Geek Answers Handbook

Sniffing Android app HTTPS traffic from Fiddler fails using only Tunnel To entries in Fiddler

I am trying to capture HTTPS traffic from my Android root device (4.4.4) in order to parse the undocumented application protocol. I installed my Fiddler as a proxy and enabled HTTPS. I installed the generated Fiddler root certificate on my device. I configured my proxy server for my Wi-Fi on my Android device.

  • When I launch my browser and go to any HTTP or HTTPS site, Fiddler can successfully capture traffic.

  • When I run some applications (for example, my own application that uses Parse as its backend), I can see all the HTTPS traffic on the servers decrypted. So far so good.

  • When I try to run this application, I cannot get Fiddler to capture its traffic. Here is all I get from Fiddler:

enter image description here

The URLs are some IP addresses: SSL (: 443).

I also tried using ProxyDroid. Interestingly, I was able to capture traffic once, saw a decrypted HTTPS connection with these application servers, but after that it was never captured again. I know the application uses HTTPS and not an unknown / different protocol.

How can I capture HTTPS traffic successfully, and why does Fiddler once work for this application and suddenly stop working?

+5
source share
2 answers

It seems to apply to this application. I successfully sniffed all the other applications. This particular application probably uses SSL binding: it validates the certificate internally and does not allow fake certificates, even if the device trusts it.

+1
source

For everyone who is faced with a problem ...

Fiddler has stopped processing https traffic on both machine browsers and the device. After reinstalling / restoring Fiddler certificates, my machine browser starts working with https again, but the device remains broken.

In order for the device to work again, I had to explicitly trust the new certificate on the device, using the device’s browser to open the site http://<adapter IP>:8888/FiddlerRoot.cer , and then trusting the certificate.

I found this answer here .

0
source

More articles:


All Articles