Mobile › Module 5 › Lesson 1
Proxy Literacy
Proxy literacy names HTTP(S) intercept setup on YOUR $MOB_LAB emulator — observe lab app traffic only, not stranger or production finance sessions.
Visual · t27_proxy_literacy
Proxy literacy. $MOB_LAB only. Original Cyberlium.
Opening
A proxy shows what YOUR lab app sends — literacy names trust stores and scope, not how to MITM neighbor banking apps.
Mobile proxies (Burp Suite, mitmproxy-class tools) sit between app and server when the device trusts your lab CA and app allows cleartext or user-installed CAs on debug builds. Emulator makes CA install easier — still only for $MOB_LAB apps you own or courseware targets. Cyberlium names proxy concepts on YOUR $MOB_LAB — certificate trust, Wi-Fi proxy settings, log redaction — never intercept traffic from apps or accounts you do not authorize. Next: TLS Pinning Named.
1. Proxy components (named)
Proxy listener on workstation (8080-class). Device Wi-Fi manual proxy pointing to host IP. User CA installed in emulator credential store for HTTPS decrypt on lab builds that trust user CAs. Log viewer: method, host, path — redact tokens in notes.
On $MOB_LAB emulator, sketch four proxy setup concepts — no live stranger account traffic.
Command guide
Try these commands — Proxy components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP MASTG network — https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/ (proxy literacy) Android network security — https://developer.android.com/privacy-and-security/security-config MASVS network — https://mas.owasp.org/MASVS/0x03-MASVS-NETWORK/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
python3 -c "print('Proxy literacy: observe YOUR lab app traffic on YOUR emulator — never intercept stranger app HTTPS')"
curl -sS https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/ | head -10
curl -sS https://developer.android.com/privacy-and-security/security-config | head -8Primary tools to practice this lesson: curl, python3. Reference sites: OWASP MASTG network (https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/); Android network security (https://developer.android.com/privacy-and-security/security-config); MASVS network (https://mas.owasp.org/MASVS/0x03-MASVS-NETWORK/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What proxy teaches defenders
Insecure transport, mixed HTTP content, verbose API errors, missing certificate validation on debug builds. Production apps should fail closed when proxy CA detected — students learn why on lab APKs.
Corporate MDM and pinning block casual proxy — that is expected defender behavior.
3. Proxy ethics boundary
Forbidden: proxying roommate apps, capturing login tokens from production services you do not own, sharing intercepted PII. Allowed: proxy literacy card — four concepts, lab app package, redaction rule.
Ship: proxy literacy card for $MOB_LAB lab app traffic. Next: TLS Pinning Named.
4. What you ship: proxy literacy card for $MOB_LAB
Four proxy concepts, lab package, redaction rule. $MOB_LAB named. NO stranger traffic. chmod 600.
5. What you record before the next lesson
Date. Proxy card. $MOB_LAB named. File t27-m05-l01-proxy-literacy.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
MITM classmate social app login. Post captured Bearer tokens in chat.
Right
Write proxy literacy card for YOUR $MOB_LAB lab app. Next: TLS Pinning Named.
Mission: name proxy setup on YOUR emulator
1) List listener, device proxy, lab CA, log review. 2) Name lab app package only. 3) Write token redaction rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Debug builds may trust user CAs — release builds should not; note both on lab card.
Knowledge Check
APPLY: Proxy literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Intercepted lab logs should redact tokens before saving notes.
True or False
Knowledge Check
APPLY: Proxy on unauthorized production apps is:
Multiple choice