1

We're doing a security assessment on a Cordova / Ionic Mobile Application (APK & IPA). Even though we've imported our proxies Certificate Authority to the device and we can intercept SSL in the default web browser without certificate errors, the application is erroring out whenever we have a proxy configured on the device and an HTTPS call is being made.

The development team is telling us they don't have any certificate pinning or other protections in place besides what is on by default in the framework.

Has anyone bypassed this before with an Ionic application and can give some tips? I'm focusing on the Android build first and the traditional overriding of the SSL error to cause it to continue by modifying the Dalvik byte code is not being successful for me.

Searching through the artifacts I'm not seeing a custom CA authority list in anything, nor a hash of a certificate etc; as a result I really don't understand why this isn't working.

Any information you can give me which helps to be able to proxy the application would greatly be appreciated.

0

I figured this out. It turned out that the issue was with Android Nugat and there actually was nothing wrong / built in to prevent the interception. Switching to JellyBean resolved the issue and allow the interception to happen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.