4 ms·
Capturing and Decrypting HTTPS Traffic from iOS Apps Using Frida (2019)
- thenthenthen 5y agoWhat is the advantage to for example Burpsuite Proxy (+burp ca certificate)? Is it possible to decrypt packets found in the air (aka open wireless network you control)?
- benmmurphy 5y agoa lot of iOS apps will use certificate pinning so this avoids having to bypass that. the disadvantage is you can't easily modify requests. i actually have an extension to mitproxy that pulls the secrets from keylog file and then performs an MITM attack on the connection based on that. this way you can modify requests without trusting an evil root certificate. but you do need the key material either via keylog file or via an attack on TLS key sharing (like solving DLP on EC). also i've only implemented this for TLS1.2.
- thenthenthen 5y agoAh nice, I was put off by the use of an jailbroken idevice, thinking they were using ssl kill switch.
- Manouchehri 5y agoThat’s awesome, I’ve wanted that to be a feature for years! It’s unfortunately really hard to Google for, since results keep returning on how to get mitmproxy to export SSLKEYLOG, not ingesting it. Did you open source it by any chance? =)
- c7DJTLrn 5y agoWhy do this over installing a root CA and using mitmproxy as a proxy server?
- inickt 5y agoAs mentioned below, lots of iOS apps will use certificate pinning to verify they aren’t being MITM’ed.
- youngtaff 5y agoIn addition to the cert pinning issue, I found it handy when I wanted to look at the Safari's HTTP/2 implementation and proxies can get in the way I believe this method can also be used to decrypt traffic going over the cellular interface too
- m0rbz 5y agoIs this still working in iOS14/15?