With great hopes I have tried to use fakenet-ng for testing spoofing or MITM type vulnerabilities. The android app I am testing uses HTTPS POST, and with fakenet it stops short of sending any data because the app rejects the SSL certificate presumably created by fakenet. I also tried simply with Edge and Chrome on Windows 10, and same deal - I can't get to first base. I can't find any information about fakenet and certificates. Fakenet lists decrypting SSL as a great feature - but it seems pretty useless without a solution to the certificate problem - I must be missing something - how do I get applications to send HTTPS data to fakenet?
2 Answers
I am using burpsuite for HTTPS inspection. Need to install its root cert on the phone. Most apps does not verify cert, or uses phone cert store. Windows users often use Fiddler.
These tools generate a new CA cert, that needs to be moved to the phones cert store, and be trusted.
In case the app downloads cert first time, and uses SSL pinninng, it is best to ensure your phone is set up to use the proxy before launching the app for the first time.
All phone apps I have tried do use OS calls, so will use the system proxy. Thus MitM with data modification is trivial.
If we are talking client side certs, try running unzip on the apk and see if there is a cert file in the package.
Reverse engineering HTTPS is often trivial, but more and more do either HTTPS pinning, uses JWT for signon, or does other things to ensure that the request is not modified. In that case you need to really do low level reverse engineering.
It seems that most of the people are better using the mitmproxy tool (see docs) together with SSLsplit for this kind of usage.
Just for the sake of completeness, here are a few pages explaining how to do:
-
Thanks. Not an answer to my question, but still helpful - I'll check out those other tools. Mar 4, 2019 at 18:19