Ways of Capturing Mobile Application GET requests

Question

Context: I am pentesting a mobile app whose primary purpose is to cast a vote. The program continuously tries to connect to google adserver and if it can't retrieve ads, it just stops functioning with the message "No internet Connection".

What I did: I tried using Ettercap/Wireshark for sniffing the traffic and all I could see was a TLS connection to an IP address that was terminated with the message"Certificate Unknown".

I have installed Burp's Cert, used JustTrustME (Xposed module) and SSL TrustKiller all of which will lead to "Connection Error" inside the app as soon as I use burp proxy on my android device.

I have successfully captured HTTP/HTTPs traffic from some other apps to verify that my setup is correct.

I am curious, as to what other things can I try, to figure out how the app actually works.

My goal for now is to see all the GET requests when a vote is cast. Basically runtime analysis of the application.

Answer 1

It sounds like that app is using certificate pinning. In this case it would be difficult to to proxy any app comms without first bypassing the cert pinning. You are using Trust Killer but it may not be working correctly.

To properly verify your set up first test against apps you know have cert pinning. My guess is the others you tested did not have this.

What you could also do is de-compile the source and have a look there. There is a quick and nasty tool online here: http://www.javadecompilers.com/apk you may have some luck with. This could let you make some ad-hoc changes of your own, re-compile and get a better run time analysis.