Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I need to perform MITM attack on an app which doesn't use HttpURLConnection and OkHttp libraries for network connection.
Analysis :
What we should do if the network connection is done with curl which I am not very familiar with?
If Wireshark reports that the device is making DNS requests, set up a MitM DNS server (or just modify the WiFi settings on the device to point to a custom DNS server) that points the target domain(s) to your Burp host. Alternatively, if you can, edit the HOSTS file on the device to bypass DNS and treat your IP as the target domain.
If the requests are being sent to a specific IP address without performing a DNS lookup (unlikely, but not impossible), you will instead need to convince the device that your computer with Burp has the IP address it's looking for, or simply route all traffic through your computer (which I'm guessing you're already doing, if you can see the device requests in Wireshark) and configure it to route traffic intended for the target IP to the local machine instead (on Linux this can be done with iptables, I believe).
Next, configure Burp to listed on port 443 (or whatever other port(s) the TLS traffic is sent to) in "Invisible" proxy mode. In this mode, Burp simply acts as a web server and uses the SNI to generate a suitable TLS certificate and to forward the request to the host (if you choose to do that).
However, note that this will not work if the app is both validating TLS certificates (which it should be, but a surprising number of apps - especially those that avoid the standard libraries - fail to do this or do it incorrectly, such as only checking the subject name and not the chain of trust) and using its own certificate store for the list of allowed CAs (instead of the operating system's cert store), or if the app is using certificate pinning. In either of those cases, you will need to modify the app itself. If you don't have the APK, you'll need a rooted device to do this; go to the app's install location and look for anything that looks like a certificate store, key store, or certificate file, and add / replace it with your Burp certificate. The app should then trust Burp and allow you to proxy the traffic. (It is possible that the app is using cert/key pinning and the pin is hardcoded; in that case you would need to extract and decompile the app binaries to replace the key or simply skip the TLS check, and at that point it might be easier to just analyze the decompiled app).
