1

I'm a newbie to android pen testing and started off with an application. The app uses HTTPS and works fine without configuring any proxy. When a proxy like a burp suite is configured, the app responds with an error message. However, I'm able to intercept other HTTPS apps. I suspected SSL pinning. But it is not the case, as the sample pen test report which I got has burp screenshots. Even the code base doesn't have any pinning related checks.

Please help me intercept the traffic. I've tried following points:

  1. Downgraded the Java version to make it compatible with the burp jar.
  2. Checked with fiddler as well.
4
  • Hey, can you share the exact error message that you are seeing? That might help people pinpoint what the exact problem might be. – sir_k Apr 6 '18 at 14:22
  • If you are able to capture SSL traffic of other applications I strongly feel the application is implementing SSL pinning. SSL pinning can be bypassed so may be the sample reports that you are referring have bypassed pinning in order to capture traffic. – Shiv Sahni Apr 6 '18 at 15:43
  • There's no SSL pinning. We also tried uploading client's certificate with the protected password in burp but still facing the same issue. – testlab testlab1 Apr 9 '18 at 5:34
  • How are you so sure that there is no pinning? – Shiv Sahni Apr 11 '18 at 16:26
0

I think it is best to install Burp suite certificate into the Android test phone.

If your test phone is Nougat and above, you can refer to the link below. https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/

If not, you can just refer to this Burp help page. https://support.portswigger.net/customer/portal/articles/1841102-installing-burp-s-ca-certificate-in-an-android-device

Hope this helps.

1
  • He stated he was already able to intercept other TLS apps, you can't do that withou already having the burp cert on the phone – J.A.K. Jun 16 '18 at 15:10
0

In order to man-in-the-middle (MITM) a TLS application, you need to make it trust the certificates issued by your MITM reverse proxy.

For some Android applications, it is enough to install the certificate authority (CA) root certificate of your MITM reverse proxy. This might however not be enough for some applications:

  • if the application implements additional verification on top of the existing ones (certificate pinning) or implements its custom logic;
  • if the application targets an SDK higher or equal to 24;
  • if the application does not use the Android libraries for certificate verification at all.

For the second case, your might want to check out the Android documentation (emphasis mine):

By default, secure connections (using protocols like TLS and HTTPS) from all apps trust the pre-installed system CAs, and apps targeting Android 6.0 (API level 23) and lower also trust the user-added CA store by default.

Another interesting source is a post of the NCC group (emphasis mine):

if the application targets an SDK higher or equal to 24, only the system certificates are trusted.

If the HTTPS traffic needs to be intercepted, then a proxy certificate must be installed, but it is going to be installed in the ‘user certificates’ container, which is not trusted by default.

One solution is to instrument (patch) the application in order to disable the certificate verifications. This can be done ahead of time (by patching the APK) or at runtime (fbut you might need to use a rooted device in this case).

For case 1 and case 2, you could use:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.