4 ms·
Goodbye to using Fiddler easily to check out the private HTTP API of any app that does not implement cert pinning
by cocotino 10y ago
Goodbye to using Fiddler easily to check out the private HTTP API of any app that does not implement cert pinning
- orliesaurus 10y agoMy exact thoughts, all the fun stuff reversing instagram's api or "peach" 's api - puff gone
- cube00 10y agoWhat are the options to inspect this traffic now we can no longer use fiddler?
- andrewguenther 10y agoIf you're trying to debug your own app, there are ways to turn this off for debugging.
- kuschku 10y agoAnd if you want to use your legal right to reverse the functionality and APIs of other apps?
- johncolanduoni 10y agoIf your device isn't rooted, modify the APK to opt-in and don't share it with anyone. If your device is rooted, just add your cert to the system store.
- kuschku 10y ago> If your device is rooted, just add your cert to the system store. So, basically the same as before, but there’s no UI for it anymore? Fuck this. I might just modify the Java SSL libs on Android to even accept my cert when cert pinning is used, if I have to spend that much effort anyway.
- click170 10y agoI share your frustration and I'm interested in your work on this, if you do proceed please consider making it easy for others to follow your lead by publishing, anonymously if necessary. I get that the intention is to make the device more secure but Google's execution on this is disappointing and lazy, and the result is that my devices no longer trust me the owner, which I don't consider acceptable given the lack of liability. I'm curious what Apple's response will be.
- GeneralTspoon 10y agoIf you plan on doing that, it might be worth looking into a similar project that uses the XPosed framework to bypass certificate pinning at a low level: https://github.com/iSECPartners/Android-SSL-TrustKiller https://github.com/iSECPartners/Android-SSL-TrustKiller Although it only works with Android versions up to 4.2.2, due to limitations of the XPosed framework.
- venomsnake 10y agoroot + xposed will make quick fix to enable it.
- GeneralTspoon 10y agoSeeing as Cert Pinning bypassing doesn't currently work with XPosed on Android versions greater than 4.2.2, I'm not so sure about that. Might require a more in-depth solution.
- ianlevesque 10y agoModify the APK first to add certificates or disable the pinning.