Reverse engineeringįor this part of the exercise we will do some very basic and standard Android application reverse engineering. Our next steps will be to reverse engineer the application, find and understand the pinning mechanism, and – obviously – bypass it. We now have more than enough evidence to infer that certificate pinning is in place. The screenshot above highlights that the certificate shown is for and that it has been signed by PortSwigger CA – Burp Suite’s CA.Īs seen in the screenshot above, the application halts the TLS handshake as soon as it receives the Server Hello message, and then closes the TCP connection. Our proxy responds with a Server Hello message. For this, we’ll be firing up Wireshark:Īs we can see in the screenshot above, the application opens a TCP connection with our HTTP proxy, and then starts the TLS handshake with a Client Hello message.

Let us have a deeper look at what is happening just to be sure. If we look into our Burp Suite’s Alerts tab we can find a little more detail about the problem we are facing:Īssuming we want to capture user credentials, of particular interest is the highlighted alert, where the TLS negotiation fails for :443 – Snapchat’s authentication server.īy now, there is very good indication that certificate pinning is in place. If we opened Snapchat and tried to login, we would see the following error message:Īs we can see, some sort of error occurred when the application tried to connect to Snapchat’s server. Naturally, we ensure that the relevant root CA certificate is installed on our device to perform HTTPS interception. We’ll be running an HTTP proxy on our test machine – in this instance we will be using Burp Suite – and setup the proxy settings on our test device with Snapchat installed.

Let’s assume the common scenario where we want to intercept the HTTP(S) traffic of an Android application – in this case Snapchat. In this article, we will be looking into how we can leverage the lack of strong binary protections (as well as complete lack of runtime protections) to bypass, with relative ease, the certificate pinning mechanism in Snapchat’s latest release for Android – version 10.19.5.0 at the time of writing. We have recently published an article discussing the basics of certificate pinning – TLS Certificate Pinning 101. Using Frida to Bypass Snapchat’s Certificate Pinning

Wireshark android snapchat