1

I want to test for security vulnerabilities in an Android App and hence want to monitor all HTTP(S) calls being made from an Android App.

I have setup BurpSuit in my Laptop and have also set up the proxy in my Android device. After installing the Burp certificate in the user trusted certificates I am able to monitor the HTTP(S) calls properly for Website and almost all apps.

But some apps are showing error by stating "Could not connect. Please check the internet connection.".

I am using an Android 5.0 non-rooted device.

Any help would be grateful

Improve this question

2 Answers 2

Reset to default
1

Some apps are configured with hard coded CA certificates or internal certificate stores. This means you can't make them trust your certificate by adding a CA in the shared certificate stores. This is quite common security measure e.g. in the financial industry.

Improve this answer
0

You need a rooted device in order to bypass SSL Pinning (Causing this error: "Could not connect. Please check the internet connection.".) and preventing you from seeing/intercepting the requests. There's many tools available on the Xposed Framework that can help.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .