3

Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can tail it in a different terminal. And ignore issues like certificate pinning.


2

An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox. These tools will show you the entire request, response, and body of all network traffic and timeline of when connections are made. In Chrome, you can even edit the page content and review how it affects the ...


2

If you can make the application use a proxy, check Fiddler. I used stunnel recently to do the same with an android application - used the dextojar suite to take the application apart, replace the https://game.server.com URL with a http://game.server.com URL in the .dex file, re-create the .dex checksum, re-create and sign the apk, install the apk. Use this ...


2

An alternative approach might be to use panda to extract the key from a trace as documented in the panda ssl tutorial. That said, the usual mitm approach is probably a bit easier to get going unless you're dealing with certificate pinning.


2

(Copy of an answer I gave on Stack Overflow) You could try injecting code into the Android app to sniff and dump SSL traffic. Take a look at https://github.com/5alt/ssl_logger (5alt's fork works with Android). Note that you need root for this. This works by hooking functions inside OpenSSL so that the raw traffic can be dumped before encryption/after ...


2

iSEC Partner's Android SSL TrustKiller utilizes hooks that Cydia substrate can provide in order to defeat certificate pinning.


2

I managed to decompress it in Python by specifying the decompression dictionary: #!/usr/bin/python3 import zlib import base64 header = ("783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f" "6400000003474554000000053a70617468000000012f000000083a76657273696f6e000000084" "85454502f312e31000000053a686f73740000000d3139322e3136382e302e313734000000073a" "...


2

The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in the Linux command line.


2

I am using burpsuite for HTTPS inspection. Need to install its root cert on the phone. Most apps does not verify cert, or uses phone cert store. Windows users often use Fiddler. These tools generate a new CA cert, that needs to be moved to the phones cert store, and be trusted. In case the app downloads cert first time, and uses SSL pinninng, it is best to ...


1

I will answer my own question because I figured out what was wrong. The app was not functioning correctly for a number of reasons that frustrated the analysis. For one, there were many advertising domains being contacted by the app on startup. The app made these connections over TLS and the connections would not succeed without trusting the proxy root CA ...


1

It seems that most of the people are better using the mitmproxy tool (see docs) together with SSLsplit for this kind of usage. Just for the sake of completeness, here are a few pages explaining how to do: Intercepting SSL and HTTPS traffic with mitmproxy and SSLsplit. MITM attack over HTTPS connection with SSLStrip. Use SSLsplit to transparently sniff TLS/...


1

Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server. I found out you can disable it by adding supress_origin=True when calling connect on the WebSocket.


1

If you're a Windows user, as a matter of dynamic analysis, you could try using an emulator like BlueStacks, then inspect your system network traffic with a program like Fiddler or WireShark. Additionally, you could use a program like Cheat Engine to open the BlueStacks process and scan its memory for strings related to URLs. As an aside, you could ...


1

If you can install an extra CA, it shouldn't be a problem. Mitmproxy has documentation on how to set up transparent intercepting. http://docs.mitmproxy.org/en/stable/transparent.html


1

This isn't a complete answer but I don't have enough rep to comment yet. First off, giving us binary data with all the non-printable characters presented as ? doesn't help. Try piping it through xxd (like nc -l 8883 | xxd) to get a hex dump which would be far more useful. When you ran mitmproxy were you using the real device? This is unclear from your ...


1

So finally, I used Cycript and attached to the running app process, and consequently intercepted the private key in runtime.


1

Since you are want to bypass HTTPS encryption, why not use Fiddler? Fiddler is a web debugging proxy that auto-sets itself as the system proxy. It also offers the option to install a self-signed root certificate at the system, so HTTPS sniffing can be done. All you have to do is start Fiddler, go to Tools -> Fiddler Optios -> HTTPS tab -> check "Decrypt ...


1

Maybe some of the following tools may help you: "SSLHOOK is a Win32 DLL that allows hooking of the OpenSSL functions SSL_read and SSL_write" https://github.com/strobejb/sslhook Immunity Debugger (immdbg) has the !hookssl command (hookssl.py)


1

If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is stripped, one option is to create your own SSL certificate pair and add it to your OS certificate trust store like so: http://pubs.vmware.com/view-51/topic/com....


Only top voted, non community-wiki answers of a minimum length are eligible