Key points
- The app used its own native network stack, so enabling the system proxy produced no usable Burp traffic.
- A kernel-level port redirect combined with a reverse connection and Burp's invisible-proxy mode captured requests without triggering the app's proxy alert.
- System-level certificate installation enabled TLS inspection, while certificate pinning remained a limitation; some application payloads also used a second encryption layer.
Context
The field test covered a Xiaomi 9 running MIUI 11 with Burp Suite Pro on Windows, using a rooted custom kernel. Earlier captures had only included WebView or Weex resources, while the app's actual business APIs continued to connect directly. The findings are particularly relevant to security testing and troubleshooting of hardened Android applications with custom networking stacks.
What this means for you
Directly applicable
The case provides a concrete troubleshooting pattern for missing captures in hardened Android apps that detect proxies or bypass standard network settings.
Who benefits: Developers maintaining hardened or proxy-aware Android clients can use the findings to diagnose failed traffic captures and assess alternative inspection points.
The site's enterprise-architecture consulting can assess how proxy detection, custom network stacks, and certificate constraints affect legacy Android integrations and test environments.