I'm a newbie to android pen testing and started off with an application. The app uses HTTPS and works fine without configuring any proxy. When a proxy like a burp suite is configured, the app responds with an error message. However, I'm able to intercept other HTTPS apps. I suspected SSL pinning. But it is not the case, as the sample pen test report which I got has burp screenshots. Even the code base doesn't have any pinning related checks.

Please help me intercept the traffic. I've tried following points:

  1. Downgraded the Java version to make it compatible with the burp jar.
  2. Checked with fiddler as well.
  • Hey, can you share the exact error message that you are seeing? That might help people pinpoint what the exact problem might be. – sir_k Apr 6 '18 at 14:22
  • If you are able to capture SSL traffic of other applications I strongly feel the application is implementing SSL pinning. SSL pinning can be bypassed so may be the sample reports that you are referring have bypassed pinning in order to capture traffic. – Shiv Sahni Apr 6 '18 at 15:43
  • There's no SSL pinning. We also tried uploading client's certificate with the protected password in burp but still facing the same issue. – testlab testlab1 Apr 9 '18 at 5:34
  • How are you so sure that there is no pinning? – Shiv Sahni Apr 11 '18 at 16:26

I think it is best to install Burp suite certificate into the Android test phone.

If your test phone is Nougat and above, you can refer to the link below. https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/

If not, you can just refer to this Burp help page. https://support.portswigger.net/customer/portal/articles/1841102-installing-burp-s-ca-certificate-in-an-android-device

Hope this helps.

| improve this answer | |
  • He stated he was already able to intercept other TLS apps, you can't do that withou already having the burp cert on the phone – J.A.K. Jun 16 '18 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.