I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but I am unable to see the traffic of the app in question - its link on burp suite instead the app works fine and connects to the remote server without even appearing any error related to certificate error on the event Log of the burp suite just as like an app using certificate Pinning would complain. in reversing the app I concluded that it is using https protocol to connect to the server. additionally, I have installed the app in Genymotion emulator and the app behaves differently. when I installed the certificate in the emulator and set up burp proxy, all the traffic from other apps appears normally in the proxy except this app. all the app traffic follows to the address which is strange to me. forexample I take an intercepted one below:

POST /app/Settings/do_pathlogin HTTP/1.1
Content-Length: 65
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; Samsung Galaxy S6 Build/OPR6.170623.017; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.125 Mobile Safari/537.36
Transition-Enabled: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Connection: close


I don't have any idea why this behaviour the app is showing, in the real device this won't show up, i.e, traffic to the address As other researchers would recommend, tried to sniff network traffic of the app with wireshark and activated the capture traffic of the wireshark, I was expecting to sniff or even decide whether app is using UDP protocols, but did not appear any traffic from the app!.

I wanted some help how can I capture the traffic of this app?

what am I missing?

what other steps do I need?

I would really appreciate any help about this.

note: I don't have any bad intentions about the app.

  • It seems that they use an internal proxy to protect their requests with their own certificates. Try to focus what's is going out from that localhost proxy with TCP inspection using Wireshark. Anyway, your request shows that if you do a normal listening on port 44895 you can intercept the traffic since that seems a login request and if you have intercepted that you should be able to intercept any other request. Also, I don't want even imagine what's the purpose to intercept the traffic of a bank application.
    – Virgula
    Commented Sep 1, 2020 at 7:47
  • @Virgula , I have set up windows 10 hotspot and wireshark to sniff any network through it and tried to sniff traffic from the app. but the app refuses to connect to the server showing a message that a network error exists.
    – hanan
    Commented Sep 1, 2020 at 7:53
  • 2
    because of certificates, Spotify app uses a similar technique with a proxy to protect their login mechanism. Maybe the only method would be to find the certificate by reversing the app. and loading it into Wireshark.
    – Virgula
    Commented Sep 1, 2020 at 7:56
  • I don't think that app is using http except for sign in and sign up. Clear app data and see if burp intercepts initial sign in stage.
    – defalt
    Commented Oct 2, 2020 at 9:38
  • @defalt still I am unable to intercept but in wireshark I can see communication between the application and the server however the applicationData was encrypted! And I don't know how to decrypt at first place.
    – hanan
    Commented Oct 3, 2020 at 17:15

3 Answers 3


I am sorry but I am having a hard time understanding the question fully. I will try to give some advice for further investigation.

It is my understanding that you are experimenting with a banking application, and that you found that

I have installed the app in Genymotion emulator and the app behaves differently

That's reasonable for a banking application. They often actively detect the emulator. Most banking apps will grind to halt when they detect 1) emulator, 2) su executable 3) debug mode ON

I can intercept other apps on my device but I am unable to see the traffic of the app

Unfortunately I don't know how the burp suite works (and that is bad in the first place!!), but you need to make sure that the intercepting suite acts as a transparent https proxy, as the app may try their best to bypass any system proxy setting.

From what I know in my SW engineering experience, a proxy is set in Java by setting system properties. The app may be trying to temporarily hijack the proxy properties, which is allowed within their ClassLoader, in order to bypass proxy.

Ideally, the testing should be done after removing phone's SIM card (or disabling mobile data) and connecting to a specially crafted wifi hosted by the testing suite. If burp allows that, then the app is a real challenge.


You should look into setting up invisible proxying with Burp.

Burp's support for invisible proxying allows non-proxy-aware clients to connect directly to a Proxy listener. This option is sometimes useful if the application you are targeting employs a thick client component that runs outside of the browser, or a browser plugin that makes its own HTTP requests outside of the browser's framework. Often, these clients don't support HTTP proxies, or don't provide an easy way to configure them to use one.

It looks like the library used to communicate with the backend in your case is not proxy aware.

  • "It looks like the library used to communicate with the backend in your case is not proxy aware." which library plz?
    – hanan
    Commented Sep 1, 2020 at 10:10
  • 1
    @hanan I think he means the library used by the application to communicate with it’s proxy server side, but the backend in this case it’s the proxy itself imo... I don’t have got this..
    – Virgula
    Commented Sep 1, 2020 at 10:21
  • @Virgula, now I can see in the wireshark encrypted application Data and Encrypted AlertMessage but how can I decrypt these?
    – hanan
    Commented Sep 1, 2020 at 10:26
  • 1
    @hanan You can't without the certificate known only by the app. That's why I said that you should do reverse engineering of the app in order to find it.
    – Virgula
    Commented Sep 1, 2020 at 10:50
  • @Virgula do you have any clue or figured out how to pullout the certificate from the app?
    – hanan
    Commented Sep 1, 2020 at 13:08

I don't think that app is using HTTP at all. I've seen similar behavior with WhatsApp in which HTTPS is only used at the registration phase and then it switches to noise pipes which is not intercepted by HTTP Proxies.

A workaround is to use mitm_relay. It listens raw TCP/UDP packets, encapsulates them in HTTP and forwards them to HTTP Proxy (Burp Suite). The only limitation is that you have to specificy the destination IP and port.

Here is the syntax of the command you can use:

mitm_relay.py -l Listener_IP -r Transport_protocol:Listener_port:Destination_IP:Destination_port -p http_proxy_IP:Port

An example of the same command with IP addreses is:

mitm_relay.py -l -r tcp:8082: -p

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .