Skip to main content

Questions tagged [https-protocol]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
75 views

Is there any Android application that can manipulate the http response?

Is there any android app to manipulate http response body without vpn? for example: from "0|{random_string}|Wrong" Becomes "1|{random_string}|True" Thanks in advance
akunguti's user avatar
3 votes
2 answers
2k views

Mitsubishi MAC-577IF2-E WIFI controller Firmware file

I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E Wi-Fi controller, and as always nowadays these devices communicate with Cloud servers first, then with you, which practically means you ...
Hojzerice's user avatar
0 votes
0 answers
173 views

HTTPS post request not showing up in http debuggers

There is this program I'd like to debug of which I already have the source code. When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http ...
Nqndi's user avatar
  • 35
0 votes
0 answers
84 views

SSL pinning deep problem

I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app ...
TrueStar's user avatar
2 votes
1 answer
3k views

finding rest api urls after decompiling apk

i have two apk files , when i decompile them using apktool i can take a look at decompile code , so here is what really confuse me , in the first apk if i searched the hole files for strings witch ...
Hothifa Farh's user avatar
1 vote
1 answer
462 views

Charles TLS Proxy for Android device with root access

I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am ...
hft's user avatar
  • 191
1 vote
2 answers
956 views

fakenet for apps using SSL

With great hopes I have tried to use fakenet-ng for testing spoofing or MITM type vulnerabilities. The android app I am testing uses HTTPS POST, and with fakenet it stops short of sending any data ...
multicode's user avatar
1 vote
1 answer
509 views

WebSocket debugging in Javascript app gives "401 Unauthorized" [closed]

I'm attempting to reverse engineer a private API used by an Android app that makes use of WebSockets. These requests are made from JavaScript inside a WebView. I use Charles to intercept both HTTP ...
FailedShack's user avatar
3 votes
0 answers
4k views

How to bypass certificate pinning on OS X and Windows [closed]

When reverse engineering a thick application it can be very useful to be able to see the network traffic it generates. Because of this, many applications use HTTPS to communicate with their servers. ...
pzirkind's user avatar
  • 437
0 votes
1 answer
133 views

Need help understanding "garbage" data in https request

I managed to overcome certificate pinning in an android application and I am now able to view all the HTTPS request in plain text. However, I came across this request that I still do not understand: ...
Lew Wei Hao's user avatar
1 vote
2 answers
15k views

Sniffing https traffic of an android app

I want to do a challenge: automise some tasks that I do in a game so I can get the max of points. To do that, I need to know the url called and the parameters that are used in the Game. After setting ...
rsabir's user avatar
  • 111
-2 votes
1 answer
1k views

How to sniff HTTPS traffic of Android apps that ignore the system proxy setting?

I saw a very similar question about this on macOS just 20hrs ago but I'm always needing to do this on Android and I keep forgetting the name of the app. So this is just for reference.
scruffy's user avatar
  • 36
-1 votes
2 answers
584 views

How to sniff HTTPS traffic of apps that ignore system proxy setting? [closed]

I want to sniff and decrypt HTTPS traffic of apps that ignore system proxy setting on macOS. If I understand correctly, common tools like Charles cannot help. How could I achieve that?
an0's user avatar
  • 101
0 votes
2 answers
845 views

Lutron Caseta Protocol over HTTPS

I have a Lutron Caseta light switch. When I open the iOS app, it connects to lutron.broker.xively.com port 8883. Using a fakedns server I was able to direct that to my server running netcat as follows:...
justin's user avatar
  • 485
1 vote
1 answer
719 views

Reverse-engineer digest http authentication

I have an iOS app which uses digest HTTP authentication with nonce which expires every 5 minutes. The client calculates response as following: HA1=MD5(username:realm:password) HA2=MD5(method:...
Nikolay Derkach's user avatar
3 votes
3 answers
1k views

Android (4.4+) SSL wireless sniffing without certificate changing

I wish to analyze the unencrypted data sent of SSL by an Android APK that uses certificate pinning. This suspicious APK is used to configure a wireless device. I need to determine two things: ...
Just Asking's user avatar
2 votes
1 answer
458 views

How to verify if Firefox is actually sending zlib data over SPDY?

I recently posted a StackOverflow bounty related to figuring out whether it is Wireshark, Firefox or just the data sample that is wrong, judging by the fact that latest Wireshark cannot dissect it. ...
d33tah's user avatar
  • 327
3 votes
2 answers
2k views

Extracting HTTPS packets before encryption

Say we have a Windows application, which sends some packets over HTTPS. We need to extract the content of this packets (unencrypted of course). There is no way to get hands on server private ...
McTraher's user avatar
1 vote
5 answers
3k views

Using Stunnel to packet capture HTTPS connection

I want to reverse engineer an application using HTTPS to communicate. I need a tool that performs a man in the middle attack and send it's own SSL certificate to the application, so I can decrypt the ...
Farzan R Nobakht's user avatar