0

I am pen testing an android app and using tethering to connect my phone to my laptop. I configured the access point settings as proxy = ipv4 address of my laptop and port = port on which burp is listening on all interfaces. Burp was intercept the requests some days before but now it's not intercepting. It happpens sometimes that the settings work and sometimes just don't. What should i do?

  • Can you add a screenshot of the Android settings? – Neil Smithline Oct 24 '15 at 14:31
1

The cellular issue when testing mobile apps does make them a little tricky to test. Some app's are aware of when they are communicating via the telecommunication provider directly and in some cases will behave differently when connected. some very old app's had a horrible pattern of sending data securely when sending data via 802.11 (using IPv4) but would send data over the cellular network (frequently via IPv6) in cleartext.

I've also seen issues where the app developer considered the telecommunications network to be encrypted when it simply wasn't.

Additionally apps created by the telecommunications providers frequently do this.

If you trust the app to behave normally you can use the Android Debug Bridge:

http://developer.android.com/tools/help/adb.html

see

http://www.mcafee.com/us/resources/white-papers/foundstone/wp-pen-testing-android-apps.pdf

However if you don't trust the device to behave properly, or you're more paranoid, you can setup a cell phone signal booster running linux and put it and the phone/device into a faraday cage style evidence bag (faraday bag) or box then use IPTables to redirect all traffic out of the bag via a physical ethernet cable to a system running your proxy. Some faraday bags and signal boosters are very inexpensive.

The primary advantage of this is you capture the data going over the telecom network side and not just what would be sent via 802.11. Likewise similar configurations with different antennas/equipment could be used to test NFC, bluetooth or any other wireless protocols the device may support.

@Lucas Kauffman just reminded me to mention that all RF equipment including things like cell phone boosters may be subject to your local laws and depending on where you are they may be illegal.

  • 2
    Just be aware that in some countries these cell phone boosters may be considered illegal. – Lucas Kauffman Sep 7 '16 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.