I recently learned of an easier way to proxy Flutter apps than setting up a VPN. This works only on macOS. Here are the steps. Note that you may still have to bypass certificate pinning. You must also configure your device to trust the Burp Proxy CA certificate before capturing traffic. If you haven't already done so, do that first.
- In the terminal, run
ifconfig | grep bridgeand make a note of the bridge number(s) you already have. - Connect the test device by USB cable.
- Turn off WiFi (and cellular if available) on the test device
- Go to Settings -> Internet Sharing, turn on next to the listed device and turn Internet Sharing On.
- In the terminal, run
ifconfig | grep bridgeand make a note of the new bridge number. In my case, interfacebridge0was already there andbridge100is now available. - To check if traffic is flowing from the device to the Internet through your Mac, run
tcpdump -i bridge100. - Setup iptables forwarding. Edit the configuration file:
sudo nvim /etc/pf.conf - Between the lines
rdr-anchor "com.apple./*"anddummy-anchor "com.apple./*", add a new line:rdr on bridge100 inet proto tcp from any to any -> 127.0.0.1 port 8080. Change the port from 8080 if you're using a different port. Save the changes. - Flush the rules:
sudo pfctl -f /etc/pf.conf - Setup ip forwarding:
sudo sysctl -w net.inet.ip.forwarding=1 - In Burp proxy settings turn on invisible proxying.
I learned this from the 8ksec "Practical Mobile Application Exploitation" course. This is a really good course! I already had a lot of experience yet I'm still learning from it.