Any Idea how to achieve this rather advanced attack ? (similar to traffic analysis attack)

[minanagehsalalma]

I made a video demonstrating the idea

traffic.portal.mp4

what i am lost at is ... how to know if a user just opened an app like FB for example... so the attack becomes convenient

[abhinavsingh]

With TLS Interception enabled https://github.com/abhinavsingh/proxy.py#tls-interception you should be able to inspect all the request attributes. You can use one of the existing plugin as basis of your own custom plugin.

[minanagehsalalma]

You can use one of the existing plugin as basis of your own custom plugin.

@abhinavsingh what plugins do you suggest ?