For mobile apps using token-based authentication (like JWT):
Warning: Do not attempt this on any network or device you do not own or have explicit written permission to test.
If you want to recreate the FaceNiff experience legally, you can set up a virtual lab using VirtualBox: Faceniff Apk Download For Android
Process:
Again, this is an academic exercise. In 2025, even this lab setup will fail against modern HTTPS sites. For mobile apps using token-based authentication (like JWT):
Android 9 (Pie) and above default to disallowing cleartext (HTTP) traffic. Developers should ensure they do not bypass this security feature.
<network-security-config>
<base-config cleartextTrafficPermitted="false">
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
</network-security-config>
For educational labs using old operating systems (like Windows XP with IE6), Cain & Abel is the classic ARP poisoning tool. Never use this on modern networks or without authorization. Process:
Before attempting to use the tool, your Android device must meet specific requirements:
Since Faceniff is a network testing tool, it is not available on the Google Play Store. You must download the APK file from third-party sources.
Steps to Download: