flowtrans-capture

A Claude Code skill for automated Android HTTPS packet capture on a rooted device — transparent transport via FlowTrans (mihomo TUN), decryption via mitmweb, and SSL-unpinning via Frida. Everything is driven from one Python entrypoint, scripts/capture.py, over adb — no screen taps.

Forwarding tool: this skill drives FlowTrans — a mihomo-based VpnService/TUN forwarder that transparently redirects an app's traffic to your PC's mitmproxy (upstream 127.0.0.1:8080). Any other VpnService forwarder with the same upstream works too, but the flowtrans subcommand's prefs/VPN control is written for FlowTrans specifically.

面向已 root 的 Android 设备的一键抓包 skill:FlowTrans TUN 透明劫持 → mitmweb 解密 → (证书固定时)Frida 脱壳,全程 python scripts/capture.py + adb。

Why

Most apps (OkHttp/Cronet) ignore the system HTTP proxy, so "install a CA + set a proxy" isn't enough. FlowTrans forwards at L3 (TUN) to 127.0.0.1:8080 → adb reverse → PC mitmweb.

App ─▶ FlowTrans TUN ─▶ device 127.0.0.1:8080 ─▶ adb reverse ─▶ PC mitmweb ─▶ internet

Quick start

python scripts/capture.py preflight                                  # check PC + phone env
python scripts/capture.py flowtrans --pkg com.example.app --mitmweb  # target + reverse + mitmweb + VPN

mitmweb UI: http://127.0.0.1:8081 (password flowtrans). Full workflow, troubleshooting, Frida unpinning, and API-replay methodology live in SKILL.md and references/.

Passwords / 密码

The only password the tool sets is the mitmweb Web UI login: flowtrans (via --set web_password=flowtrans). Open http://127.0.0.1:8081 and enter flowtrans (or use http://127.0.0.1:8081/?token=flowtrans). Change it with mitmweb --set web_password=<yours> if you rebuild the command. Upstream-proxy credentials are yours — supply them via --us-proxy / CAPTURE_US_PROXY, never hardcode them.

工具只设一个密码:mitmweb Web UI 登录密码 = flowtrans。开 http://127.0.0.1:8081 输入即可。上游代理的账密是你自己的,用参数/环境变量传,别写进脚本。

Upstream exit: direct vs overseas proxy / 上游出口

mitmweb makes the real outbound request. Two exit modes:

• Direct (default) — out through this PC's network. Use for local/regional apps.
• Overseas proxy — for apps that only work from a specific region: chain mitmweb → pproxy → your overseas HTTP proxy.

flowtrans --mitmweb is direct by default; add --us-proxy for the overseas exit — one command:

# credentials via env (never hardcode); syntax is #user:pass, NOT user:pass@host
set CAPTURE_US_PROXY=http://1.2.3.4:50100#user:pass
python scripts/capture.py flowtrans --pkg com.main.gopuff --mitmweb --us-proxy %CAPTURE_US_PROXY%

It launches pproxy -l http://:8888 -r <your overseas proxy> and runs mitmweb in upstream mode → mitmweb → pproxy:8888 → overseas → internet.

• Credential syntax: scheme://host:port#user:pass (trailing #user:pass, a pproxy quirk — not @).
• Verify the exit country: curl -x http://127.0.0.1:8888 "http://ip-api.com/json/?fields=query,country,city".
• Upstream unreachable → mitmweb returns 502/503: test curl -x through pproxy first.

Viewing & filtering requests in mitmweb / 查看与筛选请求

Open http://127.0.0.1:8081 (password flowtrans). Type a filter expression in the top search box to narrow the flow list (mitmproxy filter syntax):

Filter	Matches
~d sainsburys.co.uk	by domain/host (regex)
~u /graphql	by URL (regex)
~m POST	by method
~c 200 / ~c 4..	by response status code
~bq token / ~bs eyJ	request / response body (regex)
~t json	by content-type
~d api.foo & ~m POST	combine with & `

Offline, filter the saved .flows with mitmdump:

# print only Sainsbury POSTs, with headers+body
mitmdump -nr scripts/captures/com.sainsburys.gol.flows "~d sainsburys & ~m POST" --flow-detail 2

# extract a filtered subset to a new file
mitmdump -nr scripts/captures/com.sainsburys.gol.flows -w subset.flows "~d api.sainsburys.co.uk"

To script over all flows (e.g. locate where a token is issued), use mitmweb's HTTP API — see references/replay.md.

Stopping & cleanup / 停止与清理

Stop the capture chain / 停止抓包

# TUN path — stops FlowTrans VPN (tun0), mitmweb, and pproxy
python scripts/capture.py flowtrans --stop

# frida/start path (also clears the device global proxy)
python scripts/capture.py stop

# optional: remove the adb reverse tunnel and (if running) frida-server on device
adb reverse --remove-all
adb shell su -c "pkill frida-server"

Clean up captured data / 清理抓下来的包

Captures and logs are written next to the scripts and are git-ignored (never committed), but they can contain sensitive decrypted traffic (tokens, personal data) — delete them when done:

# flow archives + logs (bash / git-bash)
rm -f scripts/captures/*.flows scripts/*.log scripts/*.err.log

# PowerShell
Remove-Item scripts\captures\*.flows, scripts\*.log, scripts\*.err.log -Force -ErrorAction SilentlyContinue

• Flow archives: scripts/captures/<target>.flows (path set by --save).
• Logs: scripts/mitmweb.log · mitmweb.err.log · pproxy.log · unpin.log.
• Nothing sensitive is left on the device by a normal run; the temp files it uses (/sdcard/_ft.xml, /sdcard/_devca) are removed automatically.

The raw adb commands FlowTrans is driven by (write routing prefs, start/stop the VpnService, reverse tunnel) are documented in the FlowTrans app README → Command-line control (adb). This skill automates that sequence.

Requirements

• Rooted Android device (KernelSU/Magisk) with the FlowTrans forwarder installed, and adb.
• PC: Python with mitmproxy + click + cryptography; adb on PATH.
• For pinned apps: a matching frida-server on the device (not bundled).
• mitmproxy CA trusted by the device (e.g. MoveCertificate on Android 14).

Paths/credentials are read from the script's own directory and environment variables — nothing hardcoded. See the "首次配置" section in SKILL.md.

⚠️ Scope

For authorized security testing, debugging your own apps, and learning only. Respect the terms of service and law that apply to any app you inspect.

Background writeup: https://kingjem.github.io/2026/07/20/Android抓包实战全流程-FlowTrans-mitmweb-Frida-重放/