Intercepting Traffic for Mobile Applications that Bypass the System Proxy

Black Hills Information Security, Inc.

Bad Habits: An ANTISOC Operation Same Problem, Different Angles: When Red Team and Blue Team Actually Talk to Each Other How to Identify and Exploit New Vulnerabilities Swapper – A Pure Regex Match/Replace Burp Extension A Practical Guide to BloodHound Data Collection Network Engineering Basics Signed, Trusted, and Abused: Proxy Execution via WebView2 Getting Started In Pentesting – Advice From The BHIS Pentest Lead Cloud Security: Tips and Resources for Securing the Cloud Lessons From A Chatbot Incident How to Lead Effective Tabletops Understanding GRC: How to Navigate Risks and Compliance Standards The “P” in PAM is for Persistence: Linux Persistence Technique Malware Analysis: How to Analyze and Understand Malware OSINT: How to Find, Use, and Control Open-Source Intelligence What to Do with Your First Home Lab When the SOC Goes to Deadwood: A Night to Remember Social Engineering and Microsoft SSPR: The Road to Pwnage is Paved with Good Intentions Common Cyber Threats Finding the Right Penetration Testing Company Deceptive-Auditing: An Active Directory Honeypots Tool The Curious Case of the Comburglar How to Set Smart Goals (That Actually Work For You) Inside the BHIS SOC: A Conversation with Hayden Covington Abusing Delegation with Impacket (Part 3): Resource-Based Constrained Delegation Why You Got Hacked – 2025 Super Edition Abusing Delegation with Impacket (Part 2): Constrained Delegation Abusing Delegation with Impacket (Part 1): Unconstrained Delegation GoSpoof – Turning Attacks into Intel Model Context Protocol (MCP) Bypassing WAFs Using Oversized Requests Getting Started with AI Hacking Part 2: Prompt Injection Wrangling Windows Event Logs with Hayabusa & SOF-ELK (Part 2) DomCat: A Domain Categorization Tool Wrangling Windows Event Logs with Hayabusa & SOF-ELK (Part 1) Microsoft Store and WinGet: Security Risks for Corporate Environments Default Web Content MailFail Commonly Abused Administrative Utilities: A Hidden Risk to Enterprise Security Stop Spoofing Yourself! Disabling M365 Direct Send Bypassing CSP with JSONP: Introducing JSONPeek and CSP B Gone Offensive Tooling Cheatsheets: An Infosec Survival Guide Resource DNS Triage Cheatsheet GraphRunner Cheatsheet Burp Suite Cheatsheet Impacket Cheatsheet Wireshark Cheatsheet Hashcat Cheatsheet EyeWitness Cheatsheet Nmap Cheatsheet Netcat (nc) Cheatsheet Hunt for Weak Spots in Your Wireless Network with Airodump-ng from the Aircrack-ng Suite Detecting ADCS Privilege Escalation Vulnerability Scanning with Nmap Getting Started with NetExec: Streamlining Network Discovery and Access How to Use Dirsearch Augmenting Penetration Testing Methodology with Artificial Intelligence – Part 3: Arcanum Cyber Security Bot How to Design and Execute Effective Social Engineering Attacks by Phone Abusing S4U2Self for Active Directory Pivoting Why Use a Macro Pad? Espanso: Text Replacement, the Easy Way Caging Copilot: Lessons Learned in LLM Security Augmenting Penetration Testing Methodology with Artificial Intelligence – Part 2: Copilot Augmenting Penetration Testing Methodology with Artificial Intelligence – Part 1: Burpference How to Root Android Phones Communicating Security to the C-Suite: A Strategic Approach Offline Memory Forensics With Volatility Getting Started with AI Hacking: Part 1 Go-Spoof: A Tool for Cyber Deception How to Test Adversary-in-the-Middle Without Hacking Tools Canary in the Code: Alert()-ing on XSS Exploits How to Hack Wi-Fi with No Wi-Fi Why Your Org Needs a Penetration Test Program Burp Suite Extension: Copy For Light at the End of the Dark Web Wi-Fi Forge: Practice Wi-Fi Security Without Hardware Avoiding Dirty RAGs: Retrieval-Augmented Generation with Ollama and LangChain Gone Phishing: Installing GoPhish and Creating a Campaign 5 Things We Are Going to Continue to Ignore in 2025 John Strand’s 5 Phase Plan For Starting in Computer Security Questions From a Beginner Threat Hunter GRC for Security Managers: From Checklists to Influence AI Large Language Models and Supervised Fine Tuning Attack Tactics 9: Shadow Creds for PrivEsc w/ Kent & Jordan One Active Directory Account Can Be Your Best Early Warning Introduction to Zeek Log Analysis Indecent Exposure: Your Secrets are Showing Creating Burp Extensions: A Beginner’s Guide Pitting AI Against AI: Using PyRIT to Assess Large Language Models (LLMs) The Top Ten List of Why You Got Hacked This Year (2023/2024) ICS Hard Knocks: Mitigations to Scenarios Found in ICS/OT Backdoors & Breaches Intro to Data Analytics Using SQL Finding Access Control Vulnerabilities with Autorize The Detection Engineering Process Cyber Risk Lessons We Can Learn From Hurricane Preparedness Intro to Desktop Application Testing Methodology What Is Penetration Testing? Adversary in the Middle (AitM): Post-Exploitation Pentesting, Threat Hunting, and SOC: An Overview QEMU, MSYS2, and Emacs: Open-Source Solutions to Run Virtual Machines on Windows

BHIS · 2025-04-30 · via Black Hills Information Security, Inc.

by Cameron Cartier and Dave Blandford

This is a foolproof guide to intercepting traffic from mobile applications built on Flutter, which historically have been especially challenging to intercept. The methods presented should work for other types of applications as well. In the first half of this blog, we will discuss a method of intercepting iOS traffic via internet sharing on Mac. In the second half, we will show you how to intercept traffic from a rooted Android virtual device (AVD) using HTTP Toolkit.

Need help with the rooting process? You can check out Dave’s blog on ‘How to Root Android Phones’ here: https://www.blackhillsinfosec.com/how-to-root-android-phones/

**Ben Taking a Break from a Flutter Mobile App Test**

Internet Sharing for iOS

Warning: If you don’t follow every step exactly as specified, you will spend hours banging your head against a wall thinking you’ve gone crazy because it worked yesterday, and now everything looks broken because you forgot a single step. Ask me how I know.

Requirements:

A Jailbroken iOS Device (tested on iPhoneX running iOS 16.5.1)
MacBook Pro
Some combination of adapters to connect the two

From the computer, go to Settings -> Sharing -> Internet Sharing. Before toggling this on, click the info icon on the right-hand side.

This will bring you to the menu shown below.

Next, connect your iOS device via USB. This should still work if you’re using a program like USBFlux. Once you do this, you should see the “iPhone USB” option shown above. Change the settings to share from Wi-Fi to the iPhone. This should match the screenshot above. In addition, make sure that Wi-Fi and any other network interfaces are turned off on the phone.

This will create a new network interface on the Mac, which will show up if you run ifconfig. In my case, the new interface was bridge103.

To verify that the traffic you are interested in is now visible from the Macbook, you can run:

 tcpdump -i <bridge interface for the phone>

You should see traffic when using the iOS device. This indicates you are successfully sharing internet with the device over the bridge interface.

Next, open the pf.conf file in your favorite text editor:

sudo vim /etc/pf.conf

Add the following line:

rdr on bridge103 inet proto tcp from any to any -> 127.0.0.1 port 8889

This must be added in the exact position shown below (after the rdr anchor and before the dummynet-anchor line), otherwise you will get an error when you run the next command.

Now, flush the rules with the following command.

sudo pfctl -f /etc/pf.conf

Then we enable IP forwarding:

sudo sysctl -w net.inet.ip.forwarding=1

This should forward all traffic coming into the bridge103 interface over to localhost:8889. Now we will start a Burp Suite listener on that port.

**Burp Suite Proxy Binding Configuration**

In addition to changing the host and port shown above, we need to enable support for invisible proxying. Invisible proxying is a method for non-proxy-aware clients or applications to connect directly to a Burp Proxy listener. This is useful at times when the requests are not formatted in a way the proxy is expecting. More information can be found in this Portswigger blog.

This can be enabled simply by checking a box on under the “Request Handling” tab.

**Burp Suite Proxy Request Handling Configuration**

That’s it. You should now see the HTTP history tab populating.

**Traffic Successfully Intercepted from iOS Device (Redacted for Privacy)**

HTTP Toolkit for Android

With apps that do not use the system proxy, like Flutter apps, there is more attention and effort needed to capture the traffic leaving the application and going to the backend servers. There are many solutions to capture Flutter traffic but the easiest method I have found is detailed below.

Capture the Traffic

Now on to what we came to do, capture traffic for apps that do not use the system proxy. First, download HTTP Toolkit (https://httptoolkit.com/). To use the HTTP Toolkit with an upstream proxy (like Burp Suite), we need the Pro version. At the time of this blog publication, a Pro subscription was $14.00 (https://httptoolkit.com/get-pro/). They offer a monthly subscription so you can turn Pro on/off as needed when testing calls for it.

**Settings View in Application Showing Monthly Pro Subscription**

Next, open HTTP Toolkit. In the Intercept tab, options are presented for what type of traffic to intercept. Review the Android options.

Use the Android Device via ADB option. This option will set up a VPN connection from the phone to HTTP Toolkit, capturing all traffic.

After you accept the VPN request, your device will connect to HTTP Toolkit. Because HTTP Toolkit is connected to a rooted device, it will automatically install the certificate on the device. In addition, the HTTP Toolkit app will be installed on the device.

To configure the upstream connection to Burp Suite (or your hacking tool of choice), navigate to the Settings option inside HTTP Toolkit. Scroll down to CONNECTION SETTINGS and select Use an HTTP Proxy. Set the value to your Burp Suite instance IP address and port that Burp is listening on. For example: 10.X.X.X:8080

The Burp Suite CA certificate will need to be loaded in the TRUSTED CA CERTIFICATES section. Upload your .der cert where it says Load a CA certificate.

**Connection Settings to Set Upstream Proxy to Burp Suite**

Now navigate the application. You should be capturing the app’s traffic in your web application proxy. If you encounter errors, it may be related to certificate pinning or Flutter stuff, such as the usage of the BoringSSL library (https://github.com/dart-lang/boringssl_gen) for certificate verification. Additional effort is needed to bypass certificate checks, which is not covered in this blog.

Note about iOS and HTTP Toolkit: On iOS, HTTP Toolkit uses Frida to hook into the application. The method can bypass some certificate pinning implementations but applications that are not system proxy aware need another method to capture traffic (such as the one described in the first section of this blog). HTTP Toolkit will not capture traffic for applications that are system proxy unaware on iOS.

Wrapping Up

Mobile application frameworks and technologies are always changing, which can make figuring out how to proxy traffic incredibly difficult. However, it is not impossible, and the methods demonstrated will hopefully make it less of a challenge, both on Android and iOS devices.

HTTP Toolkit is a great option to have in your toolbox! If you are using a physical device, you can still use ADB either connected with a USB or, for Android version 11 and higher, over wireless.

Also, Jeroen Beckers has conducted some great research into this area and his blogs are a great resource in mobile testing—specifically, testing Flutter applications. So, if you ever get stuck on a mobile application, his blogs are a great resource to use (https://blog.nviso.eu/category/mobile-security/).

Ready to learn more?

Level up your skills with affordable classes from Antisyphon!

Pay-What-You-Can Training

Available live/virtual and on-demand

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Black Hills Information Security, Inc.

Internet Sharing for iOS

HTTP Toolkit for Android

Capture the Traffic

Wrapping Up