MITMproxy - how to get working with apps? - Android Q&A, Help & Troubleshooting

Hello,
I want to inspect some traffic from one specific app and found this blog post https://medium.com/@gaikwadchetan93...rk-traffic-via-mitm-proxy-part-1-886f6324f705
The MITM Proxy is working fine with HTTP and also HTTPS in Chrome, but not in other Apps.
I've found out, that since Android Nougat no certificates from user store will be trusted and in the blogpost he wrote to edit res/xml/network_security_config.xml.
But how do I do this? I didn't developed this app, I've downloaded it from play store.
I think i have to use a rooted phone, whats no problem, but how to I do this.
How do I edit the res/xml/network_security_config.xml or is it possible to move the certificate from user to system store?
Thank you for your Help

Related

[Q] How Does the Google Play Store Package Create Restrictions??

This is my first post, so hope to get some good replies here .
Lots of Android users complain about a few issues related to Google Play.
a) country restrictions
b) access to paid apps
c) access to "device-specific" apps
For me, I'm really curious about how the Google Play app is creating these restrictions. I've noticed that Deeco7 and xinfinityoO have created mods to the stock APK in order to help people get around these restrictions and access more apps.
But how is Google Play specifically running its restrictions? I know one small part of device authentication comes from build.prop's ro.build.fingerprint. But does anybody have a good explanation for the overall restriction/authentication process? What is it about apps like MarketEnabler that allow (or not be able to allow) devices to circumvent Google Play restrictions?
Officially, manufacturer firmware builds need to pass Google CTS tests in order to get a "license" to use Google Play. Not sure if anyone knows whether or not an authentication key is signed for a particular device once it passes CTS, and if that plays a role in granting specific Google Play app access.
Look forward to any helpful facts.

Is there any way to access google market/play without a smartphone ?

Hello
My question is:
Is there any way to access google market/play without a smartphone?
Because there are people out there, that do not like to synchronize their mobile phones to google or don't want google to see their behaviour and more on smartphones.
A while ago I read something about a small team that could get access to the market throught the sdk or combined with it.
However, if someone allready did it, I would be thankful to get some more information about it.
You can go to the website.
There is also an unofficial API and a few applications for Java and Win32 to download apks with your market profile.
Web browser, tinfoil hat optional.
I'm using Real Apk Leecher tool for windows but keep in mind that this is against the google rules...
Maybe try play.google.com?
Matheus-007 said:
Maybe try play.google.com?
Click to expand...
Click to collapse
He wants the apk, at play.google.com you can only login with your gmail account and send the apps to your phone instead of getting the apk's to your pc :/
thanks for the tips!!
any other suggestions?
theres a whole host of other sites you can use, if you type the app name in google
it will probably direct you to the play store first then give you options of other sites to choose from where you can download them . . mainly if the apps are free though
http://download.pandaapp.com/
^^ that is a site i've used a couple of times.
transfer the app onto your and use a file manger like Astro to install.

Cloud service for Android app development

Hi,
I want to write an app which can synchronize data (of the app) stored on an Android phone to a web server. Could anyone point me a book/forum/website which tells us about this type of implementation? As far as I know, I found
openmobster (i can not post a link yet)
(but I haven't tried it yet)
and some description about gsync.
Thanks!
look for SampleSyncAdapter example.........
then you'll need to have django installed to do this, and google app engine installed. Launch the webapp from google appengine and then point your browser to the url show in the appengine applicaiton.
installing django
gappengine
Thanks alot,
I'll have a look at these sites.

Google Play API App Fetcher

Hey guys! I used to download apps from google play using this tool apify
but it seems to always be broken, maybe too many people using it. Does anyone know of a similar tool that uses the same functionality, but doe snot encrypt the end result links/downloads? Basically, i am looking for a API tool that can download apps from google play without a PIN ID or email address

General Download Any Apk Off The Playstore Without installing Google, AMAZON, or Any other APP Store

EDIT-- This post is super old (but still works).
Another method (maybe better for your use case?) is the Aurora store. Please see the COMMENTS SECTION.
How To Download any app on the playstore, Without installing GMS, GAPPS, AMAZON, Or any other App Store
EVOZI:
https://apps.evozi.com/apk-downloader/
GOOGLE PLAY STORE:
Android Apps on Google Play
Enjoy millions of the latest Android apps, games, music, movies, TV, books, magazines & more. Anytime, anywhere, across your devices.
play.google.com
Simply paste the playstore link to evozi, of the app you want to download!
This is not warez, you Can Not Download Paid apps.
This site just caches and backs up all our favorite apps.
Rarely, if you're looking for something too obscure, it will not be able to locate it.
Have Fun
Google Play Store lets you download and install Android apps on an Android-powered phone or tablet or emulator if GMS Core already are installed thereon.
Sometimes evozi will say something about "you're being rate limited" and it won't work. I think this is bc they are getting too much traffic. I use Evozi in this example, as it is the cleanest (adless) experience, but do bare in mind you can always use other Mirrors~! sites like APKpure.com are mostly safe
any idea how does https://apps.evozi.com/apk-downloader/ work as am trying to automate some work and i dont want to depend on apk-downloader or any other mirror
@synackers sorry I just now had the time to research what I wanted to share. There's a "store" that has access to the playstore repositories, that is open source, and gives the user the freedom to choose to enable google features or not. This works on windows phones too and I would guess WSA too?
It is called the "aurora store" it's website is here:
auroraoss.com
This is still new to me so I can not explain it personally but the knowledge is available
This article explains a little about it and shows pictures
Maybe they have a github repo somewhere you can obtain the code you need to dl things
Hope it helps!
Hi Jeneh , to be honest am not interested in any open source apk mirroring available in internet
am seeking to understand how auroraoss or evozi actually works behind the screen ... how do they give you apk to be downloadable is also fetched from other mirror or do they have google developer and google offer any api to play store ..etc
more deep technical details is of my interest . i do appreciate your feedback
@synackers The Aurora Store is different from evozi or other sites like evozi, in that it actually accesses the repositories, ie the link to the android app in question.
For instance: to download the app "Termux" a call is made to get the app from com.termux and it goes on to install and build from there, the latest software.
When using evozi or apk mirror, they save actual hard copies of the apps to their servers to share to users, which could be any older version of the app.
Evozi regularly redownloads the more popular apps from the play store and they take requests. However there is No version choice available. The downloaded apks hash signatures will match the playstore app sigs for that app version.
Sites like apk mirror and others tend to keep all the older app versions and provide a choice which version to download. This is my only use case for these as they are more risky and you should vet the sigs on them.
Here is aurora's gitlab https://gitlab.com/AuroraOSS/AuroraStore
This link has all the code to be able to go through and find exactly what you need.
Some info on the code
"Aurora Store was originally based on Sergei Yeriomin's Yalp store. Aurora Store v4.0 is a rewrite of version 3 in Kotlin"
The developer of the store has made a page here on xda that maybe they would be willing to give better insight to a specific question you have in the installation process to provide the technicals.
Outside of Aurora, it may be beneficial to learn about PackageInstaller to be able to manually install and or uninstall apps with code. Or Package Manager, if you open that spoiler and select the "PM" option you can see all the code for using it.
Hi Jenneh ,
much appreciate your response and cooperation |
https://www.codevoila.com/post/77/how-to-install-or-uninstall-an-android-apk-file-programmatically this is definitely valuable and its crystal clear for me on how aurora works.. i had a glance at the code in github .
now my challenge or use case which i want to achieve is as following ;
1. need to take APK directly from play store ( i dont mind if google offer paid API which am not aware or seen )
this should be automated off android physical phone / or emulator
working in other project ^^ and stuck in this point
what i have noticed indeed evozi take package from playstore cause i checked an APK which recently was published and not available in any other mirror site
Aruroa still need mobile phone or emulator to work
Thanks again and appreciate your cooperation
With regards to thread's title "Download Any Apk Off The Playstore Without installing Google, AMAZON, or Any other APP Store" take note that you of course need an app store to get APKs from.​
Never make use of Aptoide: it's Large, Decentralized, Dangerous.
Aptoide is one of the most sophisticated app sources. The store works with a distributed network of different store providers and combines them on a unified platform. However, this poses significant security risks.
Truely not what am seeking , any mirror is not an enterprise grade options cause security risk is high so if there is any way to download directly apk from play store without the need for emulator or device would be much appreciated
The app store with least security risks is Google Play Store.
Apps from outside of the Google Play Store are also scan using Google Play protect on the device, it is a security risk to install apps outside of the Play Store but as long as you trust the app developer you should be fine.
well, what is the case if i need to automate a way for MDM solutions
IDK.
Probably MDM isn't not applicable if the managed devices differ in Android version and ARM architecture.

Categories

Resources