NVISOsecurity / disable-flutter-tls-verification

A Frida script that disables Flutter's TLS verification
310 stars 52 forks source link

Off Topic/Help: Unable to intercept requests of a Java mobile game #33

Closed delasy closed 1 week ago

delasy commented 1 week ago

I'm trying to intercept requests of iOS mobile game specifically this one. on Android emulator I have no problem intercepting, but when it comes to iOS I use Burp + NoPE on a palera1n jailbroken iPhone with Frida and objection ios sslpinning disable and I still can't intercept the needed request, specifically I want to intercept api dot gamepromo dot io . I disassembled the application, found that it actually doing this request but in Burp it doesn't show. the only thing that shows is the error message in log "The client failed to negotiate a TLS connection to {host}:443: Remote host terminated the handshake" (and I have all the certificates installed and trusted :).

What I tried:

  1. Burp + NoPE
  2. Reqable (doesn't show at all)
  3. Proxyman (doesn't show at all)
  4. HTTP Toolkit (aborted connection to X)
  5. https://codeshare.frida.re/@thedauntless/disable-flutter-tls-v1/
  6. https://codeshare.frida.re/@federicodotta/ios13-pinning-bypass/
  7. https://codeshare.frida.re/@snooze6/ios-pinning-disable/
  8. https://codeshare.frida.re/@electrondefuser/ios-proxy-detection-bypass/
  9. objection ios sslpinning disable
  10. Tested with DVIA-v2 and I was able to intercept all NLS requests except App Transport Security.

the only thing that seems to be super strange is that on Android it's sending user-agent "Dalvik/2.1.0 (Linux; U; Android 12; ...)". From the error that I see I believe the problem could be that certificate that I'm sending to end server is rejected during handshake? I honestly have no idea what the problem is and how I could solve it.

I would appreciate any help 🙏

delasy commented 1 week ago

I tried rvictl -s and tcpdump -i rvi0 -w capture.pcap -P with https://codeshare.frida.re/@jankais3r/ios-15-tls-keylogger/ \ I got the packets but packets to this host are not decrypted for some reason (for other hosts are decrypted):

image

delasy commented 1 week ago

I found a way to intercept requests now