3

I'm trying to intercept Android application traffic from my Android phone....Basically what worked before was that i had simply installed fiddler proxy on my PC, exported the root certificate (and added it to my android devices CA storage), then i installed cydia's mobile substrate and Android-SSL-TrustKiller because apparently the apk in question uses certificate pinning that needs to be bypassed in order to properly MitM the app. I set my android wifi proxy settings to the same ip:port as the machine that fiddler is listening on.

Unfortunately this does not work anymore for the application in question and im left unable to properly read the traffic..

I tried proxydroid (which uses iptables i believe), and fiddler showed attempts at connecting to one of the ip's, but it never goes through (i believe this is an issue with the IP not resolving to the host-name correctly, which causes certificate name mismatch errors)

With standard wifi proxy tuned to fiddler, i dont see ANY requests. With proxydroid, i see this http://gyazo.com/6792f884e1f88453a8cacb1632d0b3d5 (tones of CONNECTS and cert mismatches, despite having imported fiddlerroot into CA storage.

I have tried to use Charles web proxy with the same results seen here : http://gyazo.com/164feead28263f1db84e300127de1594

I'm at my wits end here. The thing is other apps seem to be displaying their traffic just fine (Facebook,instagram,dropbox, even banking apps)

I'm convinced that its some kind of certificate validation error but i don't know how to proceed... The only solution i can think of is just reformatting my phone and re-trying from square 1 entirely...

|improve this question
  • Can you see any of the TLS handshake over the wire? Is it succeeding? You should be getting some kind of TLS error message if it fails. – RoraΖ Feb 18 '15 at 13:19
  • Check SandroProxy has options to foward to diffrent proxy – user956584 Nov 27 '16 at 18:29
1

For proxying, it is possible to use Burp for android: https://systemoverlord.com/blog/2014/07/13/passing-android-traffic-through-burp/

(this second set of instruction assumes you are using an emulator)

http://resources.infosecinstitute.com/android-application-penetration-testing-setting-certificate-installation-goatdroid-installation/

|improve this answer
  • I have tried burp as well as genymotion android emulator.... I'll ask straight up, has anyone managed to intercept the https calls of the android app that starts with twi and ends with tter? – drew Feb 18 '15 at 1:45
  • The site shouldn't matter too much. Burp wont care what you proxy as long as you properly set up the proxy. If the app itself is set up to resist that (never tried the twitter app myself) you may want to reverse engineer the jar and see what it's up to, and side load a modified jar. – baordog Feb 18 '15 at 2:48
  • The problem is it's beyond my level of expertise... If someone more proficient than me is able to look into it, i can compensate them for their time . – drew Feb 18 '15 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.