edwsad
Payout Maximizer
2
MONTHS
2 2 MONTHS OF SERVICE
LEVEL 1
400 XP
I was always told to use Fiddler to sniff android traffic. I never really understood why most apps did not work with the Fiddler certificate installed, and why I could not see most traffic. I did some digging and found that most apps verify your certificate, and so to properly capture traffic you would need to make the app verify your certificate or bypass the step all together. Below I will list the steps that I took to get this working.
PLEASE NOTE: If you'd like some real explanations of how this works, this guide will not provide it. I have no idea how most of this works, or even if what I said above is accurate. All I know is that I have had good results and I would like to share them with you all.
Required
Download Objectionhttps://github.com/sensepost/objection/releases.
Download ADBhttps://developer.android.com/studio/releases/platform-tools.
Download Fiddlerhttps://www.telerik.com/download/fiddler.
Click for setup instructions forhttps://github.com/frida/frida#two-ways-to-installandhttps://github.com/sensepost/objection#installation.
REMEMBER TO ADD ALL OF THIS TO YOUR PATH. UPON RUNNING OBJECTION THE FIRST TIME YOU WILL NEED TO DOWNLOAD DEPENDENCIES AND PLACE IN YOUR PATH. THIS IS POSSIBLE ON IOS, BUT I CANNOT HELP YOU WITH THAT.
Step One
Lets set up our certificate on our android device. Start Fiddler and do the following.
Tools > Options > HTTPS
Enable the box that says Capture HTTPS Connects, and Decrypt HTTPS traffic.
Tools > Options > Connections
Enable the box that says Allow remote computers to connect.
Now over to your android device, and go to the WIFI settings. Modify the network you are currently connected to and add your computer's IPV4 as your proxy. Now make the port the one in the Connections menu of Fiddler. This is 8888 by default.
Open the browser on your android device and head to: http://ipv4.fiddler:8888/
Now you can tap FiddlerRoot Certificate and install it. Fiddler setup complete! Step Two
Download and place your APK in your chosen directory, and navigate to it in the command prompt. Type the following.
Wait for this to finish, and you have your modified APK. Install this on your android device, and connect it via USB to your computer. Enable USB debugging in the developer settings of your android device. Now run the app, and type the following in the command prompt.
Step Three
Do your thing! Make a config, or whatever you please. The success rates of this method are much higher than just installing the certificate. You are now able to capture traffic from this app with fiddler.
Note, success rates are not 100%! It's fairly rare, but I have run in to a few apps that will crash after being patched. I will help all of you to the best of my ability.
I have another guide coming if you all would like that will detail an easier process that requires a rooted phone. If you are interested, please make yourself heard
PLEASE NOTE: If you'd like some real explanations of how this works, this guide will not provide it. I have no idea how most of this works, or even if what I said above is accurate. All I know is that I have had good results and I would like to share them with you all.
Required
- The APK of the app you'd like to use.
- An android phone, an emulator may work but I have not tested.
- A charging cable for said phone.
- Frida, Objection, and ADB properly installed.
- Fiddler of course.
Download Objectionhttps://github.com/sensepost/objection/releases.
Download ADBhttps://developer.android.com/studio/releases/platform-tools.
Download Fiddlerhttps://www.telerik.com/download/fiddler.
Click for setup instructions forhttps://github.com/frida/frida#two-ways-to-installandhttps://github.com/sensepost/objection#installation.
REMEMBER TO ADD ALL OF THIS TO YOUR PATH. UPON RUNNING OBJECTION THE FIRST TIME YOU WILL NEED TO DOWNLOAD DEPENDENCIES AND PLACE IN YOUR PATH. THIS IS POSSIBLE ON IOS, BUT I CANNOT HELP YOU WITH THAT.
Step One
Lets set up our certificate on our android device. Start Fiddler and do the following.
Tools > Options > HTTPS
Enable the box that says Capture HTTPS Connects, and Decrypt HTTPS traffic.
Tools > Options > Connections
Enable the box that says Allow remote computers to connect.
Now over to your android device, and go to the WIFI settings. Modify the network you are currently connected to and add your computer's IPV4 as your proxy. Now make the port the one in the Connections menu of Fiddler. This is 8888 by default.
Open the browser on your android device and head to: http://ipv4.fiddler:8888/
Now you can tap FiddlerRoot Certificate and install it. Fiddler setup complete! Step Two
Download and place your APK in your chosen directory, and navigate to it in the command prompt. Type the following.
Code:
objection patchapk -s (PATH TO APK)
Code:
objection explore
android sslpinning disableDo your thing! Make a config, or whatever you please. The success rates of this method are much higher than just installing the certificate. You are now able to capture traffic from this app with fiddler.
Note, success rates are not 100%! It's fairly rare, but I have run in to a few apps that will crash after being patched. I will help all of you to the best of my ability.
I have another guide coming if you all would like that will detail an easier process that requires a rooted phone. If you are interested, please make yourself heard