1

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but I am unable to see the traffic of the app in question - its link on burp suite instead the app works fine and connects to the remote server without even appearing any error related to certificate error on the event Log of the burp suite just as like an app using certificate Pinning would complain. in reversing the app I concluded that it is using https protocol to connect to the server. additionally, I have installed the app in Genymotion emulator and the app behaves differently. when I installed the certificate in the emulator and set up burp proxy, all the traffic from other apps appears normally in the proxy except this app. all the app traffic follows to the address 127.0.0.1 which is strange to me. forexample I take an intercepted one below:

http://127.0.0.1:44895

POST /app/Settings/do_pathlogin HTTP/1.1
Host: 127.0.0.1:44895
Content-Length: 65
Accept: */*
Origin: http://127.0.0.1:44895
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; Samsung Galaxy S6 Build/OPR6.170623.017; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.125 Mobile Safari/537.36
Transition-Enabled: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://127.0.0.1:44895/app/Settings/index_callback
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Connection: close

fromPage=login&operation_key=HOME_REP&username=user&password=pass

I don't have any idea why this behaviour the app is showing, in the real device this won't show up, i.e, traffic to the address 127.0.0.1. As other researchers would recommend, tried to sniff network traffic of the app with wireshark and activated the capture traffic of the wireshark, I was expecting to sniff or even decide whether app is using UDP protocols, but did not appear any traffic from the app!.

I wanted some help how can I capture the traffic of this app?

what am I missing?

what other steps do I need?

I would really appreciate any help about this.

note: I don't have any bad intentions about the app.

  • It seems that they use an internal proxy to protect their requests with their own certificates. Try to focus what's is going out from that localhost proxy with TCP inspection using Wireshark. Anyway, your request shows that if you do a normal listening on port 44895 you can intercept the traffic since that seems a login request and if you have intercepted that you should be able to intercept any other request. Also, I don't want even imagine what's the purpose to intercept the traffic of a bank application. – Virgula Sep 1 at 7:47
  • @Virgula , I have set up windows 10 hotspot and wireshark to sniff any network through it and tried to sniff traffic from the app. but the app refuses to connect to the server showing a message that a network error exists. – hanan Sep 1 at 7:53
  • 2
    because of certificates, Spotify app uses a similar technique with a proxy to protect their login mechanism. Maybe the only method would be to find the certificate by reversing the app. and loading it into Wireshark. – Virgula Sep 1 at 7:56
  • I don't think that app is using http except for sign in and sign up. Clear app data and see if burp intercepts initial sign in stage. – defalt Oct 2 at 9:38
  • @defalt still I am unable to intercept but in wireshark I can see communication between the application and the server however the applicationData was encrypted! And I don't know how to decrypt at first place. – hanan Oct 3 at 17:15
0

I am sorry but I am having a hard time understanding the question fully. I will try to give some advice for further investigation.

It is my understanding that you are experimenting with a banking application, and that you found that

I have installed the app in Genymotion emulator and the app behaves differently

That's reasonable for a banking application. They often actively detect the emulator. Most banking apps will grind to halt when they detect 1) emulator, 2) su executable 3) debug mode ON

I can intercept other apps on my device but I am unable to see the traffic of the app

Unfortunately I don't know how the burp suite works (and that is bad in the first place!!), but you need to make sure that the intercepting suite acts as a transparent https proxy, as the app may try their best to bypass any system proxy setting.

From what I know in my SW engineering experience, a proxy is set in Java by setting system properties. The app may be trying to temporarily hijack the proxy properties, which is allowed within their ClassLoader, in order to bypass proxy.

Ideally, the testing should be done after removing phone's SIM card (or disabling mobile data) and connecting to a specially crafted wifi hosted by the testing suite. If burp allows that, then the app is a real challenge.

| improve this answer | |
0

You should look into setting up invisible proxying with Burp.

Burp's support for invisible proxying allows non-proxy-aware clients to connect directly to a Proxy listener. This option is sometimes useful if the application you are targeting employs a thick client component that runs outside of the browser, or a browser plugin that makes its own HTTP requests outside of the browser's framework. Often, these clients don't support HTTP proxies, or don't provide an easy way to configure them to use one.

It looks like the library used to communicate with the backend in your case is not proxy aware.

| improve this answer | |
  • "It looks like the library used to communicate with the backend in your case is not proxy aware." which library plz? – hanan Sep 1 at 10:10
  • 1
    @hanan I think he means the library used by the application to communicate with it’s proxy server side, but the backend in this case it’s the proxy itself imo... I don’t have got this.. – Virgula Sep 1 at 10:21
  • @Virgula, now I can see in the wireshark encrypted application Data and Encrypted AlertMessage but how can I decrypt these? – hanan Sep 1 at 10:26
  • 1
    @hanan You can't without the certificate known only by the app. That's why I said that you should do reverse engineering of the app in order to find it. – Virgula Sep 1 at 10:50
  • @Virgula do you have any clue or figured out how to pullout the certificate from the app? – hanan Sep 1 at 13:08
0

I don't think that app is using http at all. I've seen similar behaviour with WhatsApp in which https is only used at the registration phase and then it switches to noise pipes which is not intercepted by http proxies.

A workaround is to use mitm_relay. It listens raw TCP/UDP packets, encapsulates them in http and forwards it to http proxy (burp). The only limitation is that you have to specificy the destination IP and port.

mitm_relay.py -l Listener_IP -r Transport_protocol:Listener_port:Destination_IP:Destination_port -p http_proxy_IP:Port

mitm_relay.py -l 10.0.0.2 -r tcp:8082:151.101.1.69:443 -p 127.0.0.1:8080

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.