XServer icon indicating copy to clipboard operation
XServer copied to clipboard

Burp not capturing traffic from xserver even after intercept proxy has been set

Open Green10026 opened this issue 1 year ago • 5 comments

Green10026 avatar Jun 13 '23 13:06 Green10026

the setup uses genymotion emulator, I've set a proxy on the PC itself and another proxy on the wifi interface of the emulator, even tried using a proxy on the access point, all to no avail, can you please attend to this and not treat it as mediocre, it has taken alot of my time, thank you

Green10026 avatar Jun 14 '23 09:06 Green10026

Hello can you kindly respond to this, I'm waiting on your reply

Green10026 avatar Jun 16 '23 15:06 Green10026

First, you shall make sure that XServer is running in target APP. If XServer is running, you will be able to access it's web page. There will be several reasons, mostly because hook framework not work properly.

Then, you shall check proxy settings. When method is hooked, XServer will call it though HTTP and the server address will be 127.0.0.1:8000, with system proxy settings. So, the HTTP traffic should be sent to your proxy, and then come back to XServer's port. By this way, you can modify parameters and result of hooked method. However, you should make sure BURP knows where is XServer's port. Mostly it's 127.0.0.1:8000 that BURP will proxy to, so you need to map 127.0.0.1:8000 to the port XServer listens.

Emulator sometimes I use, I use adb to map the port. Instead of set proxy in wifi settings, I use 3 adb command: 'adb forward tcp:8000 tcp:8000' to map XServer's port to PC. 'adb shell settings put global http_proxy 127.0.0.1:8080' to set proxy. 'adb reverse tcp:8080 tcp:8080' to map BURP's listening port to device.

monkeylord avatar Jul 20 '23 07:07 monkeylord

I use real android mobile to do this, but nothing to intercept too.

pharazone avatar Nov 03 '23 08:11 pharazone

I use real android mobile to do this, but nothing to intercept too.

Can you open it's web page? One should keep methodView page open, to have the interception on.

When methodView page open, it has a websocket connection. XServer websocket handler do intercept and proxy, so you must have the websocket connection.

monkeylord avatar Nov 29 '23 09:11 monkeylord