Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

No alerts but no connection from Android app

fatih | Last updated: Jun 27, 2020 06:41AM UTC

I was able to inspect the traffic from an Android app with a rooted device and burpsuite certificate installed as root certificates. After an update of the app i am no longer able to inspect the traffic. No alert on the BurpSuite dashboard no SSL error or handshale etc nothing. The App says no internet connection. If i enable the TLS Pass Throug for the apps api domain the app is working normal but i am not able to watch the traffic of course. I was not able to detect a SSL pinning in the decompiled apk, i tried to bypass the SSL pinning with frida (Just to make sure maybe there is a ssl pinning) without luck. There is no first connection or else. Maybe the app is using a non standart port? If i enable pass through for the first connection and then disable it the app is working for a limited time but still no traffic is visible in BurpSuite. Any solutions for me? Android 7 Rooted Burpsuite Community Edition v2020.2.1

Liam, PortSwigger Agent | Last updated: Jun 29, 2020 12:02PM UTC

It's possible that the native app is not using the CA certificate that you have installed on the device. Some native apps use their own certificate trust store, and some implement certificate pinning to only trust specific server-side certificates. In this situation, breaking the SSL tunnel is non-trivial and may entail jailbreaking the device or using some other advanced tools. As you already have a jailbroken device, we would advise setting up Android with ProxyDroid and FS Cert Installer to push HTTPS App traffic to Burp Suite: - Reset burp suite - Turn on listen to all interfaces Android Host: - Remove all User Certs - Stop task and remove data for ProxyDroid and FS Cert installer ( you can just uninstall reinstall ) - Put the phone in airplane mode then turn on WIFI - In FS Cert put in proxy IP and PORT then click the middle button "Add CA" and add it under WIFI Cert in the dropdown - Click test chain and it should all be green yes for www.google.com For Proxydroid just put in the IP and port and also tunnel DNS Kill or reinstall any apps before you start to make sure they go through the proxy properly However, it's also worth noting that Android has changed how they handle trusted certificate authorities (CAs): - https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html

fatih | Last updated: Jun 29, 2020 03:10PM UTC

No way :( i'm able to inspect almost all others app traffic, but not the one i need. I spend a lot of time to develope a custom backend, now its all for the junk. Can you maybe tell me a freelancer who have the skills to make it work for me? I will pay for it of course. Thank you

Liam, PortSwigger Agent | Last updated: Jun 29, 2020 03:26PM UTC

Unfortunately, we can't provide a recommendation.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.