This is something I heard before but cannot remember how to do, I am looking for a tutorial or alike.
I have an Android application I need to audit. I need to check if any cookies are being transmitted, unfortunately the traffic is HTTPS.
I have been told it is possible to install my own certificate onto the Android phone and then I can decrypt the traffic in Wireshark.
I have full access to the phone and computer I am auditing so installing any certificates is not an issue.
Does anybody have a guide as to how this is performed?
EDIT: This unanswered question is what I want to do https://stackoverflow.com/questions/45300728/import-self-signed-certificate-in-android-to-sniff-https-traffic
Possible answer: I might have answered my own question, this appears to decrypt HTTPS. Simply install the Charles certificate onto the device first. I will wait for somebody to confirm? https://www.charlesproxy.com/