Intercept HTTP Traffic of an android app?

Question

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but I am unable to see the traffic of the app in question - its link on burp suite instead the app works fine and connects to the remote server without even appearing any error related to certificate error on the event Log of the burp suite just as like an app using certificate Pinning would complain. in reversing the app I concluded that it is using https protocol to connect to the server. additionally, I have installed the app in Genymotion emulator and the app behaves differently. when I installed the certificate in the emulator and set up burp proxy, all the traffic from other apps appears normally in the proxy except this app. all the app traffic follows to the address 127.0.0.1 which is strange to me. forexample I take an intercepted one below:

http://127.0.0.1:44895

POST /app/Settings/do_pathlogin HTTP/1.1
Host: 127.0.0.1:44895
Content-Length: 65
Accept: */*
Origin: http://127.0.0.1:44895
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; Samsung Galaxy S6 Build/OPR6.170623.017; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.125 Mobile Safari/537.36
Transition-Enabled: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://127.0.0.1:44895/app/Settings/index_callback
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Connection: close

fromPage=login&operation_key=HOME_REP&username=user&password=pass

I don't have any idea why this behaviour the app is showing, in the real device this won't show up, i.e, traffic to the address 127.0.0.1. As other researchers would recommend, tried to sniff network traffic of the app with wireshark and activated the capture traffic of the wireshark, I was expecting to sniff or even decide whether app is using UDP protocols, but did not appear any traffic from the app!.

I wanted some help how can I capture the traffic of this app?

what am I missing?

what other steps do I need?

I would really appreciate any help about this.

note: I don't have any bad intentions about the app.

Answer 1

I am sorry but I am having a hard time understanding the question fully. I will try to give some advice for further investigation.

It is my understanding that you are experimenting with a banking application, and that you found that

I have installed the app in Genymotion emulator and the app behaves differently

That's reasonable for a banking application. They often actively detect the emulator. Most banking apps will grind to halt when they detect 1) emulator, 2) su executable 3) debug mode ON

I can intercept other apps on my device but I am unable to see the traffic of the app

Unfortunately I don't know how the burp suite works (and that is bad in the first place!!), but you need to make sure that the intercepting suite acts as a transparent https proxy, as the app may try their best to bypass any system proxy setting.

From what I know in my SW engineering experience, a proxy is set in Java by setting system properties. The app may be trying to temporarily hijack the proxy properties, which is allowed within their ClassLoader, in order to bypass proxy.

Ideally, the testing should be done after removing phone's SIM card (or disabling mobile data) and connecting to a specially crafted wifi hosted by the testing suite. If burp allows that, then the app is a real challenge.

Answer 2

You should look into setting up invisible proxying with Burp.

Burp's support for invisible proxying allows non-proxy-aware clients to connect directly to a Proxy listener. This option is sometimes useful if the application you are targeting employs a thick client component that runs outside of the browser, or a browser plugin that makes its own HTTP requests outside of the browser's framework. Often, these clients don't support HTTP proxies, or don't provide an easy way to configure them to use one.

It looks like the library used to communicate with the backend in your case is not proxy aware.

Answer 3

I don't think that app is using HTTP at all. I've seen similar behavior with WhatsApp in which HTTPS is only used at the registration phase and then it switches to noise pipes which is not intercepted by HTTP Proxies.

A workaround is to use mitm_relay. It listens raw TCP/UDP packets, encapsulates them in HTTP and forwards them to HTTP Proxy (Burp Suite). The only limitation is that you have to specificy the destination IP and port.

Here is the syntax of the command you can use:

mitm_relay.py -l Listener_IP -r Transport_protocol:Listener_port:Destination_IP:Destination_port -p http_proxy_IP:Port

An example of the same command with IP addreses is:

mitm_relay.py -l 10.0.0.2 -r tcp:8082:151.101.1.69:443 -p 127.0.0.1:8080