Network interception

In android there are several ways to make HTTP requests. For example using HttpURLConnection (low-level API built into Java), OkHttp (A popular third-party library) etc.

Cleartext Traffic

Starting from Android 9 (API level 28), HTTP clients like URLConnection, Cronet, and OkHttp enforce the use of HTTPS, thus disabling cleartext traffic by default. However, it’s important to note that other HTTP client libraries, such as Ktor, may not enforce these restrictions [↗].

However, if developers explicitly set usesCleartextTraffic=true [↗] in the manifest or network security configuration [↗], cleartext traffic is permitted.

SSL interception

To intercept TLS/SSL traffic, the proxy certificate must be trusted by the device. Android recognizes two types of certificates: user certificates and system certificates. Applications can explicitly configure which certificate types they trust using network security config.

Example network_security_config.xml:

<base-config cleartextTrafficPermitted="false">
    <trust-anchors>
        <certificates src="system" />
        <certificates src="user" />
    </trust-anchors>
</base-config>

<base-config>
    <trust-anchors>
        <certificates src="system" />
    </trust-anchors>
</base-config>

<base-config>
    <trust-anchors>
        <certificates src="system" />
        <certificates src="user" />
    </trust-anchors>
</base-config>

If the application doesn’t accept user certificates you need to install system certificate (or patching network security config).

User Certificate

Install it in the user CA store via Android settings. In general apps trust user certificates if it targets Android 6 (API 23) or lower, or network security config allows it.

mv cacert.der cacert.crt

System Certificate

Requirement: rooted device.

• Rooted physical device
• Rooted emulator
• With Android (AVD) using non-Google emulator image (or root it)

Patching Network Security Config

1. Unpack the apk

   apktool d target.apk
   

2. Modify the AndroidManifest.xml to add a networkSecurityConfig (xml/network_security_config.xml). If it’s already present edit the file.

   <!-- Example -->
   <network-security-config>
       <base-config>
           <trust-anchors>
               <certificates src="system" />
               <certificates src="user" />
           </trust-anchors>
       </base-config>
   </network-security-config>
   

3. Repack & sign the apk

   # Repack
   apktool b
   # Sign
   java -jar uber-apk-signer.jar -apk <app_name>.apk
   

   Note

   Unpacking and repacking an app can break stuff.

Intercepting Without Proxy Support

If you configure an HTTP proxy in Android settings, you can intercept network traffic. However;

• Connections made directly via TCP sockets bypass the proxy and cannot be intercepted.

• Applications may bypass the HTTP proxy settings if the developer configures them to disallow proxy usage. E.g. with OkHttp:

  OkHttpClient client = new OkHttpClient.Builder()
      .proxy(java.net.Proxy.NO_PROXY) // Disables proxy usage
      .build();
  

• Also framework like Flutter and Xamarin application does not respect system proxy.

Android Studio emulator

Requirement: the proxy certificate must be installed in the system certificate store.

In Android Studio, you can configure a global proxy for an emulated device by going to the device’s Settings > Proxy -> Manual proxy configuration. In the host name field set burp suite proxy with http protocol: e.g. http://192.168.1.90 and port number.

HTTP Interception with VPN (Rethink app)

Requirement: the proxy certificate must be installed in the system certificate store.

If the proxy settings are ignored, use an Android VPN service app to intercept app traffic. You can use the open-source RethinkDNS app [↗].

Steps:

1. Set DNS settings to “System DNS”
2. Add an HTTP(S) CONNECT proxy (your http://burpsuiteip:port)
3. Start the VPN service

DNS Spoofing & Transparent Proxy (Rethink app)

Requirement: The proxy certificate must be installed in the system certificate store.

Before starting, you need to bind Burp to a privileged port.

sudo touch /etc/authbind/byport/443
sudo chown $USER:$USER /etc/authbind/byport/443
sudo chmod 755 /etc/authbind/byport/443

authbind --deep java -Djava.net.preferIPv4Stack=true -jar burpsuite.jar

1. We need some kind of DNS server where we can control the IP. Example dnsmasq.conf:

   address=/target.com/192.168.1.50
   log-queries
   

2. Run dnsmasq with docker:

   docker pull andyshinn/dnsmasq
   docker run --name my-dnsmasq --rm -it -p 0.0.0.0:53:53/udp -v /tmp/dnsmasq.conf:/etc/dnsmasq.conf andyshinn/dnsmasq
   

3. Enforce DNS usage using Android’s VPN feature with tools like RethinkDNS.

   • From “configure” -> “DNS” -> Change DNS settings to “Other DNS”
   • Select “DNS Proxy”
   • Create a new entry pointing at your local DNS server host

4. Finally, configure your proxy tool for invisible proxying. Burp will act as an HTTP(S) server, parse the HOST header, and forward requests. Ensure an invisible proxy listener is set on ports 443 and 80.

   Invisible proxying

   Normal Proxy
   In a normal proxy, the client (e.g., a browser or app) is explicitly configured to use the proxy. This means the client intentionally routes traffic through the proxy. Thus:

   • The client is aware of the existence of the proxy.
   • HTTPS requires the client to accept the certificate generated by the proxy (MITM).
   • The request contains both the relative path (/path) and the full address (e.g. GET http://www.example.com/path HTTP/1.1)

   Invisible Proxy
   An invisible proxy operates without the client being explicitly configured to use it. This is useful when the client does not support proxy configurations. Therefore, the client remains unaware of the proxy. However:

   With plain HTTP, a proxy-style request looks like this:

   GET http://example.org/foo.php HTTP/1.1
   Host: example.org
   

   A non-proxy-style request looks like this:

   GET /foo.php HTTP/1.1
   Host: example.org
   

   Proxies usually use the full URL in the first line to determine the destination, ignoring the Host header. In invisible proxying, Burp parses the Host header from non-proxy-style requests to determine the destination.