From 50a23a38be148c1b1bb90b586c0d2820680d96b9 Mon Sep 17 00:00:00 2001 From: Tim Perry Date: Fri, 20 Oct 2023 18:14:57 +0200 Subject: [PATCH] Update README and move Android-specific scripts into a subdirectory --- README.md | 40 +++++++++++++------ .../android-certificate-unpinning.js | 0 .../android-fallback-script.js | 0 .../android-proxy-override.js | 0 .../android-system-certificate-injection.js | 0 5 files changed, 28 insertions(+), 12 deletions(-) rename android-certificate-unpinning.js => android/android-certificate-unpinning.js (100%) rename android-fallback-script.js => android/android-fallback-script.js (100%) rename android-proxy-override.js => android/android-proxy-override.js (100%) rename android-system-certificate-injection.js => android/android-system-certificate-injection.js (100%) diff --git a/README.md b/README.md index d414208..739600d 100644 --- a/README.md +++ b/README.md @@ -2,20 +2,36 @@ > _Part of [HTTP Toolkit](https://httptoolkit.com/android): powerful tools for building, testing & debugging HTTP(S)_ -This repo contains a selection of Frida scripts that can be used independently, or as a set for interception of HTTP(S) traffic on Android & iOS. +This repo contains a set of Frida scripts designed to do everything required for fully automated HTTPS MitM interception on mobile devices. -The scripts are: +They can be used all together, to handle interception, manage certificate trust & disabling certificate pinning & transparency checks, for MitM interception of HTTP(S) traffic on Android (iOS coming soon!), or they can be used and tweaked independently to hook just specific features. -## `android-proxy-override.js` +The scripts can automatically handle: -A script to override the proxy configuration of a target application, allowing capture of HTTP traffic without changing device settings, using a VPN, or any other techniques. +* Redirection of traffic to an HTTP(S) proxy - modifying both system settings & directly redirecting all socket connections +* Injecting a given CA certificate into the system trust stores +* Disabling all known certificate pinning tools +* Fallback detection of remaining pinning failures, to provide auth-patching of obfuscated certificate pinning (in fully obfuscated apps, the first request may fail, but this will trigger additional patching so that all subsequent requests work correctly) -Note that this only works for plain HTTP - you will also need a method to trust your CA certificate (either device-wide or using another script) if you would like to intercept HTTPS. +To get started: -## `android-certificate-unpinning.js` - -A script to defeat SSL certificate pinning in a target application, by hooking & disabling all commonly known pinning techniques. For more information and detailed setup instructions for unpinning specifically, take a look at https://httptoolkit.com/blog/frida-certificate-pinning/ - ---- - -Each of these scripts can be used with [HTTP Toolkit](https://httptoolkit.com/android) or any other HTTP debugging proxies to capture traffic. +1. Start your MitM proxy (e.g. [HTTP Toolkit](https://httptoolkit.com/android/)), and set up your rooted Android device or emulator, connected to ADB. +2. Find your MitM proxy's port (e.g. 8000) and its CA certificate in PEM format (should start with `-----BEGIN CERTIFICATE-----`). +3. Open `config.js`, and add those details: + * `CERT_PEM`: your CA certificate in PEM format + * `PROXY_PORT`: the proxy's port + * `PROXY_HOST`: the address of your proxy, from the perspective of your device (or use `adb reverse tcp:$PORT tcp:$PORT` to forward the port over ADB, and use `127.0.0.1` as the host) +4. Install & start Frida on your device (e.g. download the relevant server from [github.com/frida/frida](https://github.com/frida/frida/releases/latest), extract it, `adb push` it to your device, and then run it with `adb shell`, `su`, `chmod +x /.../frida-server`, `/.../frida-server`). +5. Find the package id for the app you're interested in (for a quick test, try using [github.com/httptoolkit/android-ssl-pinning-demo](https://github.com/httptoolkit/android-ssl-pinning-demo) - the package id is `tech.httptoolkit.pinning_demo`) +6. Use Frida to launch the app you're interested in with the scripts injected (starting with `config.js`). Which scripts to use is up to you, but for Android a good command to start with is: + ```bash + frida -U \ + -l ./config.js \ + -l ./native-connect-hook.js \ + -l ./android/android-proxy-override.js \ + -l ./android/android-system-certificate-injection.js \ + -l ./android/android-certificate-unpinning.js \ + -l ./android/android-fallback-script.js \ + -f $PACKAGE_ID + ``` +7. Explore, examine & modify all the traffic you're interested in! If you have any problems, please [open an issue](https://github.com/httptoolkit/frida-android-unpinning/issues/new) and help make these scripts even better. diff --git a/android-certificate-unpinning.js b/android/android-certificate-unpinning.js similarity index 100% rename from android-certificate-unpinning.js rename to android/android-certificate-unpinning.js diff --git a/android-fallback-script.js b/android/android-fallback-script.js similarity index 100% rename from android-fallback-script.js rename to android/android-fallback-script.js diff --git a/android-proxy-override.js b/android/android-proxy-override.js similarity index 100% rename from android-proxy-override.js rename to android/android-proxy-override.js diff --git a/android-system-certificate-injection.js b/android/android-system-certificate-injection.js similarity index 100% rename from android-system-certificate-injection.js rename to android/android-system-certificate-injection.js