[MASTG-TECH-0109] Propose to update the content regarding the usage of reFlutter

[crazykid95]

Hello everyone. Recently, I’ve been working with a Flutter application and inadvertently noticed that from Flutter version 3.24.0 onwards, the hardcoded proxy IP and port have been removed. Therefore,

• The reflutter tool will no longer hardcode the IP address and port for you. You need to set proxy address manually.
• Furthermore, in many cases, you will also be unable to intercept traffic simply by configuring a global proxy from the Android Settings. Instead, you will need to utilize an additional TunProxy tool to route all traffic (or the traffic of the application needing interception) through your desired proxy, such as BurpSuite.

All of this is recommended by the reFlutter tool itself when you use it and is also mentioned in this fork of the reFlutter repository: https://github.com/Impact-I/reFlutter

Meanwhile, the "Intercepting Traffic using reFlutter" section in MASTG-TECH-0109 still contains outdated instructions and has not been updated to reflect these changes.

If approved, I would like to create a PR to:

• Add a section addressing Flutter 3.24.0 and later versions.
• In such cases, supplement the information with how reflutter responds upon launch, how to set up a global proxy from ADB and the settings interface, and how to set up a TunProxy.

[TheDauntless]

Hi!

Thanks for raising this issue! It took me way too long to figure out how they now fix the proxy issue, but apparently they just removed the proxy patch and now rely on typical non-proxy-aware MitM techniques. In hindsight it's quite obvious, but ... oh well 🙃

So two things:

• TECH-0109 should be updated to reflect this
• A new technique should be created for non-proxy-aware apps. There are different techniques for this (ProxyDroid, DNS spoofing, ARP spoofing, VPN server, TunProxy), some of which have limitations.

This does make the PR a bit bigger than your original suggestion, so let me know if you're up for it or not :)

As a side remark, we don't want to use the proposed proxy configuration (settings put global http_proxy <proxy_ip:port>) as that is the worst way to configure a proxy on Android.