Proxy Literacy
Proxy literacy names HTTP(S) intercept setup on YOUR $MOB_LAB emulator — observe lab app traffic only, not stranger or production finance sessions.
Visual · t27_proxy_literacy
Proxy literacy. $MOB_LAB only. Original Cyberlium.
A proxy shows what YOUR lab app sends — literacy names trust stores and scope, not how to MITM neighbor banking apps.
Mobile proxies (Burp Suite, mitmproxy-class tools) sit between app and server when the device trusts your lab CA and app allows cleartext or user-installed CAs on debug builds. Emulator makes CA install easier — still only for $MOB_LAB apps you own or courseware targets. Cyberlium names proxy concepts on YOUR $MOB_LAB — certificate trust, Wi-Fi proxy settings, log redaction — never intercept traffic from apps or accounts you do not authorize. Next: TLS Pinning Named.
1. Proxy components (named)
Proxy listener on workstation (8080-class). Device Wi-Fi manual proxy pointing to host IP. User CA installed in emulator credential store for HTTPS decrypt on lab builds that trust user CAs. Log viewer: method, host, path — redact tokens in notes.
On $MOB_LAB emulator, sketch four proxy setup concepts — no live stranger account traffic.
Command guide
Try these commands — Proxy components (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, python3. Reference sites: OWASP MASTG network (https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/); Android network security (https://developer.android.com/privacy-and-security/security-config); MASVS network (https://mas.owasp.org/MASVS/0x03-MASVS-NETWORK/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What proxy teaches defenders
Insecure transport, mixed HTTP content, verbose API errors, missing certificate validation on debug builds. Production apps should fail closed when proxy CA detected — students learn why on lab APKs.
Corporate MDM and pinning block casual proxy — that is expected defender behavior.
3. Proxy ethics boundary
Forbidden: proxying roommate apps, capturing login tokens from production services you do not own, sharing intercepted PII. Allowed: proxy literacy card — four concepts, lab app package, redaction rule.
Ship: proxy literacy card for $MOB_LAB lab app traffic. Next: TLS Pinning Named.
4. What you ship: proxy literacy card for $MOB_LAB
Four proxy concepts, lab package, redaction rule. $MOB_LAB named. NO stranger traffic. chmod 600.
5. What you record before the next lesson
Date. Proxy card. $MOB_LAB named. File t27-m05-l01-proxy-literacy.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: MITM classmate social app login. Post captured Bearer tokens in chat.
- Right: Write proxy literacy card for YOUR $MOB_LAB lab app. Next: TLS Pinning Named.
Mission: name proxy setup on YOUR emulator
1) List listener, device proxy, lab CA, log review. 2) Name lab app package only. 3) Write token redaction rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Debug builds may trust user CAs — release builds should not; note both on lab card.
APPLY: Proxy literacy on Cyberlium means:
APPLY: True or False: Intercepted lab logs should redact tokens before saving notes.
APPLY: Proxy on unauthorized production apps is: