Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Can't intercept flutter application using burpsuite

vasantha | Last updated: Mar 27, 2023 06:06PM UTC

Hi Team, We are not able to intercept the flutter Application traffic in burp-suite. Questions: I) Is it possible to intercept traffic using? II) How can i intercept traffic using burp?

Ben, PortSwigger Agent | Last updated: Mar 28, 2023 09:44AM UTC

Hi Vasantha, My understanding is that applications developed using the Flutter framework do not adhere to the system proxy settings unless specifically developed to do so. Is it the case that the application that you are testing works but you simply see no traffic appearing within Burp when you are attempting to proxy the traffic? If so, this would seem to indicate that the above is the case. You might be able to use the ProxyDroid Android app to force all the traffic from the device to the Burp proxy via Iptables. The following article has some useful information regarding this: https://blog.nviso.eu/2019/08/13/intercepting-traffic-from-android-flutter-applications/

Dario | Last updated: Jul 20, 2023 02:13PM UTC

I believe the best technique is using NoPe extension, by simply Burp acting as DNS server and intercepting the https traffic????

Umair | Last updated: Sep 25, 2024 05:51AM UTC

I got stuck in this and was able to SOLVE IT. 1. I tried the normal way, by proxying the WIFI but didn't work because the APK I was testing is a flutter app. 2. Tried changing the proxy in the emulator, but it didn't boot the android device. 3. Then tried Proxydroid and similar apps, It didn't proxy to burp properly. Showed I have network issues after turning on the proxy. 3. Then tried reflutter, SSL pinning bypass and every possible thing and still it was the same. 4. Then I FOUND THE WAY to connect with HTTP Toolkit. You can get it from here: https://httptoolkit.com/ Steps to connect: ------------------ 1. Installed HTTP Toolkit (available for Linux/ Windows). 2. Turn the android device on. 3. Go to HTTP Toolkit and select (Intercept > Android App via Frida)or (Intercept > Android Device via ADB)[This feature worked for me well than choosing frida option since its still at developing phase] 4. It will do all the necessary configurations and a connection request will pop up in your android device. Accept and test your app. The requests will proxy through HTTP Tool kit. (At this point, check the requests proxy through toolkit) HTTP Toolkit allows you to capture and modify the requests in pro version. 5. To connect to Burpsuite. Go to HTTP Toolkit > Settings > Connection Settings a. Set proxy as "Use an HTTP Proxy" b. Set HTTP host proxy details as "<IP OF THE BURPSUITE MACHINE>:<PORT>" of the machine. Then press the small save icon (ex: 192.168.8.2:8080) c. Add burp certificate to Trusted CA Certificate 6. Add the port number in BurpSuite. BurpSuite > Proxy > Options > Proxy Listeners > Add a. Add the port number you gave in HTTP Toolkit settings b. Select "All Interfaces" and click "OK" to save it. 7. Now the HTTP Toolkit will start to proxy all the request from your device The setup is , Android Device <-> HTTP Toolkit <-> BurpSuite

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.