# Inspecting Android HTTP with a fake VPN

DevFeed: [Inspecting Android HTTP with a fake VPN](<https://devfeed.tech/articles/inspecting-android-http-with-a-fake-vpn-19077.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/inspecting-android-http/>)

Author: HTTP Toolkit; Tim Perry

Published: 2020-08-25T12:20:00Z

Content type: tutorial

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Virtual Private Network](<https://devfeed.tech/topics/vpn.md>), [Android](<https://devfeed.tech/topics/android.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [debugging](<https://devfeed.tech/topics/debugging.md>), [Firewall](<https://devfeed.tech/topics/firewall.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [http](<https://devfeed.tech/tags/http.md>), [interception](<https://devfeed.tech/tags/interception.md>), [testing](<https://devfeed.tech/tags/testing.md>), [tooling](<https://devfeed.tech/tags/tooling.md>), [vpn](<https://devfeed.tech/tags/vpn.md>)

## AI overview

This tutorial explains how HTTP Toolkit uses Android VPN APIs to create an on-device fake VPN that can inspect and rewrite network traffic from other apps. It describes the VPN tunnel interface, protected sockets, and developer uses including testing, debugging, firewall rules, traffic metrics, and simulated connection failures. By default, the approach does not read encrypted traffic.

## Source excerpt

Can you build an Android app that can inspect & rewrite the network traffic from every other app on the device? In turns out that, yes, you can. HTTP Toolkit does exactly this, by building an app on top of the Android VPN APIs that fully simulates a fake VPN connection entirely within the device. Here I want to talk through how that works, look at the code that makes it happen, and show you how you can do the same thing for yourself. To be clear, this is not intended (or very effective) as a attack on the security of traffic from the device. When you actually do this Android provides clear warnings & permission prompts to the user during setup, and requires persistent UI notifications any time this is active. In addition this doesn't give you any way to read the contents of encrypted traffic, by default (in the next post, we'll talk about how HTTP Toolkit can do that). There are some interesting & constructive use cases this opens up though for developer tooling. For example: Inspecting & rewriting mobile traffic for testing & debugging (this is HTTP Toolkit's raison d'être). Building a firewall for Android that blocks outgoing app connections according to your custom rules. Recording metrics on the traffic sent & received by your device. Simulating connection issues by adding delays or randomly injecting packet resets. How do Android VPNs work? The Android developer docs have a VPN guide, which is a good starting point. These VPN APIs allow you to register a service in your app, which when activated is given a file descriptor that backs a network tunnel interface. That tunnel interface is then used by the whole device for all network traffic. In addition, your VPN service is given the power to create protected sockets that don't use this tunnel, so the VPN app can communicate with the network without going through itself. Once this is activated, when an app sends some data, instead of that going out to the network, each IP packet is buffered behind this file descri