5- No SSL Pinning & Insecure HTTP connections

Si nos volvemos a DoLogin.java por ejemplo

Vemos que directamente el tráfico se está haciendo en HTTP

String serverip = "";
String serverport = "";
String protocol = "http://";

public void postData(String valueIWantToSend) throws BadPaddingException, JSONException, NoSuchPaddingException, IllegalBlockSizeException, NoSuchAlgorithmException, IOException, InvalidKeyException, InvalidAlgorithmParameterException {
	HttpResponse responseBody;
	HttpClient httpclient = new DefaultHttpClient();
	HttpPost httppost = new HttpPost(DoLogin.this.protocol + DoLogin.this.serverip + ":" + DoLogin.this.serverport + "/login");
	HttpPost httppost2 = new HttpPost(DoLogin.this.protocol + DoLogin.this.serverip + ":" + DoLogin.this.serverport + "/devlogin");
	List<NameValuePair> nameValuePairs = new ArrayList<>(2);
	nameValuePairs.add(new BasicNameValuePair("username", DoLogin.this.username));
	nameValuePairs.add(new BasicNameValuePair("password", DoLogin.this.password));
	if (DoLogin.this.username.equals("devadmin")) {
		httppost2.setEntity(new UrlEncodedFormEntity(nameValuePairs));
		responseBody = httpclient.execute(httppost2);
	} else {
		httppost.setEntity(new UrlEncodedFormEntity(nameValuePairs));
		responseBody = httpclient.execute(httppost);
	}
	InputStream in = responseBody.getEntity().getContent();
	DoLogin.this.result = convertStreamToString(in);
	DoLogin.this.result = DoLogin.this.result.replace("\n", "");
	if (DoLogin.this.result != null) {
		if (DoLogin.this.result.indexOf("Correct Credentials") != -1) {
			Log.d("Successful Login:", ", account=" + DoLogin.this.username + ":" + DoLogin.this.password);
			saveCreds(DoLogin.this.username, DoLogin.this.password);
			trackUserLogins();
			Intent pL = new Intent(DoLogin.this.getApplicationContext(), (Class<?>) PostLogin.class);
			pL.putExtra("uname", DoLogin.this.username);
			DoLogin.this.startActivity(pL);
			return;
		}
		Intent xi = new Intent(DoLogin.this.getApplicationContext(), (Class<?>) WrongLogin.class);
		DoLogin.this.startActivity(xi);
	}
}

Lo cuál permite a alguien en la misma red capturar credenciales, transferencias, montos etc.

Nos ponemos en escucha por todas las interfaces en burpsuite

Redirigimos del burp al servidor real

Ponemos el puerto del burp en la app

Y ya podemos interceptar tráfico