1

I'm looking for a way to bypass a target app using a non-system certificate. The HttpCanary app itself does give a 'solution' however it's incredibly unclear:

Goto Settings->HttpCanary root CA settings and export HttpCanary.pem, and then reverse the target app to replace the cacert file.

I feel like I've looked all over, but it seems like no one is talking about it.

I've looked into the AndroidManifest.xml of the app to find the certificates the app uses, but that just pointed me to the system and user certificates.

Next I looked into /data/data/<app>/files/ of the app which does contain a Certificates.pem file, which contains a list of different certificates, so maybe if I replace it with HttpCanary's certificate it could work?

Anyway, I'd appreciate any insight on this. If you'd prefer to discuss it in private just let me know.

Thank you for any help.

Improve this question
3
  • I think you are facing the common "How to proxy an Android app on Andorid 6+" problem. The problem is the same for all proxies, therefore my answer on SO for Fiddler should be helpful to understand the problem.
    – Robert
    Jul 3, 2022 at 10:22
  • @Robert My main device already does have canary's certificate trusted by the system and I've tried SSL unpinning on an android emulator running 7.1. None of which seemed to help. I've tried quite a few versions of android and different methods. Only one I haven't tried is decompiling the apk and editing the network security config, which I will get to later today, though I'm not too sure if that'd help despite the others not helping. Either way these methods not working is exactly why I'm confused as to where to look next. Thank you for your help <3
    – omjnst
    Jul 3, 2022 at 11:59
  • 1
    If the proxy root CA certificate is correctly installed but certain apps to not accept it those apps may use certificate pinning. You can try to modify the app small code or use Frida to modify it at run-time on rooted devices
    – Robert
    Jul 3, 2022 at 12:55

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .