2

I am actually trying to debug all the traffic going in and out on my phone. I am using Fiddler on my PC, and ProxyDroid on my phone to do this. HTTP traffic works fine. I am able to decrypt it completely. However, with HTTPS traffic, all I get is "Tunnel to : xxx.xxx.xx.xxx:443 ". Any idea how do I decrypt the traffic going through the HTTPS route?

I installed the FiddlerRoot.cer on my phone through the default browser. Still no luck on decrypting the HTTPS traffic.

P.S : I am talking about traffic from apps, and not through the browser. My Phone is running ICS and is rooted.

  • 3
    Humm... I always thought the "S" in "HTTPS" stands for "secure". So the idea behind that is that you should not be able to easily decrypt it -- it is encrypted for good reason. – Izzy Feb 11 '13 at 14:23
  • 1
    HTTPS is for protecting against a man in the middle attack... which is what it sounds like you're trying to do. See: en.wikipedia.org/wiki/Man-in-the-middle_attack and stackoverflow.com/questions/2888884/… and stackoverflow.com/questions/3075489/… etc – Bryan Denny Feb 11 '13 at 15:00
  • Yes, I am exactly trying to do that. Using Fiddler, we can decrypt the HTTPS traffic. Read here --> fiddler2.com/fiddler/help/httpsdecryption.asp . Its easy to do this for browsers on the pc or phones etc. But I am trying to accomplish this for an App on my phone. – Ubaid Feb 12 '13 at 7:43
  • if the application is using custom trusted server certeficates , then no , you have to decompile the apk , crack it (disable that custom trust) then recompile it .. if the source is smali , search for "SecureRandom" on all smali files whene u find that word , u will find ur friend :D – K3rnel31 Dec 3 '15 at 16:33
1

I ran into the same issue. First - make sure you have it all set up correctly on Fiddler on your PC:

  1. Goto Tools-->Fiddler Options-->HTTPS and make sure the first 3 check boxes are checked.
  2. Click "Export Root Certificate to Desktop" and copy the cert file from your desktop to your device/SD card
  3. In your device, goto setting-> security -> Credential Storage-> Install from SD Card , and install your certificate.

That's it. worked for me :)

  • Not sure why it didn't work for me, but after another try I installed the fiddler root cert from Fiddle Echo Service page ipv4.fiddler:8888 (as described in docs docs.telerik.com/fiddler/Configure-Fiddler/Tasks/…) and HTTPS traffic is decoded OK – Mixaz Mar 15 '16 at 17:10
  • Starting with Android 7.0/Nougat intercepting SSL traffic has become more complicated because the Android apps don't trust the installed additional system certificates unless the app developer explicitly has configured the app to do so. – Robert Dec 23 '18 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.