3

I have an android application. It connects to a web socket server and uses the X509Certificate to verify the connection.

 newBuilder.trustManagers(WebSocketClient.sTrustManagers);

By using Frida I was able to get TrustManager[] trustManagerArr

trustManagerArr: ["<instance: javax.net.ssl.TrustManager, $className: im.sum.connections.Client$1>"]

How can I get certificate to use it for the purpose of establishing a connection from python?

My Frida script

W1ebSocketClient["setTrustManagers"].implementation = function (trustManagerArr) {
     console.log(' !setTrustManagers is called' + ', ' + 'trustManagerArr: ' + JSON.stringify(trustManagerArr));
   
          
     let ret = this.setTrustManagers(trustManagerArr);
      console.log(' !setTrustManagers ret value is ' + ret);
      return ret;
 };
0

1 Answer 1

2

If you use an TLS interception proxy and have a rooted phone it may be easier to add the used root CA certificate as system certificate (like described in mitmproxy doc. Afterwards the certificate verification will work unless the app uses cert/key pinning.

Alternatively you can use anti-SSL/TLS verification/pinning scripts included in Objection.

If you want to develop a script yourself it is easier to hook the javax.net.ssl.X509TrustManager method checkServerTrusted and replace it with an empty method.

4
  • Thanks for the answer. I'm not trying to see the content of the requests, I want to establish a connection to the server. When I try to establish a connection with a python script, the server drops the connection. As I understand it, the problem is the lack of a certificate. I am trying to read the certificate that is in the trustManagerArr variable.
    – user123
    Jan 25, 2023 at 14:27
  • @user123 Then your question was already talking the wrong path. For selecting a client certificate (and key) an implementation of KeyManager respectively X509ExtendedKeyManager is responsible in plain Java/Android HTTPS connection. The TrustManager is only responsible for verifying the server certificate.
    – Robert
    Jan 25, 2023 at 15:07
  • Another possibility is that the server preforms TLS fingerprinting and thus Python is recognized as "not an Android device" and thus the server drops the connection. Therefore it is crucial to identify when the connection is closed. If the handshake is successfully completed, a missing client certificate is very unlikely an issue.
    – Robert
    Jan 25, 2023 at 15:11
  • Thank you. This is good advice.
    – user123
    Jan 26, 2023 at 3:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.