1

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of implementation of security measures like SSL Pinning as the application lacks the usage of HTTPs protocol. I used SSL Capture Android application(alternative to Wireshark for Android) to successfully sniff the application traffic and confirmed that the application is using HTTP for the communication.

On decompiling the application, I found that the application is packed with a native library. I strongly believe that the application is making network calls in the native library and I think some secure API(like Xamarin hybrid platform) is used to make the network connection which lacks usage of device's proxy configuration while making the network call.

Any suggestions on how can I capture the API requests and response in the proxy server directly? I'm already using the workaround by working with the sniffed traffic.

I could have tried the Burp Invisible Proxy, but there's no DNS resolution involved as the application is sending request directly to IP.

  • You could use a VPN server on your box. Or start a hotspot there. – davidbaumann Nov 14 '18 at 10:45
  • @davidbaumann Can you please elaborate? – Shiv Sahni Nov 14 '18 at 11:06
  • Set up a VPN Server on your box and connect your android device to it. – davidbaumann Nov 14 '18 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.