Application Features & Rules

Trafexia 3.0 integrates a comprehensive suite of network traffic analysis, mock rules engine, static security audit, and AI analysis tools.

1. MITM Proxy & HTTPS / WebSocket Decryption

Real-Time HTTPS Decryption: Automatically generates and signs SSL/TLS certificates on-the-fly for intercepted domain names.
WebSocket Frame Inspection: Capture and inspect real-time WebSocket communication frames. Filter by direction (Sent / Received), message type (Text, Binary, Ping/Pong), and format JSON payloads.
Raw HTTP Stream View: View authentic HTTP/1.1 formatted request and response wire data.

Replace any API response payload with the contents of a local file from your disk:

Use Cases: Test mobile app UI states before backend APIs are deployed, test mock error JSON payloads, or load local image assets.
How to use: Specify a URL matching rule (Regex or Wildcard) and select a local file path (JSON, XML, HTML, Image).

Transparently redirect requests targeted at production domains to testing or localhost servers:

Example: Redirect all requests from https://api.myapp.com/v1/* to http://localhost:3000/v1/*.

Simulate poor network conditions to evaluate app resilience and user experience under constrained connectivity:

Preconfigured Profiles: 3G, 4G, Slow 2G/GPRS, High Latency, Offline Mode.
Custom Throttling: Customize Download speed (Kbps/Mbps), Upload speed (Kbps/Mbps), and artificial latency (Rtt in ms).

1-Click Request Replay: Click the Replay icon on the toolbar to re-execute any captured request directly against the target server.
Request Diff & Compare: Select any two requests from the traffic history to compare differences in Headers, Parameters, and Response bodies side-by-side.

Built-in static analysis engine allowing security engineers and developers to decompile and audit Android APK/XAPK files without external tools:

Decompile Engine: Decompiles AndroidManifest.xml, Java/DEX source files, layout XMLs, images, fonts, and raw assets.
API Endpoints Extractor: Automatically extracts hardcoded API URLs and hidden backend endpoints.
Secrets & Keys Scanner: Scans for embedded sensitive credentials (AWS Keys, Firebase URLs, Stripe Keys, JWT Tokens, Base64 strings).
SDK & Component Auditor: Detects third-party SDKs (Firebase, Facebook, Adjust, AppsFlyer) and flags exported components (exported="true").
AI Security Analysis: Computes an automated Security Score (0-100), delivers vulnerability recommendations, and generates ready-to-run Frida hooks.