Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am actually trying to debug all the traffic going in and out on my phone. I am using Fiddler on my PC, and ProxyDroid on my phone to do this. HTTP traffic works fine. I am able to decrypt it completely. However, with HTTPS traffic, all I get is "Tunnel to : xxx.xxx.xx.xxx:443 ". Any idea how do I decrypt the traffic going through the HTTPS route?

I installed the FiddlerRoot.cer on my phone through the default browser. Still no luck on decrypting the HTTPS traffic.

P.S : I am talking about traffic from apps, and not through the browser. My Phone is running ICS and is rooted.

share|improve this question
3  
Humm... I always thought the "S" in "HTTPS" stands for "secure". So the idea behind that is that you should not be able to easily decrypt it -- it is encrypted for good reason. – Izzy Feb 11 '13 at 14:23
1  
HTTPS is for protecting against a man in the middle attack... which is what it sounds like you're trying to do. See: en.wikipedia.org/wiki/Man-in-the-middle_attack and stackoverflow.com/questions/2888884/… and stackoverflow.com/questions/3075489/… etc – Bryan Denny Feb 11 '13 at 15:00
    
Yes, I am exactly trying to do that. Using Fiddler, we can decrypt the HTTPS traffic. Read here --> fiddler2.com/fiddler/help/httpsdecryption.asp . Its easy to do this for browsers on the pc or phones etc. But I am trying to accomplish this for an App on my phone. – Ubaid Feb 12 '13 at 7:43
    
if the application is using custom trusted server certeficates , then no , you have to decompile the apk , crack it (disable that custom trust) then recompile it .. if the source is smali , search for "SecureRandom" on all smali files whene u find that word , u will find ur friend :D – K3rnel31 Dec 3 '15 at 16:33

I ran into the same issue. First - make sure you have it all set up correctly on Fiddler on your PC:

  1. Goto Tools-->Fiddler Options-->HTTPS and make sure the first 3 check boxes are checked.
  2. Click "Export Root Certificate to Desktop" and copy the cert file from your desktop to your device/SD card
  3. In your device, goto setting-> security -> Credential Storage-> Install from SD Card , and install your certificate.

That's it. worked for me :)

share|improve this answer
    
Not sure why it didn't work for me, but after another try I installed the fiddler root cert from Fiddle Echo Service page ipv4.fiddler:8888 (as described in docs docs.telerik.com/fiddler/Configure-Fiddler/Tasks/…) and HTTPS traffic is decoded OK – Mixaz Mar 15 at 17:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.