3 ms·
Wouldn't it be possible to crack an app (decompile etc) to disable Certificate Pinning? What comes to my mind also is a debug to obtain TLS master-secret then o
by imhoguy 9y ago
Wouldn't it be possible to crack an app (decompile etc) to disable Certificate Pinning? What comes to my mind also is a debug to obtain TLS master-secret then one can decrypt encrypted stream post-factum (Wireshark accepts master-secrets).
- omni 9y agoYes, and there are tools to do exactly that. https://github.com/sensepost/objection https://github.com/sensepost/objection