MitM on Android App - Revision history

EPelanovic at 09:33, 3 April 2023

2023-04-03T09:33:36Z

← Older revision		Revision as of 09:33, 3 April 2023
Line 145:		Line 145:

	Most of the apps do not work since they have most probably HPKP, certificate- or key pinning implemented, which didn’t allow to accept another certificate then configured.		Most of the apps do not work since they have most probably HPKP, certificate- or key pinning implemented, which didn’t allow to accept another certificate then configured.

			== References ==

			* https://owasp.org/www-project-mobile-app-security/

	[[Category:Documentation]]		[[Category:Documentation]]

EPelanovic at 21:24, 30 March 2023

2023-03-30T21:24:26Z

@@ Line 110: / Line 110: @@
 [[File:Bild7.png|800px]]
 == Results ==
@@ Line 115: / Line 138: @@
 Some popular apps which were downloaded millions of times, were tested within this project. Basically, we distinguish between three outputs:
-&emsp;1.There are apps which didn’t load anymore and therefore didn’t work if a proxy on the virtual device is configured.
+&emsp;1.There are apps which didn’t load anymore and therefore didn’t work if a proxy on the virtual device is configured, most probably because of an implementation of certificate pinning.
 &emsp;2.App does work correctly, but the credentials cannot be decrypted.
 &emsp;3.App does work and credentials can be decrypted.

EPelanovic at 17:44, 30 March 2023

2023-03-30T17:44:28Z

← Older revision		Revision as of 17:44, 30 March 2023
Line 1:		Line 1:
	== Summary ==		== Summary ==

	The aim of this documentation is to test the certificate validation process of popular android apps. This will be done by a proxy which will intercept the traffic between the android app and the appropriate server. To simulate the Android smartphone an Android emulator was used. First the traffic will be intercepted without the root certificate of the proxy installed to check if a warning will prevent the user to continue to exchange data over an unencrypted channel. Then the root certificate of the proxy will be installed to be able to test if the https traffic can be decrypted.		The aim of this documentation is to test the certificate validation process of popular android apps. This will be done by a proxy which will intercept the traffic between the android app and the appropriate server. To simulate the Android smartphone an Android emulator was used. First the traffic will be intercepted without the root certificate of the proxy installed to check if a warning will prevent the user to continue to exchange data over an unencrypted channel. Then the root certificate of the proxy will be installed to be able to test if the https traffic can be decrypted. When targeting Android 7.0 (API level 24) or higher it shouldn't be possible to be able to see the decrypted HTTPS traffic, because the NSC settings should apply. All lower versions should accept the installed user certificates, which will allow the attacker to intercept the traffic in cleartext.

	== Background ==		== Background ==

EPelanovic at 15:12, 17 February 2023

2023-02-17T15:12:13Z

Show changes

EPelanovic: Created page with "== Summary == Description what this documentation is about. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == Description == === Step 1 === Enter these commands in the shell echo foo echo bar === Step 2 === Make sure to read * War and Peace * Lord of the Rings * The Baroque Cycle == Used Hardware == Device to be used with..."

2023-02-15T22:57:26Z

Created page with "== Summary == Description what this documentation is about. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == Description == === Step 1 === Enter these commands in the shell echo foo echo bar === Step 2 === Make sure to read * War and Peace * Lord of the Rings * The Baroque Cycle == Used Hardware == Device to be used with..."

New page

== Summary ==

Description what this documentation is about.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]