1

I'm a newbie to android pen testing and started off with an application. The app uses HTTPS and works fine without configuring any proxy. When a proxy like a burp suite is configured, the app responds with an error message. However, I'm able to intercept other HTTPS apps. I suspected SSL pinning. But it is not the case, as the sample pen test report which I got has burp screenshots. Even the code base doesn't have any pinning related checks.

Please help me intercept the traffic. I've tried following points:

  1. Downgraded the Java version to make it compatible with the burp jar.
  2. Checked with fiddler as well.
Improve this question
4
  • Hey, can you share the exact error message that you are seeing? That might help people pinpoint what the exact problem might be.
    – sir_k
    Commented Apr 6, 2018 at 14:22
  • If you are able to capture SSL traffic of other applications I strongly feel the application is implementing SSL pinning. SSL pinning can be bypassed so may be the sample reports that you are referring have bypassed pinning in order to capture traffic.
    – Shiv Sahni
    Commented Apr 6, 2018 at 15:43
  • There's no SSL pinning. We also tried uploading client's certificate with the protected password in burp but still facing the same issue.
    – testlab testlab1
    Commented Apr 9, 2018 at 5:34
  • How are you so sure that there is no pinning?
    – Shiv Sahni
    Commented Apr 11, 2018 at 16:26

2 Answers 2

Reset to default
1

In order to man-in-the-middle (MITM) a TLS application, you need to make it trust the certificates issued by your MITM reverse proxy.

For some Android applications, it is enough to install the certificate authority (CA) root certificate of your MITM reverse proxy. This might however not be enough for some applications:

  • if the application implements additional verification on top of the existing ones (certificate pinning) or implements its custom logic;
  • if the application targets an SDK higher or equal to 24;
  • if the application does not use the Android libraries for certificate verification at all.

For the second case, your might want to check out the Android documentation (emphasis mine):

By default, secure connections (using protocols like TLS and HTTPS) from all apps trust the pre-installed system CAs, and apps targeting Android 6.0 (API level 23) and lower also trust the user-added CA store by default.

Another interesting source is a post of the NCC group (emphasis mine):

if the application targets an SDK higher or equal to 24, only the system certificates are trusted.

If the HTTPS traffic needs to be intercepted, then a proxy certificate must be installed, but it is going to be installed in the ‘user certificates’ container, which is not trusted by default.

One solution is to instrument (patch) the application in order to disable the certificate verifications. This can be done ahead of time (by patching the APK) or at runtime (fbut you might need to use a rooted device in this case).

For case 1 and case 2, you could use:

Improve this answer
0

I think it is best to install Burp suite certificate into the Android test phone.

If your test phone is Nougat and above, you can refer to the link below. https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/

If not, you can just refer to this Burp help page. https://support.portswigger.net/customer/portal/articles/1841102-installing-burp-s-ca-certificate-in-an-android-device

Hope this helps.

Improve this answer
1
  • He stated he was already able to intercept other TLS apps, you can't do that withou already having the burp cert on the phone
    – J.A.K.
    Commented Jun 16, 2018 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .