2

Say there is an Android APK. You want to sniff the traffic to the private API. So you decompile it, find the cert, then replace it with fiddler's or burp's or charles proxy's, recompile it then run it, using one of the above listed proxies to sniff the traffic.

Is it really that simple? I easily found a text file titled "pubcert_prod"(along with pubcert_dev) in a top 10 worldwide app by ctrl+f'ing the decompiled apk.

It would be extremely trivial to write an automated tool that decompiles the app, searches contents for cert file extensions and/or greps for -----BEGIN PUBLIC KEY/CERTIFICATE----- and use openssl to generate a new cert and replace it which can then be used to sniff the ssl pinned traffic.

1 Answer 1

6

Is it really that simple?

Generally, yes.

It would be extremely trivial to write an automated tool that decompiles the app, searches contents for cert file extensions and/or greps for -----BEGIN PUBLIC KEY/CERTIFICATE----- and use openssl to generate a new cert and replace it which can then be used to sniff the ssl pinned traffic.

So?

SSL, with or without certificate pinning, is not designed to defend against a local on-client attack. It is designed to defend against data interception by arbitrary middlemen (e.g., ISPs, the coffee shop WiFi router) from arbitrary clients.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .