Anchored

Platform: HackTheBox | Category: Mobile | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

A client asked me to check if I can intercept the https request and get the value of the secret parameter that is passed along with the user's email. The application is intended to run in a non-rooted device. Can you help me find a way to intercept this value in plain text.

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. In this challenge we're given an apk file, noticed the README file says 2 notes to run this apk.

1. API leve 29 or earlier.
2. Non-rooted device.

1. I ran it on Pixel 4 API 25 (along with the google play) (non rooted).

MOBILE APP

1. Decompiled the apk using JADX, found an interesting endpoint at the MainActivity but sadly we can't access it.

2. Confused here, reviewing the AndroidManifest.xml source code, shall found an interesting attribute --> android:networkSecurityConfig.

3. We can access the network_security_config.xml with this path --> /res/xml/network_security_config.xml.

4. Searching on the internet about network_security_config.xml exploit shall resulting to this --> https://gist.github.com/sunary/REDACTED.

5. After added the Burp Suite cert to intercept request, we can't intercept the app.

NOTES:

If you use API under 30, name the burpsuite cert with .crt as it's extension.

1. This shall means, the intended solve should be patch the network_security_config.xml file.
2. Let us patch it.

decode the apk with apktool.

apktool d Anchored.apk

BUILD THE APK

apktool b -o anchored_patched.apk Anchored

MAKE KEY

keytool -genkey -keystore a.keystore -keyalg RSA -keysize 2048 -validity 10000

SIGN THE APK

apksigner sign --ks a.keystore anchored_patched.apk

1. Now let us install the apk again with adb, then try to intercept the reqeust sent to server.

2. Got the flag!

BONUS

Another network_security_config.xml

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">anchored.com</domain>
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" overridePins="true"/>
        </trust-anchors>
    </domain-config>
</network-security-config>

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.