Traffic Interception — Proxy, iptables & Invisible Proxying

2026-03-07 · Android · advanced

#android #burpsuite #iptables #proxy #dns #nat

Part 7 of the Android Pentest series.

Trust and pinning solved, you still have to actually route the app’s traffic to your proxy. There are three strategies, in increasing order of heavy-handedness.

Pick a method

Method	When to use
Global HTTP proxy	App respects system proxy settings (most apps)
iptables redirection	App ignores proxy or uses non-standard ports
Invisible proxying	App does its own DNS + host verification

Global HTTP proxy

The simplest approach — a device-wide proxy most apps respect (HttpURLConnection, default OkHttp, WebView).

BURPSUITE_IP="<YOUR_HOST_IP>"

adb shell settings put global http_proxy "$BURPSUITE_IP:8080"
adb shell settings put global http_proxy_host "$BURPSUITE_IP"
adb shell settings put global http_proxy_port 8080
adb shell settings put global global_http_proxy "$BURPSUITE_IP:8080"
adb shell settings put global global_http_proxy_host "$BURPSUITE_IP"
adb shell settings put global global_http_proxy_port 8080

Check current settings:

adb shell settings get global http_proxy
adb shell settings get global global_http_proxy

Clean up afterwards (do this — leftover proxy settings break the device’s normal browsing later):

adb shell settings delete global http_proxy
adb shell settings delete global http_proxy_host
adb shell settings delete global http_proxy_port
adb shell settings delete global global_http_proxy
adb shell settings delete global global_http_proxy_host
adb shell settings delete global global_http_proxy_port

# Some Android versions need an explicit null too
adb shell settings put global http_proxy :0
adb shell settings put global global_http_proxy :0

📌 Edge case. Apps with native code or custom HTTP stacks ignore the system proxy entirely. If traffic doesn’t show up in Burp, move to iptables.

iptables traffic redirection

The heavy-handed approach: rewrite packets at the kernel level so anything to port 80/443 goes to Burp, regardless of what the app thinks it’s doing. Run in an adb shell as root:

BURPSUITE_IP="<YOUR_HOST_IP>"

# Redirect all outbound HTTP/HTTPS to BurpSuite
iptables -t nat -A OUTPUT -p tcp --dport 80  -j DNAT --to-destination $BURPSUITE_IP:8080
iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination $BURPSUITE_IP:8080

# Keep loopback working
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT  -i lo -j ACCEPT

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

⚠️ Why ip_forward? Without it the kernel silently drops forwarded packets. This is the most commonly missed step — if your rules look correct but nothing reaches Burp, check this first.

To also catch traffic from other devices routing through this one (device as gateway):

iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination $BURPSUITE_IP:8080
iptables -t nat -A PREROUTING -p tcp --dport 80  -j DNAT --to-destination $BURPSUITE_IP:8080

⚠️ Rules do not survive a reboot — they’re in-memory only. Also enable “Support invisible proxying” on the Burp listener (Proxy → Options → listener → Request Handling) and bind it to a reachable interface, not just 127.0.0.1.

Invisible proxying (no Wi-Fi settings)

When the app does its own DNS resolution and validates the destination host, intercept at the DNS level. As root on the device:

mount -o rw,remount /
echo "<BURPSUITE_IP>  <target.api.domain.com>" >> /etc/hosts

Multiple backends:

cat >> /etc/hosts << EOF
192.168.1.100  api.example.com
192.168.1.100  cdn.example.com
192.168.1.100  auth.example.com
EOF

On BurpSuite: add a listener bound to 443 (or the app’s port) on all interfaces, then under Request Handling set Redirect to host = the real target, Redirect to port = 443, and tick Support invisible proxying.

📌 If the app also pins certificates on top of host verification, combine this with a Frida SSL bypass — invisible proxy handles routing, Frida handles trust.

Managing iptables rules

Flush everything (nukes all rules — breaks VPN/tethering if present):

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -t raw -F
iptables -t security -F

Delete only your rules (safer):

iptables -t nat -L OUTPUT -n --line-numbers
iptables -t nat -D OUTPUT <line_number>

iptables -t nat -L PREROUTING -n --line-numbers
iptables -t nat -D PREROUTING <line_number>

Troubleshooting

Symptom	Likely cause	Fix
Rules set, no traffic in Burp	`ip_forward` disabled	`echo 1 > /proc/sys/net/ipv4/ip_forward`
Rules set, no traffic in Burp	Burp bound to `127.0.0.1` only	Bind to `0.0.0.0` or the host IP
Global proxy ignored	App uses a custom HTTP stack	Switch to iptables redirection
`/etc/hosts` edit ignored	App uses its own DNS resolver	Combine iptables DNAT + invisible proxy
Everything gone after reboot	Expected — memory-only	Re-apply rules / proxy