2

I am trying to capture https requests an application performs during runtime without any success yet. Different failing approaches, using mitmproxy / charles proxy and user ca certificates, obtaining smali code in order to bypass x509Certificate checks, installing ca cert as system to avoid certificate pinning, using different xposed applications (outdated, still worth a try), make me wonder what it is that I am missing. It is only possible to capture chrome's https traffic, other applications refuse to load / connect. To be fair, one might ask why I don't figure out myself where requests are built and log all needed information. Personally, I think a working method capturing said traffic saves a lot of time and work.

# virtual methods
.method public checkClientTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V
    .locals 1
return-void #!!

iget-object v0, p0, La/a/a/a/e/d/d$a;->a:Ljavax/net/ssl/X509TrustManager;

invoke-interface {v0, p1, p2}, Ljavax/net/ssl/X509TrustManager;->checkClientTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V

return-void
.end method

.method public checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V
    .locals 1

return-void #!!

iget-object v0, p0, La/a/a/a/e/d/d$a;->b:La/a/a/a/e/d/i;

invoke-interface {v0, p1, p2}, La/a/a/a/e/d/i;->a([Ljava/security/cert/X509Certificate;Ljava/lang/String;)Z

move-result v0

if-nez v0, :cond_0

iget-object v0, p0, La/a/a/a/e/d/d$a;->a:Ljavax/net/ssl/X509TrustManager;

    invoke-interface {v0, p1, p2}, Ljavax/net/ssl/X509TrustManager;->checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V

    :cond_0
    return-void
.end method

.method public getAcceptedIssuers()[Ljava/security/cert/X509Certificate;
    .locals 1

return-void #!!

iget-object v0, p0, La/a/a/a/e/d/d$a;->a:Ljavax/net/ssl/X509TrustManager;

invoke-interface {v0}, Ljavax/net/ssl/X509TrustManager;->getAcceptedIssuers()[Ljava/security/cert/X509Certificate;

move-result-object v0

return-object v0
.end method

If you're successfully capturing traffic (especially https) please let me know your procedure in order to achieve what the question is asking for.

  • 1
    @Biswapriyo Unfortunately, applications offered on the Play Store for such purposes prove to be only useful for http requests, https capturing results in network ssl errors. – Xatev Jul 24 '18 at 21:03
  • Did you try it? – Biswapriyo Jul 24 '18 at 21:05
  • @Biswapriyo Yes, I did install most of the available options from the Play Store (including play.google.com/store/apps/details?id=app.greyshirts.sslcapture). None of them work, most being outdated using only methods which used to work before Android 6.0. – Xatev Jul 24 '18 at 21:08
1

Do you have root on your phone or not? If yes - install xposed framework and try one of this modules:

  1. SSLUnpining
  2. JustTrustMe

As the alternative to xposed framework you can use frida and

universal bypass script

If you don't have root on your device you need to change the smali code in few places, look for SSlContext and SSLSocketFactory.

You can check this implementation of trust manager and recreate this in the app.

  • Tried SSLUnpining - failed. No data captured. Tried JustTrustMe - failed. Applications refuse to connect. Frida looks promising and I will proceed to use it, although on Windows building the libraries seems to fail for me. – Xatev Jul 25 '18 at 11:43
  • If you have problem with libraries building, use pre-compiled ones, github.com/frida/frida/releases. Make sure that lib versions matches both platforms (mobile and PC). – TheKalin Jul 25 '18 at 12:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.