Android + Droidproxy + Burp = Man In The Middle (Mitm) Android Applications And Games

[operat0r_001]

11:10 AM 7/19/2012

*New Disney Pirates game I played for two days before this 'testing'

*Using DROIDPROXY ( type HTTP ) / burpesuite CA per host

*Set phone in airplane mode ( just in case it forces 3G etc )

*In Firefox downloaded generated CA and imported into phone via ‘adb push www.google.com.crt /excad/’ ( not sure if it even matters in this case.. as the post seem to be going over HTTP !?! )

*Rooted android phone

Replaing a HTTP POST from unlocking chest I get “ users request is old”:

Changing HTTP POST PostStamp numbers I get “NON VALID SIGNATURE”

Replace response from the HTTP POST from the server to 999:

WINNING !

I will most likely get banned shortly .. ( I was ban about 20min after ;/) … most online games ban for this type of “PUSHING” when a high level pushes or gives items/currency to low level user…