Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

From my experience, for certificate pinning, fastest option is to search for existing certificate/fingerprint, and try to replace it with charles’/mitmproxie’s

Edit: oh another trick usually works is to change transport to HTTP from HTTPS, just changing endpoint to something you control and changing it to http (with little hex editing the endpoint), and reverse proxy with mitmproxy/charles to the target, you can speed up process.



For the edit: If the endpoint works on HTTP that is. We no longer allow HTTP connections to our API servers for instance.


Nope you should change endpoint to charles/mitmproxy, then reverse proxy to https endpoint.

So basically for app endpoint will be charles/mitmproxy machine, then from there, you will make https request to real API server


I don't know certificate formats and I imagine it would require conversion between hex and something - maybe you can write a blog post with an example?


I am not blogging but in a free time I will try to write up a small gist.


ooh I like the second idea - so since it's an HTTP the cert pinning code won't be triggered at all, and all you need is to grep https to find endpoints and change?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: