Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Intercept Traffic of application installed on Amazon firetv stick

Ubaid | Last updated: Jan 29, 2020 05:10AM UTC

I want to intercept the traffic of application installed on amazon firetv stick. I have done the proxy configuration. However, when I try to install the burp certificate on firetv stick, I get an error that certificate can't be installed. Please help me out in figuring out a way to intercept the traffic.

Uthman, PortSwigger Agent | Last updated: Jan 30, 2020 09:09AM UTC

Can you please send a picture of the error to support@portswigger.net? Can you send your proxy configuration too? We have not tested any support for the Amazon FireTV Stick.

Burp User | Last updated: Feb 04, 2020 06:45AM UTC

I figured out the reason for this issue. I was following the same approach as we do in case of an Android Device and apparently it was wrong. Wrong Approach: 1) Set up proxy on firetv 2) Push burp certificate 3) Install the certificate This is where I was failing as I was not able to install the certificate. The reason for this was the fact that authorisation is needed for installing the certificate and since after setting up of proxy https traffic was not working. As a result, authentication was failing (FireTv simply shows a white screen and stays there for a while and then shows the error that certificate not installed) and installation of the certificate was failing. Correct Approach: 1) Push the certificate 2) Install the certificate 3) Authenticate your account 4) Now setup the proxy I hope this answer will help others in future.

land1ng3ar | Last updated: Oct 30, 2020 10:28AM UTC

I've got a problem proxying traffic on Amazon FireTV 4k Stick, I'm using the following command to push the cert. adb push charles-ssl-proxying-certificate.pem /storage/emulated/0/Download Then I use this to install the cert. adb shell am start -a "android.intent.action.VIEW" -d "file:///storage/emulated/0/Download/charles-ssl-proxying-certificate.pem" -t "application/x-x509-ca-cert" all good it presents the sign-in page to re-authenticate the user, I enter my credentials nothing happens? I'm on this screen for ever until screen saver or something kicks in and I'm back to home screen. My networking is working, I'm able to play videos on prime. I'm able to download apps. But somehow Amazon doesn't allow myself to authenticate. I even disbaled 2fa. I've reset to factory defaults many times. what am I missing? please can you help?

Uthman, PortSwigger Agent | Last updated: Nov 02, 2020 09:17AM UTC

It looks like your commands are related to Charles Proxy instead of Burp. We have not tested the FireTV Stick specifically, but the principle is the same as any other device. You configure it to use Burp as a proxy. Or if it doesn't have proxy configuration you use this approach: - https://support.portswigger.net/customer/portal/articles/2899081-using-burp-s-invisible-proxy-settings-to-test-a-non-proxy-aware-thick-client-application It is possible that Amazon takes steps to stop you doing this - such as certificate pinning. Can you double-check if this is relevant to the FireTV Stick?

land1ng3ar | Last updated: Nov 02, 2020 03:25PM UTC

Sorry, yes essentially it's the same principle for Burp (using the CER/PEM file). FireTV stick just allows to setup the proxy and since fireos 6 they appear to change the way proxies, I'm still checking this is the case.

Uthman, PortSwigger Agent | Last updated: Nov 02, 2020 03:44PM UTC

Thanks. It looks like you have already tried the information in this article: https://developer.amazon.com/docs/fire-tv/network-proxy.html. Does Charles actually work? If so, have you considered proxying upstream to Burp directly from Charles?

land1ng3ar | Last updated: Nov 03, 2020 12:43PM UTC

Burp works for me on FireOS 5. As it stands FireOS 6 requires apparently requires an embedded certificate within the app for any proxy to work.

Uthman, PortSwigger Agent | Last updated: Nov 03, 2020 12:44PM UTC

Thanks a lot for sharing your findings!

land1ng3ar | Last updated: Nov 09, 2020 12:28PM UTC

Just to update if we scrcpy it allows me to login correctly, apparently there is something wrong with FireOS6.0

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.