Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mitmproxy – Open-source console-based proxy

mitmproxy.org

Post reply on HN
Print view View original

21–30 of 41 posts

Re: Mitmproxy – Open-source console-based proxy

#21

Post by Aissen »

c7h wrote: post #15

one of the best tools for reverse engineering mobile apps. I'm just having problems when certificate pinning is enabled. Does anyone have an idea (or even a solution) how to deal with that?

Even without certificate pinning, starting with Android 7, you must decompile the app to allow user provided certificates. Or use an xposed module if you have a rooted device.

See this mitmproxy bug: https://github.com/mitmproxy/mitmproxy/issues/2054

And this tool is nice to automate decompiling, adding the line in the manifest to be able to use user-installed certificates, and recompiling: https://github.com/levyitay/AddSecurityExceptionAndroid

Also, if the app uses Google signin, you have to be rooted, because play services uses the package manager to check the app signer before giving the app a token.

Re: Mitmproxy – Open-source console-based proxy

#22

Post by bitexploder »

s0l1dsnak3123 wrote: post #18
c7h wrote: post #15

one of the best tools for reverse engineering mobile apps. I'm just having problems when certificate pinning is enabled. Does anyone have an idea (or even a solution) how to deal with that?

I'd also love to know if there's a solution for this problem!

There is. It depends on the mobile OS and device.

We deal with this routinely. Solutions tend to vary.

On iOS just use SSL kill switch (if you are jailbroken). If you are not jailbroken you don't have a lot of options. On Android there are some well documented approaches. Usually decompiling the app and adding to the local app's cert store will work and then rearchive and sign it.

Function hooking key network calls can work as well. It is pretty much required that if you want to do serious tinkering or assessment you need a jailbroken or rooted device. This can be a significant effort investment, but once done is generally reliable.

Re: Mitmproxy – Open-source console-based proxy

#23

Post by bitexploder »

mpeg wrote: post #10
cowabungamann wrote: post #6

Earlier quoted context omitted.

how do disable certificate pinning on iOS?

Haven't had to as the apps I targeted weren't using it. Can't think of an obvious way without rooting the device though...

That is because there isn't a good solution. You can get away with repackaging an IPA and hand modifying the binary depending on how they are performing the pinning, but it is always going to be time consuming to do it this way. If you are serious about tinkering you pretty much need a jailbroken device, which is getting harder to maintain by the year.

Re: Mitmproxy – Open-source console-based proxy

#24

Post by bitexploder »

Don't forget mitmdump. It is a great way to log sessions and chain to other proxies at the same time.

Also, mitmdump is one of the best and fastest ways to get ahold of web requests with Python to modify it on the fly.

http://docs.mitmproxy.org/en/stable/mitmdump.html

I have been using mitmproxy over Burp for day to day web app hacking these days. But we still use Burp scanner for lots of chores. I almost always chain through both to then go back in and use Burp features missing in mitmproxy (exploring site contents, etc.). But those are edge cases mostly needed for professional use and not for tinkering.

Re: Mitmproxy – Open-source console-based proxy

#27

Post by gregsadetsky »

c7h wrote: post #15

one of the best tools for reverse engineering mobile apps. I'm just having problems when certificate pinning is enabled. Does anyone have an idea (or even a solution) how to deal with that?

Same here, mitmproxy was always the goto tool, but many apps now use certificate pinning, which stops it cold.

I was recently wishing for a "Jailbroken Mobile Testing Tool", similar to Sauce Labs or BrowserStack but with jailbroken mobiles -- i.e. a cloud-based service allowing you to remotely control a mobile phone through a web interface. Would that be interesting to have?

This service would allow you to load an app from the App Store / Google Play, and then interact with it while logging all network connections (in tcpdump/wireshark/HAR/etc. format). The controlled mobiles would be jailbroken and have tools like SSL kill switch (as mentioned by @bitexploder in another comment) installed by default.

(Going further: the same tool would allow you to download the phone's storage as a zip archive for further analysis)

Re: Mitmproxy – Open-source console-based proxy

#28

Post by gregsadetsky »

pnutjam wrote: post #17
c7h wrote: post #15

one of the best tools for reverse engineering mobile apps. I'm just having problems when certificate pinning is enabled. Does anyone have an idea (or even a solution) how to deal with that?

what kind of problems?

Certificate Pinning (in apps) stops mitmproxy from proxying traffic to the servers you're mostly interested in proxying... see:

http://docs.mitmproxy.org/en/stable/certinstall.html#certifi...

Re: Mitmproxy – Open-source console-based proxy

#30

Post by justinjlynn »

Aissen wrote: post #21
c7h wrote: post #15

one of the best tools for reverse engineering mobile apps. I'm just having problems when certificate pinning is enabled. Does anyone have an idea (or even a solution) how to deal with that?

Even without certificate pinning, starting with Android 7, you must decompile the app to allow user provided certificates. Or use an xposed module if you have a rooted device. See this mitmproxy bug: https://github.com/mitmproxy/mitmproxy/issues/2054 And this tool is nice to automate decompiling, adding the line in the manifest to be able to use user-installed certificates, and recompiling: https://github.com/levyita…

Just wait until they go full 'treacherous computing' and turn on remote attestation using TPMs.
Post reply on HN