3 ms·

Unfortunately with modern iOS/Android you need a rooted device. Modern iOS/Android have something called SSL Pinning. Which means if you want to use a self-si

Unfortunately with modern iOS/Android you need a rooted device. Modern iOS/Android have something called SSL Pinning. Which means if you want to use a self-signed cert to Man in the Middle the HTTPS traffic it won't work. So you need to patch the network stack to allow this. I have a spare iPhone I keep rooted for this reason.

raverbashing 6y ago
Do all apps use cert pinning? I think it got popular some years ago but I remember some downsides existing (I know things like Google Apps and such use it, but I'm not sure about less popular ones)
- ChadMoran 6y ago
  I haven't run into an app I've reverse engineered that didn't have it.
  - jsjohnst 6y ago
    Then you are sampling a very small or a very biased set of apps.
- watermelon0 6y ago
  Android apps don't trust user CA certificates by default (they only work with web browsers.) You have to explicitly enable this option in app manifest. Rooting the device enables you to put custom certificates in system store, and bypass this check.
- barbecue_sauce 6y ago
  I've done a few and always ran into cert pinning issues.
- dewey 6y ago
  In my experience only a very small percentage of the apps where I look at the traffic using Charles Proxy have the certificates pinned. Usually it's the stock apps from Apple that are all cert pinned.
  - jsjohnst 6y ago
    Same experience for me across a wide category of iOS and Android apps.
feanaro 6y ago
You can actually get by without root by using Frida (https://frida.re/docs/android/ https://frida.re/docs/android/), at least on Android. By repackaging the APK to include frida-gadget (such as in this tutorial: https://koz.io/using-frida-on-android-without-root/ https://koz.io/using-frida-on-android-without-root/), you can get all of Frida's capabilities on that app without root. That said, it is more convenient to have a spare rooted phone.
jsjohnst 6y ago
> Modern iOS/Android have something called SSL Pinning. Yep, the mobile OSes have that option, but it’s not very commonly used. I fairly regularly snoop traffic on apps and it’s not super often that I’m blocked temporarily by cert pinning.
- ChadMoran 6y ago
  Interesting. The last 6 apps I've reverse engineered they all had pinning on.
behnamoh 6y ago
IMO it's fortunately tho!

raverbashing 6y ago

Do all apps use cert pinning? I think it got popular some years ago but I remember some downsides existing (I know things like Google Apps and such use it, but I'm not sure about less popular ones)

ChadMoran 6y ago
I haven't run into an app I've reverse engineered that didn't have it.
- jsjohnst 6y ago
  Then you are sampling a very small or a very biased set of apps.
watermelon0 6y ago
Android apps don't trust user CA certificates by default (they only work with web browsers.) You have to explicitly enable this option in app manifest. Rooting the device enables you to put custom certificates in system store, and bypass this check.
barbecue_sauce 6y ago
I've done a few and always ran into cert pinning issues.
dewey 6y ago
In my experience only a very small percentage of the apps where I look at the traffic using Charles Proxy have the certificates pinned. Usually it's the stock apps from Apple that are all cert pinned.
- jsjohnst 6y ago
  Same experience for me across a wide category of iOS and Android apps.

feanaro 6y ago

You can actually get by without root by using Frida (https://frida.re/docs/android/ https://frida.re/docs/android/), at least on Android. By repackaging the APK to include frida-gadget (such as in this tutorial: https://koz.io/using-frida-on-android-without-root/ https://koz.io/using-frida-on-android-without-root/), you can get all of Frida's capabilities on that app without root. That said, it is more convenient to have a spare rooted phone.

jsjohnst 6y ago

> Modern iOS/Android have something called SSL Pinning. Yep, the mobile OSes have that option, but it’s not very commonly used. I fairly regularly snoop traffic on apps and it’s not super often that I’m blocked temporarily by cert pinning.

ChadMoran 6y ago
Interesting. The last 6 apps I've reverse engineered they all had pinning on.

behnamoh 6y ago

IMO it's fortunately tho!