I noticed more and more times that some mobile apps are able to block requests, and they don't forward those requests to the server if they're going to be intercepted with a proxy like BurpSuite. This not happens for all installed apps on my device but only on fewer ones. At the beginning, I thought that it could've been a problem due to TLS or SSL certificates, but them seem to be properly installed. In fact, I'm able to intercept the request for google.com when using safari for example. Note that with this kind of apps what happens is that when I start one of them, every request gets "stucked" and BurpSuite shows nothing in the interceptor proxy, then it simply time-outs. So I would like to ask, how is it possible ? How gets prevented a sniffing attempt through a proxy, and can this security restrict be someway bypassed? Currently testing on iOS, but I don't exclude the same goes for Android.

Event Log shows this:

[14]  The client failed to negotiate a TLS connection to site:443: Remote host terminated the handshake
  • What apps exactly? What ports they use? What ports are allowed on the proxy?
    – mentallurg
    Commented Dec 31, 2021 at 16:54
  • @mentallurg check the edited question. Port is 443 and 14 are the attempts to obtain a handshake with remote server. The kind of apps is not important, since it's not the first time I get this problem. On the proxy I set in ProxyListeners the following: Interface: *:5555; Certificate: Per-host; Tls-Protocols: TLSv1.3,TLSv1.2, TLSv1.1, TLSv1
    – Virgula
    Commented Dec 31, 2021 at 16:58
  • 1
    Check if the app uses client certificates or pinning.
    – vidarlo
    Commented Dec 31, 2021 at 17:03
  • @vidarlo Ok the problem was the TLS pinning. Going to proxy -> options -> and enabling: "automatically add entries on client TLS negation failure" under TLS Pass Through seems to work. It would be interesting anyway get known about how to extract certificates within the app.
    – Virgula
    Commented Dec 31, 2021 at 17:35
  • You can bypass this with SSL pinning or rooting your phone to add the certificate directly to the system certificate manager.
    – Xiddoc
    Commented Dec 31, 2021 at 18:05


You must log in to answer this question.

Browse other questions tagged .