0

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but I am unable to see the traffic of the app in question - its link on burp suite instead the app works fine and connects to the remote server without even appearing any error related to certificate on the event Log of the burp suite. in reversing the app I concluded that it is using https protocol to connect to the server(would be happy to confirm it app link here). in my testing when I have installed the app in a Genymotion Emulator and burp suite set up to intercept traffic, can only see traffic going to local host address; forexample:

http://127.0.0.1:44895

POST /app/Settings/do_pathlogin HTTP/1.1
Host: 127.0.0.1:44895
Content-Length: 65
Accept: */*
Origin: http://127.0.0.1:44895
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; Samsung Galaxy S6 Build/OPR6.170623.017; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.125 Mobile Safari/537.36
Transition-Enabled: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://127.0.0.1:44895/app/Settings/index_callback
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Connection: close

fromPage=login&operation_key=HOME_REP&username=user&password=pass

I don't have any idea why this behaviour the app is showing, in the real device this won't show up, i.e, traffic to the address 127.0.0.1. As other researchers would recommend, tried to sniff network traffic of the app with wireshark and activated the capture traffic of the wireshark, I was expecting to sniff or even decide whether app is using UDP protocols, but did not appear any traffic from the app!.

I wanted some help how can I capture the traffic of this app?

what am I missing?

what other steps do I need?

I would really happy to help me about this.

You can get the app in question here

  • The application check your certiciate and rejects the BURP one, you need to bypass certificate pinning inside your application to sniff the traffic. – morsisko Aug 24 at 11:37
  • did you confirm it plz? I didn't see any error logs complaining about burp certificate! may be I am missing something – hanan Aug 24 at 11:46
  • Have you installed Burp root certificate as system certificate (not user certificate!) on the test device? – Robert Aug 24 at 16:04
  • Nope, I only installed it in the user certificate section. Would be happy if you give me steps to install burp certificate in the system credentials for genymotion emulator. Nevertheless if it was certificate issue, why I cannot see an error log in burp? The app does connect to the server without an issue in real device when burp was still on. – hanan Aug 24 at 17:42
  • Mitmproxy documentation contains an how-to install the rot CA cert as system cert. But you should first install your root Ca cert as user certificate so you get the correct file as c8450d0d.0 is only the valid name for the mitmproxy root ca cert. However I would recommend to use a real phone. Banking apps often refuse to work on emulators. – Robert Aug 24 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.