1

I have an application that communicates with the server through a TCP TLS 1.2 connection. The app probably uses certificate pinning. I want to intercept this traffic.

Is there any way to decrypt the traffic except extracting master secret or RSA private key? Will MITM approach (like sslsplit) work here?

1

In modern TLS, the private key of the leaf certificate won't let you decrypt previously recorded traffic, because modern TLS has DH (specifically, ECDHE) which provides PFS.

So you need to MiTM the connection or extract the per-connection ephemeral keys from the app.

5
  • Is MITM possible when the app check for expected certificate?
    – WLTY
    Nov 12 '20 at 15:19
  • Not in a simple way.
    – Z.T.
    Nov 12 '20 at 15:27
  • is there any way except changing/removing cert check?
    – WLTY
    Nov 12 '20 at 15:34
  • If it actually checks the expected cert or public key or their hash, no.
    – Z.T.
    Nov 12 '20 at 15:35
  • 1.3, which is not in the Q, has only PFS, actually both ECDHE and FFDHE but the latter is rare now. 1.0 through 1.2 (all) have both xxDHE and plain-RSA, although post-Snowden more people prefer or require xxDHE. Nov 13 '20 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.