I Wasted 3 Days Intercepting a Flutter App. Here’s What Actually Works.

Intercepting HTTPS traffic from Flutter apps with Burp Suite is unusually difficult because Flutter ships its own TLS stack (BoringSSL inside libflutter.so) that ignores Android's certificate trust store entirely. Even tools like ReFlutter fail when apps also run connectivity checks through Java or WebView layers. The solution is two Frida scripts run simultaneously: one that patches ssl_verify_peer_cert in libflutter.so via byte-pattern matching, and another that hooks X509TrustManager, SSLContext, HostnameVerifier, WebViewClient, and critically the InAppWebViewClient subclass used by the flutter_inappwebview plugin. For edge cases where traffic still bypasses Burp, the post covers iptables DNAT rules, mounting Burp's CA as a system certificate, enabling Burp's invisible proxy mode, and using DNSChef to intercept DNS resolution before packets even leave the device.