Network interception

In android there are several ways to make HTTP requests. For example using HttpURLConnection (low-level API built into Java), OkHttp (A popular third-party library) etc.

Cleartext Traffic

Starting from Android 9 (API level 28), HTTP clients like URLConnection, Cronet, and OkHttp enforce the use of HTTPS, thus disabling cleartext traffic by default. However, it’s important to note that other HTTP client libraries, such as Ktor, may not enforce these restrictions [↗].

However, if developers explicitly set usesCleartextTraffic=true [↗] in the manifest or network security configuration [↗], cleartext traffic is permitted.

SSL interception

To intercept TLS/SSL traffic, the proxy certificate must be trusted by the device. Android recognizes two types of certificates: user certificates and system certificates. Applications can explicitly configure which certificate types they trust using network security config.

Example network_security_config.xml:

<base-config cleartextTrafficPermitted="false">
    <trust-anchors>
        <certificates src="system" />
        <certificates src="user" />
    </trust-anchors>
</base-config>

<base-config>
    <trust-anchors>
        <certificates src="system" />
    </trust-anchors>
</base-config>

<base-config>
    <trust-anchors>
        <certificates src="system" />
        <certificates src="user" />
    </trust-anchors>
</base-config>

If the application doesn’t accept user certificates you need to install system certificate or patching network security config.

User Certificate

Install it in the user CA store via Android settings. In general apps trust user certificates if it targets Android 6 (API 23) or lower, or network security config allows it.

mv cacert.der cacert.crt

Note: Keep in mind that Android accepts both DER and PEM formats. When you install a certificate as a user (regardless of the format), Android automatically converts it to DER format.

System Certificate

Requirement: rooted device.

• Rooted physical device.
• Rooted emulator.
• Android Virtual Device (AVD) using non Google Play Store emulator image (If you need it you could root it).

Patching Network Security Config

1. Unpack the apk.

   apktool d target.apk

2. Modify the AndroidManifest.xml to add a networkSecurityConfig (xml/network_security_config.xml). If it’s already present edit the file.

   AndroidManifest.xml

   <?xml version="1.0" encoding="utf-8"?>
   <manifest ... >
       <application android:networkSecurityConfig="@xml/network_security_config" ... >
           ...
       </application>
   </manifest>

   network_security_config.xml

   <!-- Example -->
   <network-security-config>
       <base-config>
           <trust-anchors>
               <certificates src="system" />
               <certificates src="user" />
           </trust-anchors>
       </base-config>
   </network-security-config>

3. Repack & sign the apk.

   # Repack
   apktool b
   # Sign
   java -jar uber-apk-signer.jar -apk <app_name>.apk

   Note: Unpacking and repacking an app can break stuff.

Intercepting Without Proxy Support

If you configure an HTTP proxy in Android settings, you can intercept network traffic. However;

• Connections made directly via TCP sockets bypass the proxy and cannot be intercepted.

• Applications may bypass the HTTP proxy settings if the developer configures them to disallow proxy usage. E.g. with OkHttp:

  OkHttpClient client = new OkHttpClient.Builder()
      .proxy(java.net.Proxy.NO_PROXY) // Disables proxy usage
      .build();

• Also framework like Flutter and Xamarin application does not respect system proxy.

Android Studio emulator

Requirement: the proxy certificate must be installed in the system certificate store.

In Android Studio, you can configure a global proxy for an emulated device by going to the device’s Settings > Proxy -> Manual proxy configuration. In the host name field set burp suite proxy with http protocol: e.g. http://192.168.1.90 and port number.

Warning: If your proxy is unreachable, try changing the emulator version. You can find other versions here: https://developer.android.com/studio/emulator_archive.

HTTP interception with VPN (Rethink app)

Warning: This method is not recommended when using the Android Studio emulator. Strange things could happen…

Requirement: the proxy certificate must be installed in the system certificate store.

If the proxy settings are ignored, use an Android VPN service app to intercept app traffic. You can use the open-source RethinkDNS app [↗].

Steps:

1. Set DNS settings to “System DNS”.
2. Add an HTTP(S) CONNECT proxy (your http://burpsuiteip:port).
3. Start the VPN service.

DNS spoofing & transparent proxy (Rethink app)

Warning: This method is not recommended when using the Android Studio emulator. Strange things could happen.

Requirement: The proxy certificate must be installed in the system certificate store.

Before starting, you need to bind Burp to a privileged port.

sudo touch /etc/authbind/byport/443
sudo chown $USER:$USER /etc/authbind/byport/443
sudo chmod 755 /etc/authbind/byport/443

authbind --deep java -Djava.net.preferIPv4Stack=true -jar burpsuite.jar

1. We need some kind of DNS server where we can control the IP. Example dnsmasq.conf:

   address=/target.com/192.168.1.50
   log-queries

2. Run dnsmasq with docker:

   docker pull andyshinn/dnsmasq
   docker run --name my-dnsmasq --rm -it -p 0.0.0.0:53:53/udp -v /tmp/dnsmasq.conf:/etc/dnsmasq.conf andyshinn/dnsmasq

3. Enforce DNS usage using Android’s VPN feature with tools like RethinkDNS.

   • From “configure” -> “DNS” -> Change DNS settings to “Other DNS”.
   • Select “DNS Proxy”.
   • Create a new entry pointing at your local DNS server host.

4. Finally, configure your proxy tool for invisible proxying. Burp will act as an HTTP(S) server, parse the HOST header, and forward requests. Ensure an invisible proxy listener is set on ports 443 and 80.

GET http://example.org/foo.php HTTP/1.1
Host: example.org

GET /foo.php HTTP/1.1
Host: example.org