1

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning.

I know that there are many different ways for defeating certificate pinning, but I'm curious to know if it is possible to do it in this way.

I used this python script (https://github.com/meeee/pushproxy/blob/master/utils/find_certs.py) to surf the iOS executable file and find the certificates hardcoded in use for certificate pinning.

What if I replace the hardcoded certificate in the executable with, let's say, the certificate I created through Charles to get normal SSL traffic? Is it viable? Thanks!

  • The iOS executables are usually signed. Modifying the executable may cause the app to not validate. How are you getting around that? – Daisetsu Mar 23 at 19:22
  • I'm on a jailbroken device and I have decrypted the executable (that otherwise would not have been analysable at all) @Daisetsu – scugn1zz0 Mar 23 at 19:26
  • @scugn1zz0 If the system is jailbroken then you have complete control over the system. You can easily disable certificate pinning for any executable. – forest Mar 24 at 1:12
0

If you are able to modify the binary and get the process to still execute, then yes, that works. Make sure to modify the pinned cert with the right level of replacement (i.e. a leaf cert with a leaf cert or an intermediate CA with a CA or whatever), and of course keep the original around in case modifying it breaks something else.

I assume the cert / key isn't in its own file? I've seen that before, and it makes everything really easy; just replace the contents of the file with your proxy's cert and you're good to go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.