r0ysue/r0capture

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

7750 stars · 1516 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A Frida-based universal Android application-layer packet capture script that hooks SSL/TLS regardless of certificate pinning, obfuscation, or app framework. It captures traffic from all common protocols and frameworks, exports client certificates, locates send/receive functions, and can save captures as pcap files for Wireshark analysis.

Use cases

• capture https traffic from android apps bypassing ssl pinning
• dump android app network traffic to pcap for wireshark analysis
• export client certificates from android apps
• locate send and receive functions in an android app
• intercept okhttp and httpurlconnection traffic on android
• debug app network protocols on a rooted android device

When to choose

• you need to capture encrypted app traffic on a physical Android device without dealing with certificates
• the target app uses certificate pinning, obfuscation, or common HTTP libraries
• you want pcap output or client certificate extraction during security analysis

When to avoid

• the target uses Flutter, WebView, or custom SSL frameworks, which are unsupported
• you need HTTP/2 or HTTP/3 capture
• you only have an emulator instead of a real device
• you need multi-process app capture without extra work

Facets

cli-tool · maturity active

security networking reverse-engineering developer-tools security penetration-testing reverse-engineering android-tools developer-tools python cli frida packet-capture ssl-pinning-bypass android pcap traffic-capture hooking

Member repositories

For agents

markdown · JSON · MCP: product_card(name="r0ysue/r0capture")