Installing own certificate for HTTPS sniffing?

Question

This is something I heard before but cannot remember how to do, I am looking for a tutorial or alike.

I have an Android application I need to audit. I need to check if any cookies are being transmitted, unfortunately the traffic is HTTPS.

I have been told it is possible to install my own certificate onto the Android phone and then I can decrypt the traffic in Wireshark.

I have full access to the phone and computer I am auditing so installing any certificates is not an issue.

Does anybody have a guide as to how this is performed?

EDIT: This unanswered question is what I want to do https://stackoverflow.com/questions/45300728/import-self-signed-certificate-in-android-to-sniff-https-traffic

Possible answer: I might have answered my own question, this appears to decrypt HTTPS. Simply install the Charles certificate onto the device first. I will wait for somebody to confirm? https://www.charlesproxy.com/

Answer 1

Yes in general this is possible, as described in the other comment. That’s why apps often use certificate pinning. This means that the certificate and the public key are hard coded in the apps source code. Here you can find more information on certificate pinning.

https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning

If this is the case, you have to decompile the app, remove the pinning parts and recompile it.

Answer 2

Use mitproxy and sslsplit to manipulate your phone and make your computer pretend to be the server. You will need to install the newly forged certificate in your mobile phone so that your phone doesn't raise any warnings. Check out this post.