search

fkie-cad / friTap

The goal of this project is to help researchers to analyze traffic encapsulated in SSL or TLS.
GNU General Public License v3.0
268 stars 28 forks source link

No packets captured #10

Closed moha-abdi closed 7 months ago

moha-abdi commented 1 year ago

Hello, I have already seen an issue like this, but none of the soultions worked for me. I am on IOS 16.0, and I am also using Windows. I have tested it with more than 10 applications, and all the packets were empty. I will leave some screenshots below.

image

All the packets as in the below screenshot were 24 bytes or empty. I dont knw if the issue is specific to me or not, bt I will try and find a solution.

image

moha-abdi commented 1 year ago

I think friTap doesnt fully suppot IOS 15 and 16, because in OpenSSL_BoringSSL_iOS class, the offset is outdated for IOS 15 and for IOS 16 aswell. For my IOS 16 after I modified the offset to 0x300 I can now see TLS keys, but I think it still needs some updates.

monkeywave commented 1 year ago

Hi,

yes you are right the support for iOS is currently really "bad" and only consider iOS <= 14. Furthermore only the TLS key extraction is supported for this iOS version. Do you know if the offset 0x300 will also work for iOS 15?

Currently we have at first fix the issues with the new Android version. Than we want to focus finally on iOS to improve there the capability of friTap :-)

monkeywave commented 7 months ago

This issue is now solved with some newer iOS versions (till iOS 17) but only the capability to log the TLS keys. Regarding the feature to write only the plaintext into a PCAP further research is still needed.