4 ms·
This is an awesome method. But it's not where I need it - if you have the site in your browser, you can already do most interesting things with DOM scraping or
by uniqueuid 5y ago
This is an awesome method. But it's not where I need it - if you have the site in your browser, you can already do most interesting things with DOM scraping or MITM (as mentioned in the article).
Now, if we had a tool to extract the DOM from a mobile device and/or from apps that use pinning, that would be MUCH more interesting.
PS yes, I know frida, but last time I looked it's basically a platform that you'd need to build all the machinery on top of.
- jonluca 5y agoIf your device is jailbroken you can use SSL Kill Switch 2 + Burp Suite to get past TLS pinning. It doesn't do much if the actual payload is encrypted (then you'll need to use Frida, or lldb-debugger or something else like that)
- rmac 5y agolast i tried none of the tools work well out of the box for the interesting cases (e.g., tiktok tls mitm on mobile) publishers using custom http2/http3 libs, NDK obfuscators, etc all break the "auto patch" sslstrip stuff