I use Fiddler to inspect app traffic for extracting API (headers, body, response and..) but on Xamarin apps, Fiddler does not work because the app does not accept system proxy.
How can I do that?
1 Answers
You can use burp to intercept traffic on a windows machine. Here's a guide on how to achieve that: https://resources.infosecinstitute.com/topic/windows-mobile-application-penetration-testing-part-5-intercepting-httphttps-traffic-of-uwp-apps-on-windows-desktop/
Basically you route all traffic through burp and install the certificate on the machine to let burp know how to decrypt the outgoing traffic.
If it's not proxy aware, then you can use this DNS trick here:https://portswigger.net/support/using-burp-suites-invisible-proxy-settings-to-test-a-non-proxy-aware-thick-client-application
Related