I need to check an android app for vulnerabilities. I have to intercept encrypted data sent to the server. This application uses certificate which is placed in res/raw directory, so it is a resource file. I modified it to a Charles proxy root certificate, installed the same certificate on Android, but application does not connect.Screenshot


A common problem with mobile applications and making use of proxy software, such as charles, is that the application may be using "certificate pinning" to prevent proxied interception of the traffic between it and the server.

The easiest way to ascertain this would be to ask the application developer if they're doing that and request a build with that feature disabled to make testing easier (I'm assuming here you're acting as a security reviewer for the app.).

If that's not possible, something like Android SSL Trustkiller can be used on a rooted device to remove the certificate pinning and allow interception.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.