#HTTP TOOLKIT ANDROID INSTALL#

Use a non-rooted device, and make some minor config changes to the target application (trivial if it's your own application, slightly more difficult if it's not). Connect an Android emulator or a rooted device to ADB, in which case HTTP Toolkit can do totally automated setup for you. In short, most of the time you need to either: If you want, you can still do the normal steps to do full system interception manually if you'd prefer that, but by default it uses entirely transient and permissionless targeted interception instead, and that's almost always the better approach. You can even open two HTTP Toolkit windows on one machine, and intercept things separately into each one. That way you get much less noisy intercepted traffic for your debugging, and you can freely add rules to rewrite/break traffic without interfering with anything else. That works by injecting cert & proxy config into a single browser window, intercepting specific Android apps, targeting individual Docker containers etc. That's because the key differentiator of HTTP Toolkit vs Fiddler/Charles/mitmproxy etc, is that it provides targeted interception, rather than intercepting your entire system at once. The deb package doesn't do anything different to any others. It doesn't change any system configuration whatsoever, and it doesn't need any admin/root privileges.

#HTTP TOOLKIT ANDROID INSTALL#

It actually doesn't install system certificates at all though. I'm the author, that's exactly it! The contents of that interceptors folder should give you an idea how it all works.

Http toolkit android