Assuming the Reddit app does not use certificate pinning, you can use your computer to provide internet to your phone and then use an app like Charles Proxy to inspect requests being made from an app. Pretty easy to reverse engineer the API.
If the app does use certificate pinning, then you can use an Android phone and a modified app that removes the logic that enforces certificate pinning. This is more involved but also not impossible.
You can do this without this library. On iOS you could install an app like Charles Proxy, and install their cert to intercept traffic. Or you could proxy all traffic through your computer. Most apps does use certificate pinning today, but many still don't. I recently used this technique to reverse engineer a video streaming app
This works as long as the app does not enforce certificate pinning. But if it does, there's no way to override it and inspect what's actually going on, as I can on my desktop.
Note that while certificate pinning does make reverse-engineering harder, it's also a legitimate security feature; without it, anyone who controlled a CA (including most major governments) would be able to forge a certificate and use it to spy on users.
Certificate pinning is a hurdle to reverse engineering, but a surmountable one, at least on Android. Since the app is running on a phone where you may potentially have root, you can pick it apart with a debugger and see the traffic before it leaves the phone. This is technically challenging, but it is something that people do sometimes.
Just be ready for mitm proxying on some mobile apps to be a bust if they use certificate pinning. I’m not aware of anything that can get you past that besides patching the app itself.
Charles works by sitting between a server and a phone. It decrypts traffic from the server, displays this to the user to 'inspect', and then re-encrypts the traffic to be sent to the phone.
It re-encrypts the traffic using its own SSL certificate (technically a CA, but no need to get bogged down in details).
In many modern apps, code has been added such that an app will only accept traffic which has been encrypted by the original server certificate (ie: the Uber iOS app will only accept traffic which has been encrypted by a certificate from www.uber.com). When Charles attempts to sit between this traffic, the app will not allow network connections, and thus no traffic can be inspected by Charles.
This procedure of an app only permitting traffic encrypted by a predefined certificate is known as "certificate pinning" or "pinning" for short. It is becoming more and more common for native apps.
Would this let me see the full path of an https requests that an app is making? I've got a testing need for that, and am currently hampered because our secops team won't let us enable a feature flag to disable cert pinning so that Charles proxy will work.
WOuld this be a viable alternative because it runs on the actual phone itself?
Won't an app worth its salt use certificate pinning to prevent this mitm ? In other words - Can I use Charles to sniff FB or watsapp traffic ? I do not use both services, but interested in analyzing their traffic.
I’ve reverse engineered ssl encrypted iPhone app traffic before using Charles proxy and a self generate ssl cert to decrypt the requests. From there, you can see which endpoints are receiving what data in plain English.
I’ve only done this for apps not using certificate pinning. It gets more complicated from there.
Certificate pinning is relatively easy to disable on jailbroken iOS devices and rooted Android phones. I'm not highly technical and I did it myself to sniff Snapchat traffic 2 years ago. Any half competent security researcher should be able to do this trivially.
Most apps now use certificate pinning, i.e. they have the root certificate included in the app and signed as part of the app, so that method won't work.
On Android it's much easier to intercept and modify the behavior of apps and tell the system to disregard signatures and things of the sort.
No, this won't bypass certificate pinning, to do that you need to tamper the app or hook runtime calls using something like Xposed. There are modules [0] [1] that do this, support depends on the version of Android you're using.
Android apps could also do certificate pinning with the same effect though? In this case there isn't any difference between Android and iOS in functionality.
If the app does use certificate pinning, then you can use an Android phone and a modified app that removes the logic that enforces certificate pinning. This is more involved but also not impossible.
reply