0

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy.

This is my topology:

Android 192.168.10.199--> mitmproxy 192.168.10.246--> server 192.168.10.211

I am proxying the traffic coming from a specific application on my rooted Android using proxydroid, this application communicates with the server.

I know that after the client sends a hello client (which will list cryptographic information to the proxy), the proxy forwards the hello client to the server, the server responds with a hello server and sends it's certificate to the proxy, the proxy will then check if the certificate is valid or not. The client (Android device) is supposed to trust the proxy because I've already installed the mitmproxy certificate on it.

Mitmproxy does intercept some data coming from the application but not all of them. The application displays the programs aired on some specific channels, so it's constantly sending some /GET requests to the server to get the programs currently displayed and gets updated. those /GET requests are the ones mitmproxy intercepts. The application has a remote control option that enables me to choose a channel for example, but when I do, mitmproxy doesn't intercept the request sent.

After doing some research I'm thinking that this must be caused by certificate pinning, which basically means that the client won't communicate with a server that is not signed with the certificate hard-coded in the application.

My question is:

Why is the client not trusting mitmproxy? Is this happening because my application compares the mitmproxy certificate to the one that is hardcoded in it? If yes, I've decompiled the application, and retrieved the certificate from the apk, so is there something I can do with it?

Thank you!

  • 1
    While you claim that the proxy intercepts some data and not the others you don't provide any information which data get intercepted and which data not. This makes it hard to speculate what the reason for the difference might be. As for certificate pinning - this should cause the application to fail to get the data but does not make it possible just to bypass the proxy. It is unknown though what happens exactly in your case since like I said you don't provide any usable information about this. – Steffen Ullrich Jun 7 at 11:33
  • @SteffenUllrich Thank you a lot! The application sends constantly some /GET requests to update its content. The content of the app is the programs that are aired on some channels currently, so keeps sending /GET requests to the server to check changes. Otherwise, the requests That I send are remote control requests, for example /GET a specific channel. I hope this clarifies the matter. – yosra Jun 7 at 11:49
  • @SteffenUllrich I've updated my post. – yosra Jun 7 at 11:57
  • How do you know that the application sends requests you miss? Can you do a packet sniff to show what these missed requests are and what is different from these to the intercepted requests? – Steffen Ullrich Jun 7 at 14:51
  • @SteffenUllrich I know this because I can command the server and choose a channel, I can control the sound, change the current channel. and none of these requests are intercepted by mitmproxy. – yosra Jun 7 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.