0

Hi i like to track all the get requests of a website i browse.

lets assume im using an app in that app there is a WebView that leads to a website. the website is doing get requests. the website has SSL pinning. i like to know what are those get requests that the website is doing.

During a google research I found that Frida help me bypass the SSL pinning However, Frida must be used on Rooted devices. I need for not rooted devices. It comes to my attention that Frida-Gadget can do that for me.

is there any explicit guide to do so?

my goal is simple to go to a SSL website using my phone and track all the "get" request that the website is doing.

Thank you !

Ben Behor
  • 21
  • 4
  • You can use BurpSuit for that https://portswigger.net/burp – a0x2 Mar 18 '20 at 12:56
  • @Ben SSL pinning for an Android WebView is pretty complicated AFAIR, have you checked the [Android network Security XML config](https://developer.android.com/training/articles/security-config) if it defines the pinning. If yes you could try to modify the file and resign the app (the latter would also be necessary for injecting the Frida Gadget). Add in the Frida Gadget is described, e.g. [here](https://koz.io/using-frida-on-android-without-root/). – Robert Mar 18 '20 at 14:47
  • @a2en: Burp is useless for an unrooted device as you can't install the root CA certificate so that the apps trust burp. Additionally Ben noted that the app performs cert pinning. – Robert Mar 18 '20 at 14:48
  • Using Frida gadget means repackaging the APK file. Since you already gonna do that, you may first try something simpler: https://stackoverflow.com/a/55165555/5931191 (if that doesn't work for you - comment here and I'll help with a Frida set up) בהצלחה – Arseny Levin Mar 19 '20 at 10:31
  • Thanks guys, it seem like it could work however it is not my goal. Lets try something else: Let's assume that i have an app that runs on the background of my mobile. I like the app to track the get requests of SSL websites when im surfing chrome. - no root device – Ben Behor Mar 23 '20 at 11:11

0 Answers0