News for hackers. Stuff that matters.
Re:Show HN: ParrotSnoop – Android TCP/UDP Packet Capture for... by DivestTrump on Wednesday June 19, 2019 @09:27PM (#20228994)
I appreciate the traction this received. I'd like to note that I am not a developer by trade and I'm certainly not a designer. Java isn't even my primary language. I am just somebody interested in privacy and security and this was a fun project that should be useful. Any contributions to the code or design are very welcome. I hope this helps others and thank you.
Re:Show HN: ParrotSnoop – Android TCP/UDP Packet Capture for... by lozaning on Wednesday June 19, 2019 @10:21PM (#20229274)
Would this let me see the full path of an https requests that an app is making? I've got a testing need for that, and am currently hampered because our secops team won't let us enable a feature flag to disable cert pinning so that Charles proxy will work.

WOuld this be a viable alternative because it runs on the actual phone itself?

Re:Show HN: ParrotSnoop – Android TCP/UDP Packet Capture for... by h4waii on Wednesday June 19, 2019 @11:38PM (#20229639)
No, this won't bypass certificate pinning, to do that you need to tamper the app or hook runtime calls using something like Xposed. There are modules [0] [1] that do this, support depends on the version of Android you're using.

[0]. https://github.com/ac-pm/SSLUnpinning_Xposed

[0]. https://github.com/Fuzion24/JustTrustMe

Re:Show HN: ParrotSnoop – Android TCP/UDP Packet Capture for... by madushan1000 on Thursday June 20, 2019 @12:29AM (#20229889)
Use frida(frida.re) with something like objection to disable certificate pining at runtime. You gotta have a rooted phone, or you'll have to patch the apk with Frida library.
Re:Show HN: ParrotSnoop – Android TCP/UDP Packet Capture for... by pmontra on Thursday June 20, 2019 @01:23AM (#20230135)
Is there an apk to download and install? I looked for it and failed but I'm using my phone and I could have missed it.
Re:Show HN: ParrotSnoop – Android TCP/UDP Packet Capture for... by DivestTrump on Thursday June 20, 2019 @10:57AM (#20233534)
No, just the source code.