Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [https-protocol]

The tag has no usage guidance.

2
votes
0answers
492 views

How to bypass certificate pinning on OS X and Windows [closed]

When reverse engineering a thick application it can be very useful to be able to see the network traffic it generates. Because of this, many applications use HTTPS to communicate with their servers. ...
0
votes
1answer
53 views

Need help understanding “garbage” data in https request

I managed to overcome certificate pinning in an android application and I am now able to view all the HTTPS request in plain text. However, I came across this request that I still do not understand: ...
0
votes
2answers
3k views

Sniffing https traffic of an android app

I want to do a challenge: automise some tasks that I do in a game so I can get the max of points. To do that, I need to know the url called and the parameters that are used in the Game. After setting ...
0
votes
0answers
188 views

Does Sony disallow public use of the “hidden” PlayStation API?

If you set up an MITM proxy and connect a PlayStation or a mobile device running a PlayStation app to it, you can see through the HTTP(S) traffic that there's a PlayStation API that's not officially ...
-2
votes
1answer
758 views

How to sniff HTTPS traffic of Android apps that ignore the system proxy setting?

I saw a very similar question about this on macOS just 20hrs ago but I'm always needing to do this on Android and I keep forgetting the name of the app. So this is just for reference.
-1
votes
2answers
311 views

How to sniff HTTPS traffic of apps that ignore system proxy setting? [closed]

I want to sniff and decrypt HTTPS traffic of apps that ignore system proxy setting on macOS. If I understand correctly, common tools like Charles cannot help. How could I achieve that?
0
votes
2answers
368 views

Lutron Caseta Protocol over HTTPS

I have a Lutron Caseta light switch. When I open the iOS app, it connects to lutron.broker.xively.com port 8883. Using a fakedns server I was able to direct that to my server running netcat as follows:...
1
vote
1answer
235 views

Reverse-engineer digest http authentication

I have an iOS app which uses digest HTTP authentication with nonce which expires every 5 minutes. The client calculates response as following: HA1=MD5(username:realm:password) HA2=MD5(method:...
2
votes
2answers
907 views

Android (4.4+) SSL wireless sniffing without certificate changing

I wish to analyze the unencrypted data sent of SSL by an Android APK that uses certificate pinning. This suspicious APK is used to configure a wireless device. I need to determine two things: ...
2
votes
1answer
329 views

How to verify if Firefox is actually sending zlib data over SPDY?

I recently posted a StackOverflow bounty related to figuring out whether it is Wireshark, Firefox or just the data sample that is wrong, judging by the fact that latest Wireshark cannot dissect it. ...
2
votes
2answers
917 views

Extracting HTTPS packets before encryption

Say we have a Windows application, which sends some packets over HTTPS. We need to extract the content of this packets (unencrypted of course). There is no way to get hands on server private ...
1
vote
5answers
2k views

Using Stunnel to packet capture HTTPS connection

I want to reverse engineer an application using HTTPS to communicate. I need a tool that performs a man in the middle attack and send it's own SSL certificate to the application, so I can decrypt the ...