3 ms·
Could most of the initial API reverse engineering be blocked by using https with certificate pinning? I tried reverse engineering an Android app API and came u
by Buge 10y ago
Could most of the initial API reverse engineering be blocked by using https with certificate pinning?
I tried reverse engineering an Android app API and came up short because every MITM I tried failed, I assume due to certificate pinning. To continue I would have to statically reverse the binary, or root/jailbreak the device and nerf the pinning section of the code.
- Metalnem 10y agoYes, certificate pinning would have blocked my initial steps. But there is a tool for disabling certificate pinning validation on jailbroken iOS devices, called iOS SSL Kill Switch https://github.com/iSECPartners/ios-ssl-kill-switch https://github.com/iSECPartners/ios-ssl-kill-switch.