I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not.
I have set up a MITM proxy (as an attacker) on my lubuntu machine and set my cell phone to connect to the proxy before connecting to each app's server. Besides, I use Wireshark to see the traffic.
If an app is vulnerable, the app should easily connect to its server after the login was successful and show the data in that account. I should also be able to see in Wireshark that the cell phone, the proxy and the app's server were connected to each other and finished the SSL handshake process successfully.
Now my question is why (for only a few vulnerable apps) I can easily connect to the app's server while the app itself does not show any warning when connecting to the proxy, but there is no "finished" packet or "cipher key changed" packet in Wireshark? In other words, it seems that this app is connected to its server through the proxy so it is vulnerable, but Wireshark does not show any connection with the server, or cipher key changed, or finished frame; and as a result, based on observation in Wireshark, seems that the app, proxy and server do not finish the SSL handshake process completely, and I am still doubtful if the app is really vulnerable (note that the proxy's certificate is not configured on the phone, otherwise, the proxy was considered as a trusted party). Any answers or ideas would be helpful and appreciated!

  • Do you see part but not all of an SSL connection/handshake in Wireshark, or nothing? Your description is inconsistent. If nothing, either your application isn't using the proxy, or you aren't running Wireshark correctly to capture and display it. If you see most of a normal handshake but are "missing" only the Finished messages, that is because they are encrypted and Wireshark cannot decode them, and so displays only "Encrypted Handshake Message". You have to look at the length(s) and compare to the protocol to identify them. Commented Apr 17, 2014 at 7:57
  • Some vulnerable apps show all SSL handshake process clearly. then the cipher key is changed & all parties start to encrypt application data. So I am sure that the apps were connected to the proxy and then proxy was connected to the server. But, for some other vulnerable apps, I only see client request and then proxy shows its certificate.nothing after that. Although these apps allow me to login without any problem and direct me to my accounts, they do not show complete SSL process in wireshark. I know my wireshark works well because for other vulnerable apps it shows SSL handshake completely. Commented Apr 17, 2014 at 21:43
  • based on what I mentioned in the previous comment, now my question is if those apps are really vulnerable to man in the middle attack or they just pass the proxy without connecting to it. Commented Apr 17, 2014 at 21:49

1 Answer 1


To really know what is happening, you should not set your Linux machine as a proxy but as a router. The "proxy" really is an HTTP proxy. Applications which want to do HTTPS (HTTP-within-SSL) may use the system settings and use a CONNECT method to make your proxy forward the traffic in both directions; but they may also connect directly to the serve, completely ignoring your proxy setting. Applications which want to use SSL but not HTTPS (they do "something else" than HTTP within the SSL tunnel) are unlikely to use your proxy at all.

I suppose that this is what you observe: with your HTTP proxy, you only see part of the communications, and not the parts that you are interested in.

A typical low-tech Man-in-the-Middle will setup a fake WiFi access point, which will be the router for all IP packets exchanged by the cell phone. This is both easier for him than trying to convince you to use a custom HTTP proxy, and it gives him more actual attacking power.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .