1

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning.

I know that there are many different ways for defeating certificate pinning, but I'm curious to know if it is possible to do it in this way.

I used this python script (https://github.com/meeee/pushproxy/blob/master/utils/find_certs.py) to surf the iOS executable file and find the certificates hardcoded in use for certificate pinning.

What if I replace the hardcoded certificate in the executable with, let's say, the certificate I created through Charles to get normal SSL traffic? Is it viable? Thanks!

Improve this question
3
  • The iOS executables are usually signed. Modifying the executable may cause the app to not validate. How are you getting around that?
    – Daisetsu
    Mar 23, 2019 at 19:22
  • I'm on a jailbroken device and I have decrypted the executable (that otherwise would not have been analysable at all) @Daisetsu
    – scugn1zz0
    Mar 23, 2019 at 19:26
  • @scugn1zz0 If the system is jailbroken then you have complete control over the system. You can easily disable certificate pinning for any executable.
    – forest
    Mar 24, 2019 at 1:12

1 Answer 1

Reset to default
1

If you are able to modify the binary and get the process to still execute, then yes, that works. Make sure to modify the pinned cert with the right level of replacement (i.e. a leaf cert with a leaf cert or an intermediate CA with a CA or whatever), and of course keep the original around in case modifying it breaks something else.

I assume the cert / key isn't in its own file? I've seen that before, and it makes everything really easy; just replace the contents of the file with your proxy's cert and you're good to go.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .