Burp suite for android apps

For a long time now, I have been thinking of blogging on things I learn new. I feel now that nothing will happen if I simply dream of them. So here is the kick start

Burp is wonderful tool to intercept and analyse requests that go from web application to the server. It captures all the calls made by the web application first. You can tamper the payload, query params and every other aspect and send the modified request to the server. One can do injections too.

All said and done, lets now see how we can set up Burp for mobile applications. Here are the steps.

1. Install genymotion
https://wiki.appcelerator.org/display/guides2/Installing+Genymotion
2. Create account and login




3. Launch a simulator with OS lesser than Android 6
4. Once the simulator launches, click on "Open  GAPPs" on the top right most corner. This will install the play store.




5. From Playstore, install chrome, EX file manager, and the app you want to test
6. Go to settings and choose the network you are connecting, Long press it and "Forget Network"
7. Choose a new and choose "Manual" proxy
8. Go to your laptop and open terminal and issue "ifconfig". Get your ip address
9. The same be provided as the proxy hostname in the simulator
10. Give the port as 8080



11. Now in the burp, open Proxy tab and go to "Options". Add Listeners. In the next pop up, choose "Bind to addresses"->"Specific Addresses" and in the drop down, choose your ip address. Mark the port as 8080




12. On the simulator, open chrome and hit "http://burp". On the website, click and download the CA certificate




13. Go to Ex file manager, open the downloads and rename the downloaded file as "certificate.cer" from "certificate.der"

14. Go to settings and click on Security
15. Install certificate and use this "certificate.cer". You can name the certificate as anything. (Eg: spotify.cer)
16. Open the app you want to scan and see in the burp suite -> Proxy -> Http history, the calls made by the app should be stored. Turn off the interceptor so all the calls are captured without intervention in the history. Intercept only calls that you like to.

Comments

Post a Comment

Popular posts from this blog

Bug bounty - Simple tips and tricks

Image
Its been a couple of months that I am bug hunting and I think I got hang of it now. Bug bounties are the most fancied way of earning money among the ethical hackers and otherwise engineers. I get many requests on Linkedin and Telegram to teach them about bug bounty. I have followed a few big time bug hunters and learnt from them. There are awesome writeups, podcasts and tutorials on Pentester.Land Here are a few tips and tricks to get started with any bounty program. Follow platforms like HackerOne and BugCrowd. They have organised bounty programs which reward in points and money according to the priority of the bug found. They have charity programs too if you wish to donate. So, when there are new programs launched for websites, mobile apps and APIs, you get to see whats in scope of the program and whats not. If you are reporting a bug thats not in scope, you get -ve points. There will be rules of the program which you MUST read carefully to understand the type of progra...
Read more

Hashing, Salting, Encoding and Encrypting

Image
One of the most asked questions when you say you are a cybersecurity engineer is that whats the difference between hashing, encoding and encryption. Many great blogs are available out there to answer that question. I try to make things simple so a layman gets it right. Hashing Hashing is a one way function where the given string is converted to fit in to a fixed length string using hashing algorithms. Simply put its a set of rules that convert the text in to a fixed length text. Hashing is basically used to check the authenticity of data. Assume you have a file that should be downloaded from a website. First you hash the file and digitally sign it. Now you hash the signed file too and encrypt(will talk about this later). The browser that downloads the file at the client end will get these two hash values from the file. Now it employes the same hashing mechanism and generates its own set of hashes. If these two hashes match the ones with the file downloaded, then the browser kn...
Read more

Homomorphic encryption

Image
Homomorphic encryption is a type of encryption where the data in transit can be accessed, computed, analysed all the while the data remains encrypted. This can be extension of both symmetric and asymmetric encryption(See Symmetric and Asymmetric Encryption for more details). This can be used for outsourcing encrypted data for storage and computation to the cloud environments In plain language homomorphic encryption is like this - Assume there are many things in a bag and you put your hands inside, manipulate their positions, access them and sense them but you cant pull them out and see for real what they are. This kind of data transmission is required in healthcare where the privacy is of most concern. The same holds good for voting purposes where the data needs to be encrypted for privacy purpose but also should be assessed. In the banking sectors too this is used to protect the PII and still perform the required processing on the data. The computations on the data are rep...
Read more