MitM Android Java Application

Question

I'm trying to MitM an Android Application for research purposes (it's designed to be broken).

I'm using Burp as an attack proxy and already exported the Burp CA certificate and imported it into the Android CA store.

I also tried 3 different tools that promise to break certificate pinning (Android-SSLTrustKiller and others).

However every time I set my Burp as proxy, the app throws the following error in logcat:

09-14 20:18:07.446: W/System.err(2478): javax.net.ssl.SSLHandshakeException: 
checkServerTrusted: Expected public key: 30820122300d06092a864886f70d0......

My best guess is that the Java "Environment" is using different certificate settings than the rest of the Android OS.

I can already decode the browser or Google maps just fine.

So how can I get Java to ignore the certificate pinning?

Answer 1

So how can I get Java to ignore the certificate pinning?

To get around certificate/public key pinning you must usually make changes to the application itself since the pinning is done there with an application specific trust manager. That means it does not work to just add your CA as trusted to the system wide CA store.

For a recent write-up of how this can be done see Defeating SSL Pinning in Coin's Android Application .

Answer 2

figured it out a year later: used apktool to decompile the android app to smali code and remove the certificate pinning in the smali code. Recompiled it with apktool and was able to mitm it!

Nowadays there is a lot of tutorials that explain this.

for example: https://itunsecurity.wordpress.com/2016/12/25/vulnhub-flickii-a-different-approach-walkthrough-part1/