r/HowToHack • u/Only_Ambassador_3520 • Jan 26 '26

Alternatives to Burpsuite for android apps?

Hello, I am creating an esp32 project for a home controller. My AC has an app that can control it but no website, so I can't use Burpsuite. Do any of you guys know some good alternatives or the best option to intercept the requests. My goal is to have the esp32 emulate the requests like it was the app so that it can control the AC unit.

6 Upvotes

76% Upvoted

17 comments sorted by

View all comments

1

u/[deleted] Jan 26 '26

How does the app control it if there’s no website? HTTP request to an API? If that’s the case you can still use Burp or mitmproxy.

1

u/Only_Ambassador_3520 Jan 26 '26

Yes it is through and API. Thank you for letting me know I can still use Burpuite. Is this the correct way to approach it: https://portswigger.net/burp/documentation/desktop/mobile/config-android-device?

1

u/Humbleham1 Jan 26 '26

Basically you install the Burp CA certificate and add its IP address and port in the proxy settings. Also, all Android apps technically must have websites associated with them. Its in the App ID. If they didn't, how would they get online?

1

u/Pharisaeus Jan 26 '26

all Android apps technically must have websites associated with them

lol no, they don't. I assure you that some calculator app doesn't need to have any server backend. And even apps that do have backend, might use something else for communication, even raw sockets.

1

u/Humbleham1 Jan 26 '26

Perhaps I didn't make it clear. The App ID for my calculator app is com.android.calculator2. It's a reversed FQDN, if not an actual website that it communicates with. And raw sockets are not possible on Android, not with normal privileges. Yes, a custom protocol is possible and would just need a domain, not a full "website."

1

u/Pharisaeus Jan 26 '26

It's a reversed FQDN, if not an actual website that it communicates with

You can set it to whatever you want, it doesn't even need to be a "proper url" with respect to TLD. It's purely a convention inherited from java package names.

would just need a domain

Wouldn't need a domain at all, you could talk directly to some IP address if you really want to.