2

I wanted to make some Tinder tools, and found some already made APIs. I would like go through the process of discovering this private API by myself, since most of the articles are a bit out of date.

  1. I set up mitmproxy to sniff the API, but unfortunately, I couldn't catch any responses beside the tunneling.
  2. I understood that there was some certificate pinning happening.
  3. I downloaded the lastest version of APK Tools (2.2.4).
  4. I am using Oracle Java 8 JDK on a Ubuntu 16.04 VM.

My issue is the following :

  1. I disassemble the tinder.apk with APK Tools.
  2. I reassemble it (without any modifications):

    First thing I notice is that filesize from original and the crafted one is different while no modifications were made When I install my new version of Tinder, I can't login to the app.

Constraint : I can't use a SSL killer on my phone because of security issues that are implied.

Is APK Tools a good tool? Is there another way?

| improve this question | |
  • FYI here we do "reverse engineering", not "retro-engineering". – Igor Skochinsky♦ Sep 7 '17 at 14:48
  • For you, what is the difference? According to wikipedia it seems quite similar (source) – Nvlf Sep 7 '17 at 15:00
  • I haven't heard the term before; to me it sounds like "retrofitting". – Igor Skochinsky♦ Sep 7 '17 at 15:01
  • Oh ok, thanks. It feels like it can have both sense. Fun fact, google brought me to reverse engineering reddit community from the retro engineering keyword. – Nvlf Sep 7 '17 at 15:04
0

Probably the app has some additional checks against modification. Try to track down the login error shown, maybe you can find the check which triggers it and disable it.

Instead of patching the app itself, you can also try an external solution which would target external libraries to bypass pinning. You'll need to find out which SSL library the app uses and how it detects the certificate mismatch, then either patch the library on disk or in memory, at runtime. This post gives some possible solutions that might work for that.

| improve this answer | |
  • Thanks a lot for your answer. I'll give it a try then. About the external solutions, that's why I meant by a SSL Killer. But it needs a rooted phone, and it will most probably disable SSL on every app and connection. And for security purposes, I'd like to avoid this solution. I've read many papers from researchers, going through certificate pinning on Tinder, and there's no mention of a tampering check, or needs for an external things. That's why I concluded that it's either out of date, or the most probable one, is that I'm not skilled enough since I'm a beginner. – Nvlf Sep 8 '17 at 13:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.