I want to capture all the traffic from an Android app for its pen-testing. How do I do that?
Here's what I've already tried:
I installed the app on an emulator and started the emulator with a
http-proxy pointing to a local port. The local port had ZAP running on it. I'm able to intercept the traffic from the browser but not from the app.
Well, may be my app uses https and I thought I had some certificate problem. So I exported the OWASP ZAP's certificate and
pushed it on the android emulator. Of course, Android >= ICS versions have their cert names hashed using OpenSSL. So I followed some instructions here and I managed to get my ZAP's cert on my device. Still, I'm not able to intercept the traffic.
My next line of thought was: May be this app is damaged. So I installed Facebook, Pocket and Guardian (news) apps from the app store into the emulator and tried intercepting their traffic. I can intercept the traffic from Guardian but Pocket and Facebook are unable to connect to internet (so is my app). However, I can browser the internet from my browser on the emulator.
Honestly, I'm at my wits end. I don't understand why this is happening. I haven't done a lot of pen-tests before so, I guess I lack experience. Could anyone help this poor soul?
(Of course, I can always use Wireshark, but it wouldn't be able to MiTM the requests and responsees the way ZAP or Burp does.)
After "Google-ing" like a madman, I finally found that Android doesn't have a support for global proxy (which works for, both browser AND apps). More info can be found here.