2

Say there is an Android APK. You want to sniff the traffic to the private API. So you decompile it, find the cert, then replace it with fiddler's or burp's or charles proxy's, recompile it then run it, using one of the above listed proxies to sniff the traffic.

Is it really that simple? I easily found a text file titled "pubcert_prod"(along with pubcert_dev) in a top 10 worldwide app by ctrl+f'ing the decompiled apk.

It would be extremely trivial to write an automated tool that decompiles the app, searches contents for cert file extensions and/or greps for -----BEGIN PUBLIC KEY/CERTIFICATE----- and use openssl to generate a new cert and replace it which can then be used to sniff the ssl pinned traffic.

5

Is it really that simple?

Generally, yes.

It would be extremely trivial to write an automated tool that decompiles the app, searches contents for cert file extensions and/or greps for -----BEGIN PUBLIC KEY/CERTIFICATE----- and use openssl to generate a new cert and replace it which can then be used to sniff the ssl pinned traffic.

So?

SSL, with or without certificate pinning, is not designed to defend against a local on-client attack. It is designed to defend against data interception by arbitrary middlemen (e.g., ISPs, the coffee shop WiFi router) from arbitrary clients.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.