Burp Suite - Not able to intercept android app

If your burp suite  was working fine for intercepting mobile application and suddenly it has stopped working. To fix this issue download latest burp suite from PortSwigger.net download section and install it.

If you are not able to intercept some mobile applications, the reason may be some of the applications are using https protocol and the application for which burp suite worked, it might be used http protocol.

To intercept traffic for mobile application with https APIs, run the burp suite and open it in browser.
Suppose you are running it on 8080 port (Default), open url http://localhost:8080 in browser.
It will look like this.

.der file will be downloaded. Convert the file into pem file

openssl x509 -inform der -in /root/Documents/cacert.der -out /tmp/burp.pem

Browse this pem file in your mobile device and add into 'Add certificate' option of your device. In android device, you can find the option under Settings > Security or Settings >  WLAN > More > Advanced > Install certificates
Once certificate will be installed, you may get notification about network monitoring.
Now try to intercept the app again, it should work fine.

Note : This tutorial is for ethical penetration testing purpose.

Ubuntu Firefox and Chrome - Read History on Command Line

You are very habitual of command line and you do most of your tasks like copying data, report generation, analyzing logs using terminal, you must have thought before if there is a way to read history of browser using command line.

Well yes there is definitely a way to complete this task. Browsers save the history in sqlite files. If you know basic queries of SQL, you can read history on terminal.

Firefox History using Terminal

cd ~/.mozilla/firefox

There must be a folder name with random string. Something like c18jclvi.default

cd ~/c18jclvi.default

You can find the sqlite file here i.e. places.sqlite.

Copy this file somewhere else like /tmp, If you use the file in firefox directory you may get "Error: database is locked" 

Open sqlite command prompt using following command.

sqlite3 /tmp/places.sqlite

To list all tables, run query

sqlite> .tables

You can find the url history in table moz_places.

sqlite> select * from moz_places;

To decode timestamp, first find the timestamp in the row. Usually 10th column is timestamp's column.

Divide this number buy 1000000. Now run command

date -d @1557653257.768815

It will display the correct date and time of this visited url.

Chrome History using Terminal

Similarly you can display chrome browser history in terminal.

cd ~/.config/google-chrome/Default

Copy filename History in some other place like /tmp. If you use the file in Chrome directory you may get "Error: database is locked" 

sqlite3 /tmp/History

To list all tables, run query

sqlite> .tables

You can find the url history in table urls.

sqlite> select * from urls;

Nginx Custom 404 Not Found Error or Internal Server Error page for Django

If you are trying to configure nginx custom error page for a Python web application like Django but it always shows Django Default 404 Error Page, here is solution for you.

All solutions you found out but they are not working because they are showing you solution on custom error page for application which does not need proxy pass, Django runs on port 8000 (By Default) and you must have used proxy pass in your nginx virtual host for domain configuration.

You need to give one extra attribute in your virtual host and all will work well.

1) Create an index.html in /usr/share/nginx/html/index.html

2) Add following lines under active virtualhost     

        proxy_intercept_errors on;
        error_page 500 502 503 504 404 /index.html;
        location = /index.html {
        root /usr/share/nginx/html;

     
3) Reload nginx. Now open an error page or 404 page. It will open index.html content in browser.

Note : Your solutions were not working because you did not use attribute `proxy_intercept_errors on;`
 For a proxy pass virtualhost, this attribute is important.