have inserted 127.0.0.1:8008 (localhost and the coosen port...)

- With this configuraton may apps, like weather or news apps, are now working, but Play store an Maps no, and, mainly, the company mail (exchange server) cannot connect !

- I also noticed (but I would like to try again) that now the browser works directly without asking again account and password (no popups...).

- Adding the "transparent proxy" option and "flagging" the apps Map, Play, Mail and "Exchang seerver", I managed to use the Maps and the Play store, but NOT the company mail... no way... "impossible ti connect with the server"...

Any ideas or suggestions ? If I manage to fix the company mail problem it will be really PERFECT !!

Thanks in advance for any idea or reply !! (and I hope this is the correct thread for this kind of questions...).

K
[Android Software Development] SandroBSupp:
Maybe you will succeeded with this settings:

When you set transparent proxy there is option to set name of Hostname for transparent SSL server.

By default it is sandroproxy.unsecure. You should change it to the name of your exchange server https server name.

You should also put sandroproxy certificate to android store by Export CA to store menu option on log screen.

If Exchange server has certificate that is not trusted by android you should set option Trust all SSL server certs or put Exchange server cert CA to android store.

But mail application can be very strict about ssl connections (server certificate pinning) so chances are that will not work.
[Android Software Development] kostas66:
Will try and let you know !!

Thanks for the fast and clear reply !!!

K
[Android Software Development] kostas66:
At the end it worked !! :)

But only after removing most of the configurations.... I will detail better later.

In the meamwhile you got my "5 stars" in Goggle Play !

K
[Android Software Development] kostas66:
Hi,

here are the details of the configuration steps I followed:

First I applied all the configuration steps you suggested (leaving also the previous configurations described in my first post). And the mail client (exchange server) worked, but I "lost" Google Play...

Trying to understand what happened I started removing, one by one, all the configurations... and at the end the configuration that worked with "all" apps (I tried gmail, exchange server, google maps, the browser, google play, some news and weather apps...) was surprisingly the following:

- "Transparent Proxy" disabled (I also un-selected all the previously selected apps in the "Apps" tab)

- Removed the "hostname for transparent SSL"

And it works like a charm :good: !!

Now, as during the day I do not have access to a WiFi network, I will be able to test the real power consumption of the app, will let you know.

Another two little things:

- A minor "bug": In the config tab when trying to delete the value inserted in "hostname for transparent SSL" the app presents the pop up, but after having deleted the value and pressed "OK" the field seems empty, but it remains populated with the previous value (I solved explicitely writing "sandroproxy.untrusted" in the field).

- A question: wich directories I have to monitor/clean to avoid that "log" and/or "data" become too big ? (or there is an automatic function/limit ?)

Thanks again !!

K
[Android Software Development] SandroBSupp:
I'm glad that you make it work.

About captured data. You can set directory with Preferences->Data storage path

You can use Delete action on Data tab.

Or even better to set in Preferences that nothing is captured with Data Capture -> Allowed urls, Blocked urls.

Just put .* in Blocked urls.
[Android Software Development] kostas66:
I think you deserve at least a couple of pints of beer !! Cheers ! :laugh:

(Donation confirmation number: 35D93497VP135271C)

Thanks again,

K
[Android Software Development] kostas66:
Hi,

it seems that I have some problems... I don't know why, but suddenly, without any change in configuration (or other), the Play Store stopped working (server error, timout or other messages...).

So I decided to "start over" uninstalling the app and reinstalling it... I also deleted the client certificate... just to "clean everything"...

But now, even after having uninstalled the proxy I cannot remove the "PIN authentication" of the lockscreen.. in the config it says something like "disabled by admin" in the "drag" option... so I cannot disable the PIN... (I remember that when I selected the "export CA" option the app requested to insert a pin, and I did it...but now ?)...

Any suggestion before I hard reset the phone :mad: ?

EDIT: I succeded in removing the PIN by "Settings, security, clear credentials"

Thanks !

K

PS: Did you receive the donation ;) ?
[Android Software Development] SandroBSupp:
Hi,

You should use Settings->Security->Clear Credentials (Remove all credentials)

instead clear SandroProxy CA certificate in User store. Then you will have option to remove locking.

It is certificate authority certificate.

Really don't know why it stopped working suddenly...

Thnx for donation. It will be for couple of beers :)
[Android Software Development] kostas66:
As soon as I have some time will try again and let you know any news/details.

K
[Android Software Development] SandroBSupp:
I tested myself and found out that is not working for Google+ and Google Play.

It has been a while that I test with these apps.

I will do some more testing and try to make it work.
[Android Software Development] SandroBSupp:
I found why is not working.

Some http authorization header (Authorization:GoogleLogin) is not send to google servers.

I will make new version and put it on the market. But I didn't really tested with ISA chain proxy.

Can you be so kind and send me if it is working also on your ISA proxy environment.
[Android Software Development] kostas66:
I just saw your post !

Will try asap !

K
[Android Software Development] kostas66:
Configuration used:

- Enabled chain proxy

- Exported CA

- No transparent proxy

And... everything sems to work fine !!!!!!

Will do more tests and let you know.

Thanks !

K
[Android Software Development] SandroBSupp:
Great!

I must say that probably is not as fast as without SandroProxy and ISA proxy. But it should work.
[Android Software Development] SandroBSupp:
New feature: using chrome remote devtools

SandroProxy now supports chrome devtools remote protocol. So you can examine realtime, stored data.
[Android Software Development] SandroBSupp:
New feature: chrome 3d panel

Added new chrome devtools panel to view captured data in 3D.

https://plus.google.com/u/0/102248092997026875601/posts/1yQMFDGfZdb
[Android Software Development] SandroBSupp:
New feature: websockets protocol

SandroProxy can handle websockets protocol.

There is new tab WS where you can examine protocol messages.

Modifying, replaying, generating new messages are features yet to come.

http://code.google.com/p/sandrop/issues/detail?id=63
[Android Software Development] alex2308:
How do you intercept SSL? As far as I see SandroProxy does not create the CA file itself, so I created a file (PKCS12, .pfx) with a password and added it. Now SP says "client cert file name is not valied so it will not be used", "Using ..." "CA cert exported to.." "Using CA from file .." and finally when I try to reach a https test website it says "Interceptiong SSL connection!" --> "ConnectionHandler got an error : java.lang.NullPointerException"

Is it me? Nexus 4, root, Android 4.2.2

NullPointer at org.sandrop.webscarab.plugin.proxy.ConnectionHandler.run(ConnectionHandler.java:174)

Which version of WebScarab do you use? I want to check the code on line 174.

..
[Android Software Development] SandroBSupp:
SandroProxy creates CA certificate on his own if none specified in settings.

http://code.google.com/p/sandrop/issues/detail?id=2#c3

...

If custom, not generated is used, be careful that it contains BasicConstraints with isCA flag set to true.

Otherwise will not be recognized as CA certificate.

...

Next step is that client trust this CA. There is also Settings -> Export CA to store it in ICS android store.

You can also build yourself working proxy from sandroproxy sources.

Just use SandroProxy plugin project to start with.

http://code.google.com/p/sandrop/source/browse/projects/SandroProxyPlugin/readme.txt

http://code.google.com/p/sandrop/source/clones
[Android Software Development] alex2308:
Even with the generated one (reinstalling the app) it pops the same error. I will try to check the source!

May it be due to server name indication within SSL? I some changes in one clone of yours:

https://code.google.com/r/b2b224442...webscarab/plugin/proxy/ConnectionHandler.java

Found your code, think I have a guess, even without compiling/debugging. This code:

https://code.google.com/p/sandrop/s...webscarab/plugin/proxy/ConnectionHandler.java

[..]
if (_base != null || _transparentSecure) {
if (_transparentSecure || _base.getScheme().equals("https")) {
_logger.fine("Intercepting SSL connection!");
String hostName = null;
if (_transparentSecure){
if (_transparentResolver != null){
hostName = _transparentResolver.getSecureHostName();
}
}else{
hostName = _base.getHost();
}
String host = "sandroproxy.untrusted";
if (hostName == null || hostName.trim().length() == 0){
hostName = host;
}

boolean isSSLPort = false;
boolean checkForSSL = true;
// 433 port should be ssl, 80 without
if (_base.getPort() == 443){
[..]

I believe _base is null (error pops at line 174, not much that can be Null here). Read the code for _transparentSecure != null and _base == null, it will go beyond all your checks.
[Android Software Development] SandroBSupp:
Can you give more information of your configuration?

Using regular proxy or transparent one? Transparent is more tricky because server certificate name must be properly set in settings.

Please try first with browser making ssl to proxy. There you can trust or reject CA certificate.

Some applications are using ssl pinning and can not be intercept.

Recently there is some sandroproxy clone that check this.

http://code.google.com/r/dextorer-sandrop/source/detail?r=b75d4cf1db9639b5ab108b86f6e07184bcc78c74

But anyway, will look at the source code to find if there are still some bugs...
[Android Software Development] alex2308:
I am using transparent proxy with accept all certificates and hostname zohan.com. it used to work some weeks/months ago. Trying with chrome and dolphin browser using transparent browser I get no connection (not even a window). Chrome says:

Fehler 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL-Protokollfehler

Edit:

I found this site reffering to the error - http://www.roezer.com/error-neterr_ssl_protocol_error/ - it says, it might be due to Chrome not allowing SSL 2.0 any longer. Could that be the issue?

Edit 2:

The SSL 2.0 does not seem to be the problem, when I do a tcpdump of packets going out, I can see the HTTP traffic but no traffic regarding HTTPS. It seems to hang within the proxy
[Android Software Development] SandroBSupp:
Recently websockets protocol was added to sandroproxy so chances are that it is broken since then.

Some previous version of apk can be send to you until problem is resolved.

Chrome also works with android os proxy settings.

You should also try with regular proxy and SandroProxy CA in android os cert store.
[Android Software Development] alex2308:
I will try, but have to go to work now. Can you send some old .apk for testing, too? Can you reproduce my error on your device?
[Android Software Development] SandroBSupp:
https://docs.google.com/file/d/0BxEHDZT3toTmbndFcVQxYW5Ka0E/edit

Will let you know when have some results of test.
[Android Software Development] alex2308:
Short update from work - This version works!

You can PN me for my gtalk or whatsapp for faster reply. Will help you testing :)

---------- Post added at 10:07 AM ---------- Previous post was at 10:01 AM ----------

Short update from work - This version works!

You can PN me for my gtalk or whatsapp for faster reply. Will help you testing :)
[Android Software Development] SandroBSupp:
Just reproduce error on latest version with <transparent proxy>/<chrome>/<https://developers.google.com>

Will send you new apk to test when issue resolved.
[Android Software Development] SandroBSupp:
Please try with this version. It was really problem that you noticed. _base was null when transparent ssl used.

1_3_58 hotfix for transparent proxy

https://docs.google.com/file/d/0BxEHDZT3toTmRUFXQ2I0MFJiQVE/edit

http://code.google.com/p/sandrop/source/detail?r=e0d6b5a9381185ab06cd4ab29afbc59447cb143e&name=1_3_57_hotfix_transparent_proxy#