5 ms·
Would this let me see the full path of an https requests that an app is making? I've got a testing need for that, and am currently hampered because our secops t
by lozaning 7y ago
Would this let me see the full path of an https requests that an app is making? I've got a testing need for that, and am currently hampered because our secops team won't let us enable a feature flag to disable cert pinning so that Charles proxy will work.
WOuld this be a viable alternative because it runs on the actual phone itself?
- deleted 7y ago[deleted]
- h4waii 7y agoNo, this won't bypass certificate pinning, to do that you need to tamper the app or hook runtime calls using something like Xposed. There are modules [0] [1] that do this, support depends on the version of Android you're using. [0]. https://github.com/ac-pm/SSLUnpinning_Xposed https://github.com/ac-pm/SSLUnpinning_Xposed [0]. https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
- madushan1000 7y agoUse frida(frida.re) with something like objection to disable certificate pining at runtime. You gotta have a rooted phone, or you'll have to patch the apk with Frida library.