Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

How to test a mobile app that use SSL Pinning?

Jasmine | Last updated: Apr 07, 2021 10:34AM UTC

The app I must test wrote in Flutter. I can intercept requests from Chatwork, Zalo, etc... excluding this app. I guess that because the Framework Flutter use SSL Pinning as default. I don't have a root devices, also do not want to use apk tool and Frida. How can I intercept requests from this app now?

Ben, PortSwigger Agent | Last updated: Apr 08, 2021 07:41AM UTC

Hi, As SSL pinning has been designed to prevent the type of MiTM attack that Burp is essentially performing then getting this to work without using the kind of manipulation that you have already discounted is going to be problematic. The general approach would be to manipulate the app (using techniques that you do not wish to use) as described in the following blog posts: https://blog.nviso.eu/2019/08/13/intercepting-traffic-from-android-flutter-applications/ https://blog.netspi.com/four-ways-bypass-android-ssl-verification-certificate-pinning/ I will leave this forum post up in case any of our other users have any other suggestions that might help you with this.

zinzin | Last updated: Jun 12, 2023 05:44PM UTC