1

Here are the steps I've been through until I hit a problem.

  1. I have a website that runs on an HTTPS protocol serving the Android application
  2. I generally debug requests / responses via Wireshark running on Windows operating system.
  3. I requested the private key to the server programmer so that I can attach it to Wireshark, but I didn't get it.
  4. I still needed to debug my app rather than copy-pasting Log.d() all over my Android app.
  5. Downloaded an app called "SSL" in Google Playstore.
  6. It installs a "packet capture certificate" (which Android is pretty suspicious of because it's a third-party certificate)
  7. Started capturing HTTPS packets that are decrypted

How can this actually work? This application obviously knows how to retrieve packets heading to other apps. But how can it decrypt the SSL? Or is it the other way around? Are the apps reporting the decrypted HTTP packets to this app?

Improve this question
3
  • 1
    Wireshark can (passively) decrypt SSL/TLS with either (1) the server longterm key using plain-RSA keyexchange only or (2) the session master secret obtained from either endpoint (using any KX). But if the server programmer can't locate their longterm key for you they probably can't locate multiple session secrets either, and I doubt any Android app will, so you're probably left with only an active MitM as already answered.
    – dave_thompson_085
    May 18, 2016 at 21:10
  • Providing a link to the app would have been incredibly helpful. They might have had documentation on how the app worked.
    – schroeder ♦
    Sep 5, 2022 at 9:17
  • How Wireshark performs TLS interception is well covered by Wireshark's documentation.
    – schroeder ♦
    Sep 5, 2022 at 9:19

1 Answer 1

Reset to default
1

HTTPS needs certificates to work. These certificates are meant to be a guarantee that you're talking to the right server (and not to the server of an intruder). Encryption only (without this authentication) would be pretty useless, because it would be trivial to intercept and decrypt traffic.

To manage all this certification stuff, we use a Public key infrastructure. Your phone trusts only certificates signed by a certificate authority.

By installing the app you mentioned, you imported a "packet capture certificate". Now your phone trusts everything it trusted before - plus all certificates signed by the "packet capture certificate".

Now the app can act as a proxy between your device and your web application. It decrypts your traffic so that it can display the packet contents, and then re-encrypts it with its own secure connection to the web application. This is similar to a Man-in-the-middle attack. This only works because you trusted the certificate. (If you wouldn't trust the certificate, your phone would most likely throw a connection error.)

But how does the app get the packets? It probably uses the Android VPN API and presents itself to the Android system as a VPN tunnel. Therefore, Android forwards all packets to the app.

Wireshark can't be used as a proxy because wireshark only listens to traffic and does not alter or insert new requests. If you want another tool which can intercept HTTPS, then try OWASP ZAP, Burp Suite or mitmproxy.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .