3 ms·

I wonder if you can use a proxy with this, I would like to run this through MITM Proxy to see the requests made by different Android apps. Current I am using An

by 2h 4y ago

I wonder if you can use a proxy with this, I would like to run this through MITM Proxy to see the requests made by different Android apps. Current I am using Android Studio or GenyMotion

tyingq 4y ago
If it works at all like WSL, you might want to look at wsl-vpnkit. https://github.com/sakai135/wsl-vpnkit https://github.com/sakai135/wsl-vpnkit It's not a proxy, but would give some idea how to shim into the middle. Uses gvisor-tap-vsock underneath: https://github.com/containers/gvisor-tap-vsock https://github.com/containers/gvisor-tap-vsock
ohgodplsno 4y ago
Unless you found a way to break HTTPS, that won't do. Android uses certificate pinning, and any MITM attempt (such as running through a proxy) won't even send the requests through.
- 2h 4y ago
  No, Android doesn't. Some apps do. And in many cases, the pinning code can be removed in real time with Frida. Please don't spread misinformation.
  - ohgodplsno 4y ago
    Android apps do not trust anything out of the system default CA since Android 7.0, which is "light" pinning. https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to.... Additionally, certificate pinning can be done in multiple ways, and your Frida bypass will not do anything in the case of a simple reimplementation of pinning for OkHttp means you now have to find also that code (which has most likely been proguarded and obfuscated) to replace. The only ways your certificate works are: * Your self signed certificates are marked as trusted in the app manifest (which, since it isn't your app, you have to rebuild an APK to modify the network_security_config) * There's a leftover "accept everything" in the manifest, and that can only work with debug builds. * You ran it through apktool/equivalent to insert a permissive network_security_config (which only has this ability since 2022, but other scripts have existed before). Running it through Frida for that purpose is needlessly overkill. Please know your shit.
    - 2h 4y ago
      you missed the step, where you can just install a certificate to /system/etc/security/cacerts which unlocks most current Android apps. so maybe learn your own tactics, before commenting further.
      - oefrha 4y ago
        The system volume on WSA is a static image and can’t be mounted as readwrite the last time I checked. You pretty much have to use something like MagiskTrustUserCerts.
        2h 4y ago
        > can’t be mounted as readwrite yeah it can. you just mount it as tmpfs.

by 2h 4y ago

I wonder if you can use a proxy with this, I would like to run this through MITM Proxy to see the requests made by different Android apps. Current I am using Android Studio or GenyMotion

tyingq 4y ago

If it works at all like WSL, you might want to look at wsl-vpnkit. https://github.com/sakai135/wsl-vpnkit https://github.com/sakai135/wsl-vpnkit It's not a proxy, but would give some idea how to shim into the middle. Uses gvisor-tap-vsock underneath: https://github.com/containers/gvisor-tap-vsock https://github.com/containers/gvisor-tap-vsock

ohgodplsno 4y ago

Unless you found a way to break HTTPS, that won't do. Android uses certificate pinning, and any MITM attempt (such as running through a proxy) won't even send the requests through.

2h 4y ago
No, Android doesn't. Some apps do. And in many cases, the pinning code can be removed in real time with Frida. Please don't spread misinformation.
- ohgodplsno 4y ago
  Android apps do not trust anything out of the system default CA since Android 7.0, which is "light" pinning. https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to.... Additionally, certificate pinning can be done in multiple ways, and your Frida bypass will not do anything in the case of a simple reimplementation of pinning for OkHttp means you now have to find also that code (which has most likely been proguarded and obfuscated) to replace. The only ways your certificate works are: * Your self signed certificates are marked as trusted in the app manifest (which, since it isn't your app, you have to rebuild an APK to modify the network_security_config) * There's a leftover "accept everything" in the manifest, and that can only work with debug builds. * You ran it through apktool/equivalent to insert a permissive network_security_config (which only has this ability since 2022, but other scripts have existed before). Running it through Frida for that purpose is needlessly overkill. Please know your shit.
  - 2h 4y ago
    you missed the step, where you can just install a certificate to /system/etc/security/cacerts which unlocks most current Android apps. so maybe learn your own tactics, before commenting further.
    - oefrha 4y ago
      The system volume on WSA is a static image and can’t be mounted as readwrite the last time I checked. You pretty much have to use something like MagiskTrustUserCerts.
      - 2h 4y ago
        > can’t be mounted as readwrite yeah it can. you just mount it as tmpfs.