D1T1 - Brida: When Burp Suite meets Frida
summary
Brida integrates Burp Suite with Frida, letting Burp call an app’s internal routines to decrypt, encrypt, and sign network traffic on-device. It demonstrates a Burp plugin that invokes app encryption functions to decode POST bodies, runs the app’s challenge-response code to automatically solve backend challenges, and reinjects results into proxy/repeater/scanner flows; live tools include an object/class browser, return-value inspection/modification, a Frida console, and a wizard that generates Burp plugins from exported Frida JS functions for Android and iOS.
AI-written summary · about
chapters (14)
- 0:00Introduction to Brida
- 3:11Why mobile app testing is hard
- 5:52Burp Suite and Frida basics
- 8:25Frida instrumentation demo
- 12:00Brida plugin architecture
- 15:50New features in Brida
- 23:41Live demo setup
- 27:06Inspecting encrypted traffic
- 32:47Writing a custom plugin
- 37:34Exploiting the app
- 44:38Challenge-response bypass
- 47:52Testing login forms
- 50:11Manual testing with Brida
- 52:53Q&A and closing
related talks
52mUnlocking secrets of proprietary software using Frida
51mAnalysis of Real World Apps with Frida
25mFoundations of Dynamic Analysis and Hooking of Android Apps with Frida
23mBURPing for Developers
28mBuilding a Security Module for Android
29mInstrumenting binaries with Frida
39mMobile App Traffic: Analysis and Modification
44mCatch Me If You Can: Detecting Root and Frida