Cyber Risks · PortSwigger Research

Brida, Burp to Frida Bridge

Summary: Brida is a Burp Suite extension, version 0.6.0 by Federico Dotta and Piergiovanni Cipolloni, that bridges Burp and Frida so testers can intercept and modify traffic between mobile applications and their backend servers while calling the app's own functions directly. It includes an engine for graphically building custom plugins that inspect and edit HTTP requests and responses, pre-built hooks to bypass common security controls, a class-structure explorer for adding inspection or tamper hooks, and an integrated JS editor.

What you should know: The tool is built to minimize or eliminate the need to reverse engineer and reimplement cryptographic routines and token generation, which is the work that normally gates mobile API testing - so the barrier to exercising a mobile backend's real request-signing logic drops for anyone who installs it from the BApp Store.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related