News for hackers. Stuff that matters.

A comment on Ask HN: What do you do with your Raspberry Pi?. Parent comment

Re:Ask HN: What do you do with your Raspberry Pi? by punnerud on Tuesday June 25, 2019 @10:14AM (#20274374)
That is why these systems generate their own certificate that you add to your phone, so you still can see the traffic.

For MITMProxy you can visit http://mimt.it when the setup is running.

A bit more difficult with “pinned-setificate” where you have to:

1) Decompile the app (easy if you search for the online APK-download and APK-decompile tools)

2) Move the certificate out of the APK and use it for the traffic between MITMProxy/Charles and the server

3) Replace the certificate in the APK with one generated for MITMProxy/Charles, or just delete it if that works for the app (most likely not)

4) Re-compile the APK and install on your device

5) Run MITMProxy/Charles as before, just with some parameters to load the “pinned-certificate”

(There is also a lot of guides for this. Maybe not for pinned-certificate.)

[ Parent | on HN ]
Re:Ask HN: What do you do with your Raspberry Pi? by popotamonga on Tuesday June 25, 2019 @06:05PM (#20279519)
1) decompile 2) remove the line that does the pinning (Easy to find) 3) recompile and sign

5 minutes

[ Parent | on HN ]