When reverse engineering a thick application it can be very useful to be able to see the network traffic it generates.

Because of this, many applications use HTTPS to communicate with their servers. Bypassing this has become easy to do with tools like Charles (SSL Proxy).

As a result, some applications use Certificate Pinning which does not allow a proxy to intercept traffic.

What are some solutions around this problem, ideally, I'm looking for a methodology, tools and techniques to do this in both Windows and OS X applications.

  • 1
    I doubt there's an easy solution. If it's using system API calls to validate the certificate you might be able to intercept that and return true. If not, you're going to have to dig into the application enough to either find and replace its pinned cert or knock out the code that does cert validation, and work around any anti-tamper code that may be in place. Either that or discover the pinned cert's private key, but that's infeasible. – Rup Feb 2 '18 at 10:09