3

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager.

class miTM implements  javax.net.ssl.X509TrustManager{

    public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) throws java.security.cert.CertificateException{
        return;
    }

In the above code checkServerTrusted method is empty so this application is vulnerable to MITM attacks.

I created a certificate using openssl and installed vulnerable android application in emulator.

Now how can i perform man in the middle attack in android emulator using sslsniff or any other tools?

Improve this question
3
  • 1
    You need a way for the Android device to route to your MitM server. You could use a VPN like in this example: tripwire.com/state-of-security/security-data-protection/… or you could modify the routing tables using ADB xinotes.net/notes/note/1496. A combination of the two might be what you're looking for. Hard to know exactly without knowing what kind of application you're trying to MitM.
    – RoraΖ
    Aug 12, 2014 at 11:14
  • sorry for late reply i went to vacation .. i want to prove that this android application is vulnerable to MITM attack. how can i?.
    – user3160055
    Aug 25, 2014 at 6:37
  • Easier if you can use 2 computers (one for the emu and another for the MITM).
    – LatinSuD
    Sep 11, 2014 at 22:18

2 Answers 2

Reset to default
2

Google "MITM PROXY", you will find a lot of tools. One example is:

http://mitmproxy.org/

With cell phones, MiTM attacks are multi-route, so you have to sometimes do some pretty technical set up of environments to completely cover all the paths. Remember you have 3g/4g, sms/mms, wireless, NFC, BT/BTLE.

Of course if you are using just the emulator, then you just have the "wireless" or traditional network route and any of those frameworks should work.

Improve this answer
2
  • MITM proxy (ie. the link provided above) is definitely what you need. It can generate untrusted certificates on the fly which is what you need to target an App which doesn't validate certificates properly. SandroProxy is an alternative if you want something running on the actual device.
    – thexacre
    Sep 11, 2014 at 23:22
  • I used this for months and it works very well; both for hardware (standard or factory mode) and the emulator. The emulator is easier to intercept, but is done with command line arguments rather than inside the emulator itself. For Android Studio, it might be under Launch Configurations.
    – ǝɲǝɲbρɯͽ
    Apr 21, 2015 at 3:47
0

I haven't used android emulator but have used Fiddler to debug traffic on an iPad.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .