3

I wish to analyze the unencrypted data sent of SSL by an Android APK that uses certificate pinning.

This suspicious APK is used to configure a wireless device.

I need to determine two things:

  • First, the WPA key the APK establishes with the device
  • Then, the sequence of HTTPS API calls that the APK uses to configure the device.

The configuration process is:

  • Download obfuscated APK from company site
  • Create account on their servers,
  • The APK then connects to the device SSID with a private WPA key
  • There is a native .so that does some calculation of the key

The HTTPS sessions to the Internet server use a fixed certificate, attempting to proxy results in a certificate error.

Ideally I would like to use an emulation environment, and hook the library calls (similar to what "Droidbox" appeared to do), but I can't find a more recent version.

2

iSEC Partner's Android SSL TrustKiller utilizes hooks that Cydia substrate can provide in order to defeat certificate pinning.

| improve this answer | |
  • I would be eternally grateful if you shared details about how you got it to work for you? I've tried using Android SSL TrustKiller with Cydia substrate on both the Genymotion virtual machine, and the default Android virtual machine, and I've also tried with different versions of android, and even my physical phone, but I continue to ONLY pick up traffic from apps that don't use Certificate pinning. Please share what setup you are using? – 43.52.4D. Feb 9 '16 at 1:46
2

(Copy of an answer I gave on Stack Overflow)

You could try injecting code into the Android app to sniff and dump SSL traffic. Take a look at https://github.com/5alt/ssl_logger (5alt's fork works with Android). Note that you need root for this.

This works by hooking functions inside OpenSSL so that the raw traffic can be dumped before encryption/after decryption.

You have to install Frida Android server: https://www.frida.re/docs/android/

  • Connect phone with USB debugging on
  • Download frida-server for the right CPU architecture from https://github.com/frida/frida/releases
    • To know which CPU architecture your device is using (for getting the right download), you can run getprop ro.product.cpu.abi on the phone.
  • Push to /data/local/tmp of Android (as root), make executable (chmod 755).
  • Run /data/local/tmp/frida-server on the phone.
  • On your computer, install frida-tools using pip install --user frida-tools. (Must be Python2, not Python3!)
  • List processes to see if everything works, by running frida-ps -U on your computer with the phone connected
  • Forward Frida's ports: adb forward tcp:27042 tcp:27042; adb forward tcp:27043 tcp:27043
  • Get ssl_logger on your computer
  • Run python ssl_logger.py -pcap log.pcap -remote com.android.package.name on your computer. (Note that -remote is not explained in the readme, but it's necessary!.)
    • You can add -verbose to see live traffic output.
    • Let it run until you are done, quit with Ctrl+C. You then have a file log.pcap which you can analyze in Wireshark.
    • Note: In case you are getting a JavaScript error, you have to edit ssl_logger.py and insert a line with var addresses, SSL_get_fd, SSL_get_session, SSL_SESSION_get_id, getpeername, getsockname; before the line with function initializeGlobals.

Tutorials for using Frida on Android: https://11x256.github.io/

| improve this answer | |
0

For sniffing https calls I use Charles proxy, when you install Charles certifiate on the device you'll be able to sniff whole apk<->server traffic.

| improve this answer | |
  • The question specifically mentions that the certificate is pinned, so this will not work. – Cybergibbons Jan 28 '16 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.