0

I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This not happens for all installed apps on my device but only on fewer ones. At the beginning, I thought that it could've been a problem due to TLS or SSL certificates, but them seem to be properly installed. In fact, I'm able to intercept the request for google.com when using safari for example. Note that with this kind of apps what happens is that when I start one of them, every request gets "stucked" and BurpSuite shows nothing in the interceptor proxy, then it simply time-outs. So I would like to ask, how is it possible ? How gets prevented a sniffing attempt through a proxy, and can this security restrict be someway bypassed? Currently testing on iOS, but I don't exclude the same goes for Android.

Event Log shows this:

[14]  The client failed to negotiate a TLS connection to site:443: Remote host terminated the handshake
5
  • What apps exactly? What ports they use? What ports are allowed on the proxy?
    – mentallurg
    Dec 31 '21 at 16:54
  • @mentallurg check the edited question. Port is 443 and 14 are the attempts to obtain a handshake with remote server. The kind of apps is not important, since it's not the first time I get this problem. On the proxy I set in ProxyListeners the following: Interface: *:5555; Certificate: Per-host; Tls-Protocols: TLSv1.3,TLSv1.2, TLSv1.1, TLSv1
    – Virgula
    Dec 31 '21 at 16:58
  • 1
    Check if the app uses client certificates or pinning.
    – vidarlo
    Dec 31 '21 at 17:03
  • @vidarlo Ok the problem was the TLS pinning. Going to proxy -> options -> and enabling: "automatically add entries on client TLS negation failure" under TLS Pass Through seems to work. It would be interesting anyway get known about how to extract certificates within the app.
    – Virgula
    Dec 31 '21 at 17:35
  • You can bypass this with SSL pinning or rooting your phone to add the certificate directly to the system certificate manager.
    – Xiddoc
    Dec 31 '21 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.