I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but I am unable to see the traffic of the app in question - its link on burp suite instead the app works fine and connects to the remote server without even appearing any error related to certificate on the event Log of the burp suite. in reversing the app I concluded that it is using https protocol to connect to the server(would be happy to confirm it app link here). in my testing when I have installed the app in a Genymotion Emulator and burp suite set up to intercept traffic, can only see traffic going to local host address; forexample:
http://127.0.0.1:44895 POST /app/Settings/do_pathlogin HTTP/1.1 Host: 127.0.0.1:44895 Content-Length: 65 Accept: */* Origin: http://127.0.0.1:44895 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; Samsung Galaxy S6 Build/OPR6.170623.017; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.125 Mobile Safari/537.36 Transition-Enabled: true Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Referer: http://127.0.0.1:44895/app/Settings/index_callback Accept-Encoding: gzip, deflate Accept-Language: en-US Connection: close fromPage=login&operation_key=HOME_REP&username=user&password=pass
I don't have any idea why this behaviour the app is showing, in the real device this won't show up, i.e, traffic to the address
As other researchers would recommend, tried to sniff network traffic of the app with wireshark and activated the capture traffic of the wireshark, I was expecting to sniff or even decide whether app is using UDP protocols, but did not appear any traffic from the app!.
I wanted some help how can I capture the traffic of this app?
what am I missing?
what other steps do I need?
I would really happy to help me about this.
You can get the app in question here