# 分析-FactsDroid: Your Universal Knowledgebase

Craving a smarter way to soak up bite-sized knowledge? Say hello to FactsDroid, your sleek and modern companion for discovering mind-blowing facts anytime, anywhere. Built with a stunning Material 3 design and fluid animations, FactsDroid curates random facts from reliable sources and presents them in an engaging, informative format.

Love what you learn? Rate each fact using a 5-star system and save your favorites to a private vault. Thanks to its encrypted local database, your fact collection stays secure and just for you.

Wrapped in vibrant gradients and an intuitive layout, FactsDroid turns everyday curiosity into a fun, stylish experience.

## 安装包

examples/android/FactsDroid.apk

## 安装信息

APK已经安装到了 `emulator-5554	device`设备上。

## Objective

Learn the art of network interception. Your goal is to intercept the network traffic generated by FactsDroid in a tool that supports dynamic tampering with network traffic such as Burp Suite or Charles Proxy. You should be able to view and modify the API requests and responses between FactsDroid and the backend server without statically patching the provided APK.

Successfully implement a Machine-in-The-Middle (MITM) attack that allows you to manipulate the facts being displayed to the user, potentially inserting custom content or modifying the retrieved facts before they reach the application.

Successfully completing this challenge demonstrates important skills in network security analysis, understanding of mobile app API interactions, and highlights the importance of proper certificate validation and network traffic encryption in mobile applications.

## Restrictions

Your solution must work without statically modifying the original APK file and should demonstrate the complete interception workflow, from setup to successful traffic interception. The approach should be applicable to modern Android versions (Android 14+) and focus specifically on network traffic interception techniques.

At no point are you allowed to modify the “request” sent to the backend server. Exploiting the backend server is out of scope for this challenge. Response manipulation is fair game.
