I've pentested a lot of websites and a few apps too but this app eludes them all.
On the websites, when there's a websocket upgrade
the BURP proxy recognizes it and starts showing it in the websockets tab. Somewhat similar happens on the apps, but not on this one.
This app doesn't do any such thing.
How this app works :
- Gets it's websocket endpoints from a config, downloaded from a website. Then 'mysteriously' it makes a connection to the websocket server, which isn't visible in the BURP proxy.
My Setup : 1. Rooted phone with frida running and objection framework for ssl unpinning ( although not needed here, as I am already able to see all the http(s) traffic from the app ).
FYI I've added my BURP cert as root authority in my android 7.0 phone.
I've also tried 'invisible proxying' ( not sure how it works ) didn't work either.
Any ideas would help ?
Thanks.
netstat
or similar on the device will not help - this only gives you the information if it is TCP or UDP but says nothing about the actual application protocol, i.e. HTTP, websockets ... And I agree with Ghedipunk that that just because others call it websockets it does not need to be websockets. It is not uncommon that plain sockets and websockets get confused, especially by people which don't realize that the internet is not just "web".