API request got intercept by burp suite

Question

I am working on an app that has SSL pinning not implemented security point open.

This below method is responsible for API calling with SSL code. I have already gone through android official documentation. The code is almost similar.

private SSLSocketFactory sf;

public String post(Context context,final String domain) {
    try {
        CertificateFactory cf = CertificateFactory.getInstance("X.509");

        InputStream caInput = null;

        if (domain.equals("abc-connect.bank.com")) {
            caInput = new BufferedInputStream(context.getResources().openRawResource(R.raw.live_certificate));
        } else {
            caInput = new BufferedInputStream(context.getResources().openRawResource(R.raw.uat_certificate));
        }

        Certificate ca = cf.generateCertificate(caInput);
        caInput.close();

        String keyStoreType = KeyStore.getDefaultType();
        KeyStore keyStore = KeyStore.getInstance(keyStoreType);
        keyStore.load(null, null);
        keyStore.setCertificateEntry("ca", ca);

        String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
        tmf.init(keyStore);

        TrustManager[] trustManagers = tmf.getTrustManagers();
        final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0];

        TrustManager[] wrappedTrustManagers = new TrustManager[]{
                new X509TrustManager() {
                    public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                        return origTrustmanager.getAcceptedIssuers();
                    }

                    public void checkClientTrusted(X509Certificate[] certs, String authType) {
                        try {
                            origTrustmanager.checkClientTrusted(certs, authType);
                        } catch (CertificateException e) {
                            Log.e("CertificateException 1 ", ""+e.getMessage());
                        }
                    }

                    public void checkServerTrusted(X509Certificate[] certs, String authType) {
                        try {
                            origTrustmanager.checkServerTrusted(certs, authType);
                        } catch (CertificateException e) {
                            Log.e("CertificateException 2 ", ""+e.getMessage());
                        }
                    }
                }
        };

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, wrappedTrustManagers, null);

        sf = sslContext.getSocketFactory();

        HttpsURLConnection.setDefaultSSLSocketFactory(sf);

        URL url1 = new URL(this.url);
        HttpsURLConnection urlConnection = (HttpsURLConnection) url1.openConnection();

        urlConnection.setSSLSocketFactory(sf);

        int timeoutConnection = 20000;
        int timeoutSocket = 20000;

        urlConnection.setConnectTimeout(timeoutConnection);
        urlConnection.setReadTimeout(timeoutSocket);

        urlConnection.setRequestMethod("POST");
        urlConnection.setDoInput(true);
        urlConnection.setDoOutput(true);

        OutputStream os = urlConnection.getOutputStream();
        //below code removed.

        }
    } catch (Exception e) {
        response = "Error " + e;
    }
    return response;
}

I am testing this code, my API request get captured by burp suite. below is the image of captured request.

Below is my minimum and target SDK for app from built.gradle file.

minSdkVersion 19
targetSdkVersion 21

Can someone tell me why my request got captured in burp suite.

Answer 1

If you are intercepting URL than there is no way to hide the URL from being captured from let's say "Wi-Fi" but you can secure your data by using a token and aside from using ssl we can also use Hash Generation and never send your precious cargo in the header always use RequestBody to send your data(If you have SSL). As explained here

secure communication.

Hope this solves your answer.