I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy.
This is my topology:
I am proxying the traffic coming from a specific application on my rooted Android using proxydroid, this application communicates with the server.
I know that after the client sends a
hello client (which will list cryptographic information to the proxy), the proxy forwards the
hello client to the server, the server responds with a
hello server and sends it's certificate to the proxy, the proxy will then check if the certificate is valid or not. The client (Android device) is supposed to trust the proxy because I've already installed the mitmproxy certificate on it.
Mitmproxy does intercept some data coming from the application but not all of them. The application displays the programs aired on some specific channels, so it's constantly sending some /GET requests to the server to get the programs currently displayed and gets updated. those /GET requests are the ones mitmproxy intercepts. The application has a remote control option that enables me to choose a channel for example, but when I do, mitmproxy doesn't intercept the request sent.
After doing some research I'm thinking that this must be caused by certificate pinning, which basically means that the client won't communicate with a server that is not signed with the certificate hard-coded in the application.
My question is:
Why is the client not trusting mitmproxy? Is this happening because my application compares the mitmproxy certificate to the one that is hardcoded in it? If yes, I've decompiled the application, and retrieved the certificate from the apk, so is there something I can do with it?