2

I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62.

I am trying to route my all packets from my wlp2s0 interface to burp proxy which is running on 8080. I also enabled invisible proxy, but still no luck

I am routing packets using this firewall rule

iptables -t nat -A PREROUTING -s 10.42.0.62 -p tcp -j REDIRECT --to-ports 8080

After enabling this rule Internet access on the device stops working means the rule is working, but burp proxy is not showing any data flow.

Please anybody point out what I am doing wrong, I wasted many hours on this.

Update: I was trying Burp Proxy on the PC browser and was playing with proxy settings like Socks5 and resolve dns over Socks5 and then burp proxy stopped working even on PC browser. So I think when I route packets through Burp then it not resolves DNS queries and then my android sticks at DNS requests and there is no flow of TCP packets, that's why Burp Not showing anything. So, I think the main question is how we can resolve DNS queries through Burp Proxy.

8
  • What type of traffic are you trying to capture? What mitmproxy arguments are you using? Commented Feb 8, 2020 at 5:26
  • 1
    Burp doesn't work with "packets". It proxies HTTP requests. Commented Feb 8, 2020 at 5:30
  • @multithr3at3d I am not using any tool for mitm, I am creating hotspot on PC, So technically I am MITM, and then I am forwarding all traffic from hotspot interface to Burp.
    – Monu
    Commented Feb 8, 2020 at 11:34
  • @multithr3at3d I also come to this conclusion about HTTP, but unfortunately Iptables can't filter using HTTP protocol
    – Monu
    Commented Feb 8, 2020 at 11:35
  • 1
    Ya I tried capturing packets using Wireshark they were normal but I didn't get much information because they were encrypted. Most annoying thing about this is burp doesn't show even a single type of packet. I think burp only works at application layer and can't handle low level layers. I think it is not possible what I am trying to achieve. Thanks anyway for your time.
    – Monu
    Commented Feb 8, 2020 at 22:37

2 Answers 2

0

I had the same problem . This solved my issue:

Modify the /etc/hosts file . Change this 127.0.0.1 localhost into 127.0.0.1 local.dev where local.dev can be what you like

3
  • Thanks Marco for answer, this kind of worked. Now instead of showing nothing in burp, it shows some packets. But most of the requests are to my DNS 1.1.1.1 which is responding with "301 Moved Permanently", So as I previously updated in question, my mobile is unable to access internet because it is unable to resolve host names using DNS. Can you tell me how can I solve this.
    – Monu
    Commented Feb 17, 2020 at 12:23
  • And requests to DNS 1.1.1.1 only has "HOST, User-Agent, Connection", it not even has information about domain it trying to resolve
    – Monu
    Commented Feb 17, 2020 at 12:24
  • Hi Anni , thanks for the feedback. In Burp under Proxy -> Options -> Request handling you can check the Support invisible proxying option .This should help Commented Feb 17, 2020 at 13:07
0

In your iptables rules, you redirect all TCP packets from source 10.42.0.62, which probably include those of DNS requests. Although ordinary clients use UDP for DNS requests which should not be having this issue, your target obviously is using DNS over HTTPS.

I'd recommend you explicitly state the destination port for matching, because most packets targeting other than 80/443 is not HTTP/HTTPS traffic which Burpsuite care about.

sudo iptables -t nat -A PREROUTING -s 10.42.0.62 -p tcp --dport 80 -j REDIRECT --to-port 8080

And remember to enable transparent proxy support in Burpsuite settings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .