HestiaBestia 13 I was always told to use Fiddler to sniff android traffic. I never really understood why most apps did not work with the Fiddler certificate installed, and why I could not see most traffic. I did some digging and found that most apps verify your certificate, and so to properly capture traffic you would need to make the app verify your certificate or bypass the step all together. Below I will list the steps that I took to get this working. PLEASE NOTE: If you'd like some real explanations of how this works, this guide will not provide it. I have no idea how most of this works, or even if what I said above is accurate. All I know is that I have had good results and I would like to share them with you all. Required The APK of the app you'd like to use. An android phone (rooted), an emulator may work but I have not tested. A charging cable for said phone. Frida, Objection, and ADB properly installed. Fiddler of course. Download Frida HERE. Download Objection HERE. Download ADB HERE. Download Fiddler HERE. Click for setup instructions for FRIDA and OBJECTION. REMEMBER TO ADD ALL OF THIS TO YOUR PATH. UPON RUNNING OBJECTION THE FIRST TIME YOU WILL NEED TO DOWNLOAD DEPENDENCIES AND PLACE IN YOUR PATH. THIS IS POSSIBLE ON IOS, BUT I CANNOT HELP YOU WITH THAT. Step One Lets set up our certificate on our android device. Start Fiddler and do the following. Tools > Options > HTTPS Enable the box that says Capture HTTPS Connects, and Decrypt HTTPS traffic. Tools > Options > Connections Enable the box that says Allow remote computers to connect. Now over to your android device, and go to the WIFI settings. Modify the network you are currently connected to and add your computer's IPV4 as your proxy. Now make the port the one in the Connections menu of Fiddler. This is 8888 by default. Open the browser on your android device and head to: http://ipv4.fiddler:8888/ Now you can tap FiddlerRoot Certificate and install it. Fiddler setup complete! Step Two Download and place your APK in your chosen directory, and navigate to it in the command prompt. Type the following. objection patchapk -s (PATH TO APK) Wait for this to finish, and you have your modified APK. Install this on your android device, and connect it via USB to your computer. Enable USB debugging in the developer settings of your android device. Now run the app, and type the following in the command prompt. objection explore android sslpinning disable Step Three Do your thing! Make a config, or whatever you please. The success rates of this method are much higher than just installing the certificate. You are now able to capture traffic from this app with fiddler. Note, success rates are not 100%! It's fairly rare, but I have run in to a few apps that will crash after being patched. I will help all of you to the best of my ability. Quote Share this post Link to post Share on other sites
LeJatta 14 thanks bro this is a good ass tutorial Quote Share this post Link to post Share on other sites
HestiaBestia 13 thanks bro this is a good ass tutorial I appreciate it. First one to look at it as far as I can tell :) Quote Share this post Link to post Share on other sites
