1

I want to see what viber is sending out of my android phone, I'm using mitm proxy (custom server) but the app is using certificate pining to detect the proxy and close the connection after the handshake is done.

I know the basic method of patching OkHttp's CertificatePinner. The problem with viber is that they went to extreme lengths to hide the pinning. Most apps I have seen were easy to patch, and the signature or the cert was not hidden.

I found around 7 keystores (bks) in the app, but no calls to CertificatePinner, no sha1/ or sha256/ signatures. am I missing something?

I also looked for Custom TrustManagers but could not find anything useful, mostly because the app is full of ads, (google, facebook, yandex, adjust.com, ...) some of these ad libraries have their own certificates and keystores

Any ideas on how the app is pinning the certificate? did I miss something?

(PS: this is for research purposes only)

Improve this question
3
  • 1
    The cert pinning mechanism might be in native code.
    – morsisko
    Commented Feb 7, 2021 at 12:01
  • Typically a pinned certificate is not included in the app, instead just a SHA-1 or SHA-256 of the certificate or it's public key is used and included. Therefore if you know the server cert chain I would hash each cert or it's public key(s) and try a raw search on all files in the app if one of the hashes are included in binary, hex or base64 format. Most likely you will end up in one of the 30+ native libraries included in the app.
    – Robert
    Commented Feb 7, 2021 at 14:29
  • 1
    Have you looked into using something like Frida to dynamically hook and disable cert pinning?
    – multithr3at3d
    Commented Feb 7, 2021 at 19:01

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.