Let's say I'm trying to reverse engineering communctions between an Android app and a web server uing HTTPS.
At beginning, I tried to do MITM using webmitm and a fake cert. But the app failed to start because the fake cert used by webmitm is not trusted by the app.(Let's say the app has its own way to decide what cert it trusts and I cannot import the fake cert to Android as trusted cert)
So I come to another approach. I noticed that both the app and web server support weak ciphers(e.g. TLS_RSA_EXPORT_WITH_RC4_40_MD5 ). So I'm thinking, instead of using a fake cert as a bridge, is there any mitm tool which only change the Client Hello packet to enforce weak ciphers, and forward the server's original cert without decryption or encrypting anything in the middle.
In another word, when the app sends "Hello Webserver, I support the following cipher suites: XXX YYY ZZZ. Please choose one your support" , the mitm tool intercepts this packet, and change it to "Hello Webserver, I only support TLS_RSA_EXPORT_WITH_RC4_40_MD5" and forward it to the web server. Since both of them suppor this cipher suite, they are going to use this for the rest of the communication. And the mitm tool just forward everything between them, and record all the packets. And then I try to decrypt the recorded packets offline.