3 ms·
a lot of iOS apps will use certificate pinning so this avoids having to bypass that. the disadvantage is you can't easily modify requests. i actually have an ex
by benmmurphy 5y ago
a lot of iOS apps will use certificate pinning so this avoids having to bypass that. the disadvantage is you can't easily modify requests. i actually have an extension to mitproxy that pulls the secrets from keylog file and then performs an MITM attack on the connection based on that. this way you can modify requests without trusting an evil root certificate. but you do need the key material either via keylog file or via an attack on TLS key sharing (like solving DLP on EC). also i've only implemented this for TLS1.2.
- thenthenthen 5y agoAh nice, I was put off by the use of an jailbroken idevice, thinking they were using ssl kill switch.
- Manouchehri 5y agoThat’s awesome, I’ve wanted that to be a feature for years! It’s unfortunately really hard to Google for, since results keep returning on how to get mitmproxy to export SSLKEYLOG, not ingesting it. Did you open source it by any chance? =)