0

I´m pentesting my first mobile application. I have a rooted android device and followed the steps here and here to install the certificate to proxy the traffic through Burp on my Laptop.

But no requests show up. When I´m opening the app I have the option to either register (trying that throws the error message "User already exists", which is definitely not the case (triple checked that)) or login. I tried logging in with an account created on the webpage but the app throws a "User does not exist" error. When setting the proxy settings on the phone to none, both registration and logging in as existing user work fine.

So my guess is the app is either using certificate pinning or there are some issues with the proxy settings or the certificate.

Improve this question
6
  • @schroeder when trying to register, the app always says "that mail is already registered" (which is clearly not the case), when trying to log in (with an existing account made on the webpage) it says "that user does not exist". As I said it´s my first android pentest so clearly not an expert, but after some googling it seems to me that errors like these indicate certificate pinning
    – Opera of the Phantom
    Sep 13, 2021 at 11:48
  • You say that you did some research that said it was a pinning issue. Can you explain why you think that it is a pinning issue and not a proxy issue?
    – schroeder ♦
    Sep 13, 2021 at 12:10
  • @schroeder for example in this thread forum.portswigger.net/thread/… (First answer by Ben, from portswigger) as far as I understand it, a non correct functioning app while proxy is enabled is seen as an indication of certificate pinning
    – Opera of the Phantom
    Sep 13, 2021 at 12:22
  • Ok, I can see why Ben would say that. So if you want to rule out a misconfigured Burp, then simply use a browser.
    – schroeder ♦
    Sep 13, 2021 at 12:29
  • Done that: if I open Chrome and search for something, I see the requests in Burp. So the setup should be configured correctly?
    – Opera of the Phantom
    Sep 13, 2021 at 12:34

1 Answer 1

Reset to default
1

It turned out to not be a certificate pinning issue but a problem with the self-installed certificates. Since Android Nougat, apps seem to no longer trust user certificates by default (article for reference).

So the solution was the Magisk module AlwaysTrustUserCerts, which made it possible to turn the self-installed Burp certificate into a system certificate.

After that, intercepting the requests through Burp worked without a problem.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .