2

I wish to analyze the unencrypted data sent of SSL by an Android APK that uses certificate pinning.

This suspicious APK is used to configure a wireless device.

I need to determine two things:

  • First, the WPA key the APK establishes with the device
  • Then, the sequence of HTTPS API calls that the APK uses to configure the device.

The configuration process is:

  • Download obfuscated APK from company site
  • Create account on their servers,
  • The APK then connects to the device SSID with a private WPA key
  • There is a native .so that does some calculation of the key

The HTTPS sessions to the Internet server use a fixed certificate, attempting to proxy results in a certificate error.

Ideally I would like to use an emulation environment, and hook the library calls (similar to what "Droidbox" appeared to do), but I can't find a more recent version.

|improve this question
2

iSEC Partner's Android SSL TrustKiller utilizes hooks that Cydia substrate can provide in order to defeat certificate pinning.

|improve this answer
  • I would be eternally grateful if you shared details about how you got it to work for you? I've tried using Android SSL TrustKiller with Cydia substrate on both the Genymotion virtual machine, and the default Android virtual machine, and I've also tried with different versions of android, and even my physical phone, but I continue to ONLY pick up traffic from apps that don't use Certificate pinning. Please share what setup you are using? – 43.52.4D. Feb 9 '16 at 1:46
0

For sniffing https calls I use Charles proxy, when you install Charles certifiate on the device you'll be able to sniff whole apk<->server traffic.

|improve this answer
  • The question specifically mentions that the certificate is pinned, so this will not work. – Cybergibbons Jan 28 '16 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.