1

I've pentested a lot of websites and a few apps too but this app eludes them all. On the websites, when there's a websocket upgrade the BURP proxy recognizes it and starts showing it in the websockets tab. Somewhat similar happens on the apps, but not on this one.

This app doesn't do any such thing.

How this app works :

  1. Gets it's websocket endpoints from a config, downloaded from a website. Then 'mysteriously' it makes a connection to the websocket server, which isn't visible in the BURP proxy.

My Setup : 1. Rooted phone with frida running and objection framework for ssl unpinning ( although not needed here, as I am already able to see all the http(s) traffic from the app ).

FYI I've added my BURP cert as root authority in my android 7.0 phone.

I've also tried 'invisible proxying' ( not sure how it works ) didn't work either.

Any ideas would help ?

Thanks.

Improve this question
7
  • What makes you believe that this is a websockets connection? If there is no upgrade request then there is no websockets. This could be a plain socket (not websocket) connection and I would find nothing mysterious about it. Not everything is web. To see what's going on be in the path of the traffic, for example capture the traffic on the router.
    – Steffen Ullrich
    Dec 20, 2019 at 20:09
  • This sounds a lot like a product-specific tech-support style question, which doesn't usually get answered around here (some do get answers... Others get closed. Some get answers and get closed.) So good luck on that front... I don't know much about Burp, but I do know a bit about WebSockets... The first question is... Is the application really setting up a WebSockets connection?
    – Ghedipunk
    Dec 20, 2019 at 20:10
  • Two reasons : 1. The server in the config is a websockets server ( for live update as well as multiplayer feed ), it's a poker game app. 2. The team lead told me the same.
    – temporarya
    Dec 20, 2019 at 20:11
  • 2
    A WebSocket connection is just a full duplex TCP/IP connection that has a handshake and per-message framing to make it play nice with browsers and proxies. If you don't have a browser (more pedantically: your client network code doesn't run in Javascript inside of a browser's sandbox), then you don't need the overhead of WebSockets. Your team lead might call it WebSockets, and might believe that it's websockets, but since you haven't seen the bytes on the wire, I'm skeptical.
    – Ghedipunk
    Dec 20, 2019 at 20:19
  • 1
    @temporarya: As I said, to determine what it is sniff the data on some device in the network path. netstat or similar on the device will not help - this only gives you the information if it is TCP or UDP but says nothing about the actual application protocol, i.e. HTTP, websockets ... And I agree with Ghedipunk that that just because others call it websockets it does not need to be websockets. It is not uncommon that plain sockets and websockets get confused, especially by people which don't realize that the internet is not just "web".
    – Steffen Ullrich
    Dec 21, 2019 at 2:09

1 Answer 1

Reset to default
1

Finally I got it working.

The Problem :

  • The thick client wasn't respecting the mobile's proxy setting and 'invisible proxying' didn't help either as the app was using direct IP to communicate. ( This part took me a lot of time figuring out, rest part was almost ~20 minutes )

How I got it working :

Since I had a rooted phone I used ProxyDroid ( with Global Proxy setting ON, which requires root ), to configure iptables and others to route all traffic through my BURP proxy.

Bonus - Things learnt :

  • I had realized, while I started exploring this problem for the past 36 hours that the reason AND solution to this problem would definitely add to my android application testing skills. This saved me a lot of endpoints I might have missed on my further android application pentesting.
Improve this answer
3
  • Would you please guide me how did you configure ProxyDroid with burp? I can intercept the traffic if I set proxy from settting/wifi/ but when I try proxyDroid, I am not getting any traffic on burpsuite. I am entering the exact same HostName and HostPort on ProxyDroid that I used with setting/wifi.
    – john
    May 4, 2020 at 9:44
  • hello sir can i have your tweeter id
    – Jay seen
    Jun 12, 2020 at 8:03
  • ProxyDroid aside, Drony might be another alternative to use for this.
    – David
    Jan 27, 2021 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .