Skip to content

04-network-analysis.md

Latest commit

 

History

History
87 lines (62 loc) · 2.5 KB

04-network-analysis.md

File metadata and controls

87 lines (62 loc) · 2.5 KB
Raw

04 — Network Analysis

Mobile apps talk. Most of what they say is interesting.

Traffic interception setup

Android

# Set proxy
adb shell settings put global http_proxy <IP>:8080

# Or use iptables redirect (if app ignores system proxy)
adb shell iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination <IP>:8080

Install Burp CA as system cert (requires rooted device + system partition write):

adb push cacert.der /data/local/tmp/cert.cer
adb shell su -c "mv /data/local/tmp/cert.cer /system/etc/security/cacerts/"
adb shell su -c "chmod 644 /system/etc/security/cacerts/cert.cer"

iOS

Settings → Wi-Fi → (i) → HTTP Proxy → Manual
Server: 127.0.0.1
Port: 8080

Burp CA:

  • Safari → http://burp → Download CA
  • Settings → General → VPN & Device Management → Install
  • Settings → About → Certificate Trust Settings → Enable

What to look for

  • HTTP instead of HTTPS (any endpoint).
  • Sensitive data in URL query strings (tokens, PII).
  • Weak auth (Basic Auth, API key in header without rotation).
  • Verbose error messages in JSON responses.
  • Session tokens in URLs (leak to logs / referrer).
  • Missing certificate validation (accepts any cert).
  • Certificate pinning — is it implemented? Can it be bypassed?

Capturing traffic

# tcpdump on device (rooted)
adb shell tcpdump -i any -w /sdcard/capture.pcap
adb pull /sdcard/capture.pcap .

# iOS via rvictl (macOS)
rvictl -s <udid>
tcpdump -i rvi0 -w capture.pcap
rvictl -x <udid>

Protocol analysis

WebSocket

  • Same origin policy doesn't apply — check origin validation on upgrade.
  • Messages after handshake may bypass auth checks applied only to HTTP.

gRPC / Protocol Buffers

  • Decode with Burp extension gRPC-Web or protobuf-decoder.
  • Look for JSON fallback endpoints (/json or ?format=json).

MQTT / AMQP

  • IoT-heavy apps may use MQTT. Check authentication on broker.
  • Default credentials: admin/admin, guest/guest.

What gets missed

  • Background sync traffic — push down the notification tray and watch for API calls.
  • Certificate pinning on WebView only — the native layer may be pinned, but the WebView isn't.
  • DNS-over-HTTPS bypassing local DNS interception.
  • Hardcoded backup endpoints that don't go through the proxy.

Don't bother

  • Trying to intercept traffic before SSL pinning is bypassed. Pinning bypass first, everything else second.
  • Reporting "app uses third-party analytics" unless it leaks PII.