Android (4.4+) SSL wireless sniffing without certificate changing

Question

I wish to analyze the unencrypted data sent of SSL by an Android APK that uses certificate pinning.

This suspicious APK is used to configure a wireless device.

I need to determine two things:

• First, the WPA key the APK establishes with the device
• Then, the sequence of HTTPS API calls that the APK uses to configure the device.

The configuration process is:

• Download obfuscated APK from company site
• Create account on their servers,
• The APK then connects to the device SSID with a private WPA key
• There is a native .so that does some calculation of the key

The HTTPS sessions to the Internet server use a fixed certificate, attempting to proxy results in a certificate error.

Ideally I would like to use an emulation environment, and hook the library calls (similar to what "Droidbox" appeared to do), but I can't find a more recent version.

Answer 1

iSEC Partner's Android SSL TrustKiller utilizes hooks that Cydia substrate can provide in order to defeat certificate pinning.

Answer 2

(Copy of an answer I gave on Stack Overflow)

You could try injecting code into the Android app to sniff and dump SSL traffic. Take a look at https://github.com/5alt/ssl_logger (5alt's fork works with Android). Note that you need root for this.

This works by hooking functions inside OpenSSL so that the raw traffic can be dumped before encryption/after decryption.

You have to install Frida Android server: https://www.frida.re/docs/android/

• Connect phone with USB debugging on
• Download frida-server for the right CPU architecture from https://github.com/frida/frida/releases
  • To know which CPU architecture your device is using (for getting the right download), you can run getprop ro.product.cpu.abi on the phone.
• Push to /data/local/tmp of Android (as root), make executable (chmod 755).
• Run /data/local/tmp/frida-server on the phone.
• On your computer, install frida-tools using pip install --user frida-tools. (Must be Python2, not Python3!)
• List processes to see if everything works, by running frida-ps -U on your computer with the phone connected
• Forward Frida's ports: adb forward tcp:27042 tcp:27042; adb forward tcp:27043 tcp:27043
• Get ssl_logger on your computer
• Run python ssl_logger.py -pcap log.pcap -remote com.android.package.name on your computer. (Note that -remote is not explained in the readme, but it's necessary!.)
  • You can add -verbose to see live traffic output.
  • Let it run until you are done, quit with Ctrl+C. You then have a file log.pcap which you can analyze in Wireshark.
  • Note: In case you are getting a JavaScript error, you have to edit ssl_logger.py and insert a line with var addresses, SSL_get_fd, SSL_get_session, SSL_SESSION_get_id, getpeername, getsockname; before the line with function initializeGlobals.

Tutorials for using Frida on Android: https://11x256.github.io/

Answer 3

For sniffing https calls I use Charles proxy, when you install Charles certifiate on the device you'll be able to sniff whole apk<->server traffic.