3 ms·

So the article title could be changed to "Peach API has replay vulnerability"? I haven't actually tried this yet but can someone confirm the app has pinning?

by nstj 11y ago

So the article title could be changed to "Peach API has replay vulnerability"? I haven't actually tried this yet but can someone confirm the app has pinning? If so, thoughts on how he sniffed the original traffic and ran the replay?

jorge_leria 11y ago
If you have a jailbroken iOS device you can use SSL Kill Switch [0] to disable certificate pinning and get the traffic with MITMproxy [1] or Charles. [0] https://github.com/nabla-c0d3/ssl-kill-switch2 https://github.com/nabla-c0d3/ssl-kill-switch2 [1] http://mitmproxy.org/ http://mitmproxy.org/