Auditing Android Network Traffic

What Is Your Phone Actually Sending?

From TrackerControl on F-Droid to Magisk root, LSPosed, and Inspeckage

Tools · Techniques · The Full Spectrum

Why Audit Your Phone?

  • Your phone phones home constantly — even queued while in airplane mode
    • Telemetry, crash reports, and analytics are baked into almost every app
  • Tracker SDKs are embedded without your knowledge
    • Meta, Google, Adjust, AppsFlyer, Unity Ads ship inside apps you trust
  • HTTPS doesn't hide metadata
    • ISPs and carriers log destination IPs, timing, and data volume
  • Your OS vendor is also a data collector
    • Google Play Services sends device health and usage stats as a system process
  • Device firewalls only catch what runs through them
    • Apps that connect before the VPN loads, or use hardcoded IPs, slip through
  • You can't opt out of what you can't see
    • Visibility is the prerequisite to control — auditing is step one
  • Threat model: everyone has one
    • Targeted ads → employer monitoring → state-level surveillance — pick your concern

The Auditing Spectrum

EASY — No Root Required

Install from F-Droid

  • TrackerControl (TC)
  • Warden
  • NetGuard
  • Blokada 5
  • PCAPdroid
  • Exodus Privacy scanner

MEDIUM — ADB + Desktop

Android Debug Bridge

  • HTTP Toolkit
  • mitmproxy / Charles
  • Wireshark (desktop)
  • tcpdump over ADB
  • Frida (partial root)
  • Network profiler

ADVANCED — Rooted Device

Magisk + LSPosed

  • Inspeckage module
  • JustTrustMe / TrustMeAlready
  • XPrivacyLua
  • AdAway (system hosts)
  • Zygisk hooks
  • eBPF socket tracing

TrackerControl — Your First Tool

  • Local VPN intercepts all DNS and outbound connections — no root, no server, no account
    • Every DNS query is matched against Exodus Privacy + Yale Privacy Lab tracker lists
  • Live traffic log shows which app called which domain, in real time
    • Sort by tracker count to instantly find your worst offenders
  • Per-app blocking — allow an app's own servers, block only embedded tracker SDKs
    • Fine-grained enough to keep Netflix working while blocking its analytics calls
  • Export to PCAP for deeper analysis in Wireshark on a desktop
    • Full packet captures from a device with zero root required
  • Notification badges show tracker activity on your home screen per app
    • Your alarm clock app showing 12 tracker calls will make you reconsider your app choices
  • Install path: F-Droid → search TrackerControl → install the fdroid variant (not Play Store)
    • The fdroid build has all features unlocked; the Play Store build is restricted

Warden + NetGuard — App Audit & Firewall

Warden — App Intelligence

  • Audits what trackers are compiled into an app, not just what it calls at runtime
  • Cross-references Exodus Privacy database — shows SDK names and categories
  • Works in Shizuku mode — freeze/disable tracker components without root
  • Audits permissions, services, receivers, and broadcast listeners too
  • Flags apps with aggressive background wakelock and network activity
  • Install via IzzyOnDroid repo in F-Droid settings

NetGuard — Per-App Firewall

  • Uses Android local VPN to block any app from WiFi, mobile data, or both
  • Default-deny model — start with everything blocked, whitelist what you trust
  • Background connections blocked separately from foreground — powerful for idle audits
  • Traffic log and PCAP export are free on the F-Droid build (paid on Play Store)
  • Rules survive reboots; no account or internet required to operate
  • Works perfectly alongside TrackerControl when run in sequence

Medium Tier — Capture & Decrypt Traffic

PCAPdroid — No-Root Packet Capture

  • Saves full .pcap files you open in Wireshark on your desktop
  • Shows connection metadata without decryption: destination IP, port, bytes, app
  • With system CA install (medium effort): full HTTPS decryption for non-pinned apps
  • Detects apps bypassing system DNS — highlights hardcoded resolver connections
  • Available on F-Droid and Play Store — F-Droid build has no restrictions
  • Export and share captures for collaboration or documentation

HTTP Toolkit — ADB HTTPS Interception

  • Connects via ADB and installs a CA cert automatically — no manual certificate setup
  • Full HTTP/HTTPS request + response viewer with search and filtering
  • Bypasses pinning automatically on apps with targetSdk < 24 (many older apps)
  • Rewrites and blocks individual requests in real time — useful for testing
  • Free tier at httptoolkit.com covers everything needed for a personal audit
  • Ideal for a focused one-session audit on a dedicated test device

Medium Tier — Proxy & Raw Capture

mitmproxy — Scriptable HTTPS Proxy

  • Run on desktop, point phone's WiFi proxy setting at your machine's IP
  • Free, open source, Python-scriptable — write addons to auto-flag tracker endpoints
  • Charles Proxy is the paid GUI alternative — same concept, better UX for beginners
  • Install mitmproxy CA on device to see HTTPS plaintext content
  • Certificate pinning blocks this on hardened apps — see the pinning slide for bypasses
  • mitmproxy addons can log, modify, or replay any captured request automatically

ADB + tcpdump — Kernel-Level Capture

  • Captures at the kernel network stack — bypasses VPN blind spots entirely
  • Push a statically compiled tcpdump binary or use one pre-installed on rooted devices
  • Pipe live to Wireshark on your desktop with no intermediate file: 
adb exec-out tcpdump -i any -w - | wireshark -k -S -i -
  • Requires USB Debugging enabled in Developer Options — no root needed for basic capture
  • Sees traffic from all apps simultaneously, including system processes

The Certificate Pinning Problem

Scenario Detail
What is cert pinning? App ships a hardcoded list of trusted keys. Your installed CA is rejected entirely.
Who uses it? Banking, payment, social media (Instagram, WhatsApp, TikTok), all Google apps
No-root option HTTP Toolkit auto-bypasses apps with targetSdk < 24. Older apps often unprotected.
MagiskTrustUserCerts Promotes user-installed CAs to system store. Bypasses apps that check user trust.
Frida (nuclear) Hooks the SSL library at runtime and returns true for any cert. Root or patched APK.
JustTrustMe (LSPosed) Xposed module that strips SSL checks in the target app process. Point-and-click.
TrustMeAlready Updated fork of JustTrustMe — better compatibility with modern Android versions
objection (Frida wrapper) CLI tool that automates Frida-based pinning bypass — one command, any app

Advanced Tier — Rooting & Magisk

Why Root for Network Auditing?

  • Access /proc/net/ — raw kernel socket tables showing every active connection
  • Run tcpdump, strace, bpftrace natively without ADB tunneling overhead
  • Mount system CA store — make your cert trusted system-wide, bypassing user trust checks
  • Use eBPF programs to trace socket syscalls at the kernel level
  • Block connections at iptables/nftables level, below the app and VPN layers
  • Install Magisk modules that hook into apps before they even start

Bootloader + Magisk Setup

  • Settings → Developer Options → OEM Unlock → fastboot flashing unlock (wipes device)
  • Pixel phones easiest; OnePlus, Fairphone good; Verizon/Samsung carrier locks vary
  • Patch boot.img using the Magisk app → fastboot flash boot magisk_patched.img
  • Magisk operates systemlessly — does not modify /system, survives some OTAs
  • Zygisk DenyList hides root from banking apps and Play Integrity checks
  • Install from github.com/topjohnwu/Magisk — always use the official Releases page

LSPosed & Xposed — Hook Into Any Process

The Framework Stack

  • Xposed (classic) — original ART hook framework by rovo89; mostly replaced now
  • LSPosed — modern replacement via Zygisk; per-app scope, active Android 8–14 support
  • Install LSPosed as a Magisk module — flash the zip from the LSPosed GitHub releases
  • Manage modules via the LSPosed app (use the hidden icon for stealth from root detectors)
  • EdXposed — Riru-based alternative for older devices (Android 8–11), less maintained
  • Each module declares which apps it hooks — zero performance cost on unscoped apps

Key Modules for Network Auditing

  • JustTrustMe — strips certificate pinning from any scoped app
  • TrustMeAlready — updated fork with better modern Android support
  • Inspeckage — full runtime audit: network, crypto, file I/O, reflection, all logged
  • XPrivacyLua — feed fake GPS, IMEI, contacts, and sensor data to any app
  • AppSystemizer — elevate user-installed apps to system privilege level
  • Access Inspeckage audit UI at http://127.0.0.1:8008 while target app is running

What You Will Actually Find

  • Advertising SDKs firing on every app open
    • Adjust, AppsFlyer, MoPub, ironSource — sending device fingerprint, app events, location
  • Google Play Services telemetry running as a system process
    • Crash reports, device health, usage metrics — cannot be blocked without root
  • Analytics frameworks in nearly every commercial app
    • Firebase Analytics, Mixpanel, Amplitude, Segment — behavioral tracking baked deep
  • Crash reporters holding device snapshots
    • Sentry, Crashlytics, Bugsnag — stack traces plus device state sent to third-party servers
  • Silent background syncs on a timer
    • Contacts, calendar metadata, photo hashes synced even when apps are "closed"
  • DNS exfiltration and DoH bypasses
    • Apps hardcoding 8.8.8.8 or using DNS-over-HTTPS to circumvent your resolver blocks
  • Undocumented API calls revealed by bypassing pinning
    • Once cert pinning is stripped, banking and social apps often show calls you never expected
  • Your alarm clock talking to twelve advertising servers
    • The first time you audit a free app will permanently change how you evaluate app stores

Choosing Your Tool — Quick Reference

Goal No Root Root Required
Block trackers system-wide TrackerControl + NetGuard AdAway system hosts
See which domains an app calls TrackerControl live log Inspeckage Network tab
Capture full PCAP PCAPdroid tcpdump direct on device
Decrypt HTTPS (no pinning) HTTP Toolkit mitmproxy + JustTrustMe
Decrypt HTTPS (pinned apps) Frida + patched APK LSPosed JustTrustMe
Audit a specific app deeply Warden + Exodus Inspeckage full audit
Block at DNS level TrackerControl / Blokada AdAway hosts file
Real-time packet view PCAPdroid → Wireshark desktop tcpdump piped via ADB
Fake data sent to apps — XPrivacyLua (LSPosed)

Hands-On Lab — No-Root + ADB Setup

No-Root Setup (~30 Minutes)

  • Install F-Droid from f-droid.org — add IzzyOnDroid repo in settings
  • Install TrackerControl, PCAPdroid, Warden from F-Droid
  • Enable TrackerControl VPN — it never leaves your device
  • Use apps normally for 10 minutes; check the live log sorted by tracker count
  • Export a PCAP from PCAPdroid and open it in Wireshark on desktop
  • In Warden: scan your top 5 most-used apps and read the Exodus tracker list

ADB + HTTP Toolkit Setup

  • Enable Developer Options: tap Build Number 7 times in Settings → About Phone
  • Enable USB Debugging and connect USB cable; run adb devices to confirm
  • Install HTTP Toolkit on your desktop from httptoolkit.com
  • HTTP Toolkit → Android Device → follow the wizard (installs CA automatically)
  • Open the target app — watch requests populate in real time in HTTP Toolkit
  • If HTTPS shows blank: cert pinning is active — this app needs the advanced approach

Hands-On Lab — Rooted Device Setup

Magisk + LSPosed Install

  • Flash Magisk: patch boot.img with Magisk app → fastboot flash boot magisk_patched.img
  • Verify root: open terminal app → type su → prompt should change to #
  • In Magisk → Modules → install LSPosed zip from github.com/LSPosed/LSPosed
  • In LSPosed → install JustTrustMe and Inspeckage from the modules repo
  • Scope both modules to your target app in LSPosed; reboot to apply

Using Inspeckage

  • Open target app — Inspeckage intercepts all calls in that process
  • Open browser on device or desktop: navigate to http://127.0.0.1:8008
  • Check the Network tab: all HTTP/HTTPS requests with full headers and bodies
  • Check Crypto tab: see what encryption keys are being generated or used
  • Export the full JSON audit log for documentation or sharing
  • If HTTPS is blank with JustTrustMe scoped: try TrustMeAlready as a replacement

Resources

Tool Where to Get It
F-Droid f-droid.org — FOSS Android app store, no account
TrackerControl F-Droid: search TrackerControl (fdroid variant)
PCAPdroid F-Droid: search PCAPdroid
Warden F-Droid via IzzyOnDroid repo
NetGuard F-Droid: search NetGuard
HTTP Toolkit httptoolkit.com
mitmproxy mitmproxy.org
Magisk github.com/topjohnwu/Magisk
LSPosed github.com/LSPosed/LSPosed
Inspeckage github.com/ac-pm/Inspeckage
JustTrustMe github.com/Fuzion24/JustTrustMe
TrustMeAlready github.com/ViRb3/TrustMeAlready
XPrivacyLua github.com/M66B/XPrivacyLua
Exodus Privacy exodus-privacy.eu.org — scan any APK online
AdAway adaway.org or F-Droid