Okay, guys.
So here right now, it's getting pretty warm, but this doesn't stop us, right?
Absolutely.
So now let's dive into this.
Let's get rid of the certificate pinning.
Let's patch this away.
This is your blueprint.
If you want to deal with certificate pinning, let's go.
Okay, so here we are now at the Ubuntu VM and my fan is spinning absolutely crazy right now.
I hope this noise doesn't affect this microphone over here.
Okay.
Once again, we start with a clean setup, so let's verify this not not update yet.
So if config one interface not plugged in and let's do this right now.
There we go.
Yeah.
We have it done.
Now let's start our burp suite and establish our man in the middle connection.
Then we verify the certificate pinning is still active.
Sometimes.
Yeah, it can happen that you got rid of the certificate pinning.
This might be the case when the certificate timed out.
So this happened two or three times for me.
By taking a look at an application a few weeks later, the certificate pinning has been gone based on
the certificate error.
So let's see if we have that.
Luckily right now I guess not, but it's worth a try.
So therefore let's establish our burp suite first.
Whoops.
That's the way to study warp speed.
Okay.
Temporary project use verb defaults.
Okay.
On proxy options.
We enable our interface request handling support and visible proxy burp suite.
Done.
That's nice.
Now let's get back on our smartphones screen copy.
Okay.
I have to turn it on first.
I guess that's that's required.
Okay.
So now it's turned on.
Let's see.
Screen copy.
There we go.
Internet connection also.
That's nice, but let's verify if it's the correct by file, so otherwise we won't see it later on in
settings connected to tp-link.
Fine.
We haven't established our man in the middle setup yet, so maybe let's do a quick check if the app
still works regularly.
And now let's establish our man in the middle set up by applying our IP type rules.
Let's keep this in foreground because this yeah.
This layout is that nice that we keep it in foreground.
Okay, we need a route.
So that's the first point.
And then we need to enter the correct password.
There we go.
And now?
Now we apply our IP.
Table rule.
Table nut.
We want to add the new pre routing rule regarding to the protocol tcp destination port 80.
And we want to change the destination address to destination 1040 201 8080.
Uh, yes, that looks good.
Okay, now, also.
Four, four, four, three.
All right, and let's open the burp suite.
Put them on the left, send request dashboard error certificate, pinning that fate.
That's exactly what we want to have right now.
Not when we test in real application.
But yeah, to patch this away.
That's an good sign over here.
So certificate pinning still works.
All right.
Now, we have seen within the application how it is being done.
So if you take a look into the EBS directory, the certificate pinning hash.
I guess we have used this time.
We have used the eclipse.
So.
If you use Eclipse?
Yes, we did use Eclipse.
So let's open the Eclipse project.
We launch it.
Yes.
And it still all loops and it still opens at this point where we can see how the certificate pinning
has been implemented.
And these are now the hashes, the fingerprints of the public key of the certificate that's being pinned.
All right.
What we need to do is we need to get our burp suite certificate.
We need to get the public key.
And we also need to get out the hashes of the public key.
Then we need to decompile this application and replace these hashes with the one of our burp suite.
After this, we also need to adjust the network configuration of this file.
We could delete all the other one parts.
Deleting might cause some errors or we might do some mistakes.
Therefore, what I like to do is simply just overwriting all these hashes with the one of the burp suite.
All right.
Okay.
So the password certificate.
How can we get the public key?
We can export your certificate within proxy options.
Import export certificate.
We have already done this.
I guess.
Yes.
Yeah.
We have our perhaps with cert, but nevertheless let's do it once again.
So we click on export the AR format and then we choose our file regarding to installing it on the Android
smartphone.
We have named it CRT, but yeah, it's just in file extension and Linux doesn't care about this.
All right.
Now we've got the certificate exported.
Let's have a look.
So here we have our burp suite certificate and it's being in d r format.
The R simply transmits binary.
That's why it's being printed as data.
So if we view this file, then we can see binary data, but we can see what we can see.
So we know, okay, this is our parts.
We got our burp suite certificate.
All right?
The other file extension is Pam.
Pam simply means ASCII in form of base64 encoded text.
All right, so now the question, how can we get the public key out of this?
And the answer for this one is have a look in the cheat sheet or take a look at open, as I said.
But both came to the same conclusion.
We are using open SSL for this one.
So open SSL, then we want to work with the certificate.
Therefore we need to provide the x 509 parameter and then we have an cert in which is the burp suite
and the inform.
It's the URL.
So that almost is not okay.
That's not binary form.
We want to get out the public key and therefore we have to provide the public key parameter.
And I guess this should work right now.
Yes, fine.
This works.
So here we have now the public key and here we have this certificate.
If you do not want to have this certificate, we can simply apply no out now we only get the public
key.
So let's clear the screen.
There we go.
Okay, nice.
Let's write this to burp, Pop.
Okay.
All we need to do right now is making a fingerprint with the RSA algorithm, knows about this public
key, and then we get back the hash.
Okay, so let's see, how can we do this open SSL, RSA, and then let's open the help.
I guess that's the best way.
So open SSL, RSA, we have input file, that's our public key.
And then we have the input form and this one is public pop in.
So expects the public key as an input.
All right.
That's exactly what we have.
And then we have an output form.
And this is the hour.
We want to have the binary form out there.
And I guess that's the first part.
Right?
Let's verify this.
Yes.
Okay.
Here, get here.
We're getting now the the arrows a key.
All righty.
Okay.
Now we need to pass this, and we need to make a hash sum over this binary content right now.
All right.
We can do this also with OpenSSL and Digest.
It's an SHA 256.
And the input is binary.
All right.
Looks good.
And all we have to do is now base64 encoding this output.
There we go.
This is our public key fingerprint in base64 encoded format of the burp suite certificate.
Nice.
So this one over here, I clear the screen.
This is our command.
Okay.
Now, let's take this value and let's go into the applications directory apps and then into cert challenge
pinning hash this way.
And now.
Now we need to use the APK tool because we want to patch this in smiley.
And yeah, we also need to adjust the XML config.
Therefore the resources also needs to be recompiled.
So apk tool d certificate pinning hash dot apk.
Oh, okay.
Yeah.
The directory already exists so we can provide a new directory and yeah, that's exactly what we want
to do.
So epic tool.
Let's see, dash, dash.
Help in this one dash.
All because we do not want to overwrite our existing Eclipse project.
If you want to reverse engineer later on, so let's simply name this out.
Now the output gets they compiled into the old directory.
Okay.
So within out we have know our our context.
Let's have a look.
It's within a main activity, Dot.
So let's simply search for this file or let's simply open the whole smiley classes to directory with
Wizard Studio code.
I guess that's way easier.
From.
There we go.
It is within com.
And let's see.
What's the package name come up?
Hacking certificate pinning.
All right.
Com pecking.
We already got cert pinning.
So main activity dot mali.
Do we have it over here?
It doesn't look like the reason for this is we can now see main activity, dollar, network apps, money.
If you remember our amazing smiley journey over here, having a dollar sign and two class names over
here means we are having an inherited class.
So the network IP is an inherited class of the main activity class.
Yeah, that's that's what it is.
So let's see, we have here our public class main activity.
That's correct.
And now let's see here we have this inherited class.
All right.
And this is where the very code relies.
So the SHA 256 signature and this means we have to take a look into the network here, inherited class.
And this one is being referenced over here.
All right.
So maybe let's enable Java that we can see it a little bit nicer.
There we go.
Okay.
So here we have no network AP class.
We can see this one extends an awesome task and yet source file is the main activity java.
All right we have here our instance fields we've got our constructor and here we have the motha method
doing background.
And this method over here.
There we go.
These are now our three shot, 256 hashes.
So if you take a look into this one, these are.
Whoops.
Can I close this one?
Maybe not.
Doesn't matter.
So here we can see that's the method two in background.
And here we have our hashes.
So that's definitely what we have over here.
All right.
So the thing we need to do is these are being loaded into a string.
So we to also be true.
We do all we need to do is simply replacing this hash value with our hash.
That's all.
And let's get back our hash.
It wasn't here.
It was.
There.
Copy.
And now let's simply patch all three of them.
I mean, we could now figure out where it ends, I guess, if we delete this and this line.
Then we would also just have one hash over here.
But we might make mistakes, we might overwrite other registers.
Therefore, let's simply keep three of them in there and we just simply override it.
All right.
We hit ten times the safe button to make sure this file got really saved, and that's it.
And this has been now successfully patched.
Nice.
We can close it here.
We have some problem.
Now we take a look at the network security config because we also need to patch it over there.
All right.
So let's switch back to the network security config.
Therefore, let's have a look into the EPS directory.
So with an EPS certificate pinning, underscore hash, we have now our Decompile code, this output
over here.
Now the question, where can we find this network security configuration file?
And the answer for this one is having a log in the Android manifest because this file has some reference
to this config.
So let's opening this one.
And here we can see the network security config is being stored in a directory named XML.
And here we have defining.
All right, XML, that's layout directory.
So we have to take a look into the rest directory and this one over here.
Nice.
Here we have it.
So by opening this one, we can see that our network security config, if you have now an application
that does not have its own network security config, that you can also simply create this directory
within the resources over here and add this file on yourself.
But you want to have this, you will find out in just a few minutes.
But first, let's have a look into this one, this metric file that's performing all the stuff.
Okay.
So here we have this.
It's an XML file and we've got some several text domain config.
Then we've got our domain includes subdomains is being set to true and here we can see example dot com
and then we've got the pin set and here are our three hashes.
So the fingerprints of the root certificate, the intermediate certificate and also the certificate
of example dot com.
Nice.
The estimation right now is OC simply replace these hashes over here and then we are good to go.
Absolutely.
This is the the absolute valid assimilation, but unfortunately it won't work out.
The reason for this is how the Android system handles certificates.
So this has changed in the past.
And regarding two different version numbers, you might be lucky and yeah, you might have a smartphone,
but this one works.
But it's not always the case.
And this course is designed to work on the most up to date version right now.
Android 11.
And therefore let's see how we can deal with this one.
Therefore, let's have a look into this file.
So what are these texts and how can we deal with this?
How can we make it burp suite being accepted by this application over here?
Because only inserting these fingerprints are not enough.
So let's see.
So we go into Google and search simply for network security config on Android.
And here we have the official documentation.
If you have a look into this one, then we got a nice overview about what this file is capable to do.
For example, yeah, it's also named like this.
The key capabilities of this one are before you cast them trust anchors and customize which certificate
authority are trusted for an app secure connection.
All right, this sounds pretty promising and debug only overrides clear text traffic about and certificate
pinning.
Wow.
You can do a lot of stuff in here, so maybe let's have a quick look into this one.
No, not this one.
This one, for example, domain config.
If you want to navigate, you can find these tags on the right.
And here you can find now all this information regarding to the domain config.
For example, this includes subdomains.
If set to true, then this domain rule matches the domain and all subdomains, including supplements
of subdomains.
Otherwise the rule only accepts the applies to the exact matches.
All right.
That's that's pretty handy to know.
Right.
And so I guess it's a good idea if you make yourself familiar with this file later on.
For now, I just show you the most important stuff.
So let's see.
We've got also our pin set.
PIN set a set of public key pins and a secure connection to be trusted.
One of the public keys in the chain of trust must be in the set of pins.
So these are definitely the fingerprints that's being pinned.
But yeah, this doesn't help us further, right?
Absolutely.
Therefore, let's go back to the beginning of the network security config.
And here, let's see.
All right.
Here we have some different default configuration that being applied regarding to this config file.
For example, the default configuration of apps targeting Android nine and higher is as follows.
Over here we see the certificate storage only.
The system certificate storage is being accepted on Android nine and higher.
This means even if you have fingerprinting our burp suite certificate, it won't be accepted by default.
So only within the system certificate storage.
This certificate would be accepted.
And this is also the reason why the certificate pinning approach works.
For example, dot com on this application because the example dot com certificate has been signed by
this researcher and this is a known authority stored in the system storage.
Of course we can also add our burp suite certificate in there if we have route permissions, but let's
assume we do not have route permissions, so how can we deal with this?
Here we can see it's also the case for Android seven and regarding to Android six.
And there we go.
In Android six, the system and user storage will be accepted.
So what if we simply take this configuration into our network security configuration and this would
mean we get rid of the fingerprints in this conflict file in this one over here.
And our burp suite certificate, if it's being stored in the user storage, is also being accepted right
now.
So that's the solve our task.
Yes, it does.
And this is exactly the approach I'm going for all the time.
I simply add my own trust config or this one over here into this configuration file, and this simply
makes the burp being accepted.
So let's do this.
We go into this file and then we are opening it.
And now let's see.
We've got our network security config.
And if you take a look at this, here, we have a base conflict tech.
So this is one or this one is directly under the network security conflict tech.
Do we see this over here?
Yes.
So here we can see first line XML version, then next line, network security, tech, and then we have
our base config.
So what we need to replace this everything in here between this network security tech config.
Okay, maybe let's adjust this layout a little bit and that's it.
The password certificate is now being trusted by this application, but we still have the the Java pinning
approach in the source code.
We also got rid of this one.
So now this should be this should be working out.
And let's save this file also at least ten times.
And now let's build this application.
So we go into the root directory.
Over here we are opening the APK to build out.
Yes.
All right.
No error so far.
So our smiley patching might be right.
Might be not we.
We will see if we start this application.
But regarding to the syntax, it seems to work out.
But I mean, we have just patched the string.
We are now in the form of patching in whole application code.
So that's not a hard task anymore, right?
Absolutely.
So we go into the destination and now let's sign this application.
First, we need to align it and we want to create a new old APK file modification.
Successful.
Now we can use the APK signer with this key store.
Start with this key alias name, this key store and this application.
This way.
And the password is.
Change it.
Yes.
Okay.
Now, let's open the smartphone once again.
Here we have the the application.
Let's close this one.
Okay.
Let's open a new terminal.
Let's get into the smartphone.
And then.
The PM list pictures and we are prepping for cert.
This is our package name.
So we exit out and then we do.
ADB Uninstall.
Com app hacking.
Certificate pin.
Okay.
Let's observe this life on the smartphone if this one gets really uninstalled.
Okay, cool.
Now let's install our application.
There we go.
Okay, let's open the burp suite on the left.
So we can see it has made an update regarding to Google APIs.
Yeah, but so far, nothing more.
Okay, and let's open this application.
And now fingers crossed that this one works out.
There we go.
Pinning that fate.
Do we have an attack?
So what?
We can see this request over here, right?
Where's the problem?
This is now a problem regarding to the burp suite.
This is pretty unfortunate and it cost me a lot of time.
So if you take a look into the dashboard, we can see example com is using http two and you might think
yeah.
So what, what's the problem about this one?
Well, let me show you.
So if we doing a call getting the header information of example dot com, we can see.
Oh, it's using HPE 1.1, but not the HPE version.
There we go.
And this one is using HTTP two and the burp suite, for whatever reason, has problems regarding to
passing this header.
There's an option that we can enable to get rid of this.
So you can also find this information, I guess, in the ADB log if you are performing ADB Logcat.
Let's scroll up.
Yes, unexpected status line http two.
So that's not a problem regarding to our patching approach.
That's some problem regarding to the burp suite.
And that's pretty unfortunate.
But I will show you how to deal with this that you do not have to spend a lot of hours figuring this
out.
All right.
So what we need to do is we need to go into the project options and within misc not.
With an http.
Sorry.
Here we can see enable http two.
And now this makes absolutely no sense.
I know, but we need to disable it.
Okay.
And now it should work.
So by disabling http to the purpose, we can now pass this header.
I know this sounds strange, but let's have a look.
In proxy HPE S3.
I mean if you can see the request in the burbs with over here also over here, then you definitely know
your cert pinning patching approach has worked.
Probably if you still encounter errors, then it's regarding to the tools you are using.
All right, that's definitely not all right.
But we have to deal with this now.
Let's do it once again.
Send request and there we go.
We have disabled HTTP two and now the burp suite can handle it.
All right, now let's also hack this application.
Intercept on so proxy intercept intercept on the sent request.
Here we have our request.
And now we also need to fetch the responses.
Therefore, we go into options.
First intercept line responses.
We add a new one.
I'm sorry my fault intercept requests in this one over here intercept server response at.
The main name matches any.
--.
Now we have this application send request example dot com.
That's our request here we have now the response.
Nice.
Your edge connection got hacked.
Oh, I guess we had a little bit too to slow.
Certificate pinning.
What?
And let's see.
Okay.
We were too slow.
Absolutely no problem.
We simply get this response over here.
Here we can see our original response.
And if you click on this, then we can say or select edit edited response.
Okay, now we select everything in here and now we finally hack this.
I promised this to you.
Send request, we forward this one.
We replace everything in here and there we go.
Cert pinning what successfully?
So now we have hacked this application over here.
Nice, isn't it?
And that's all for this video right now.
So the key takeaways are how can we create or how can we fetch the fingerprint of the Brexit certificate,
how we can patch it in the travel side, and what's the best approach regarding to the network security
config?
So these three are my key features and I do this all the time.
So this is exactly my approach I'm doing to patch certificate pinning and I never had problems regarding
to this one.
I did patch every certificate pinning so far.
And yeah, this was this was the base over here.
Sometimes it's a little bit harder if they are using proprietary libraries so that they are performing
their own certificate pinning.
But we know how to reverse engineer an application, but we know how to reverse engineer an application.
And this one over here and also our smiley skills are that nice right now that we do not have any problems
in patching this.
All righty.
In the next section, we take a look at pinning and raw certificate.
So in whole certificate, this will be also, in short, practical video, because we have done the
theory part before.
All righty.
Okay.
If you are able to patch these two approaches, then you are able to patch, I guess, 95% or 99% of
the applications out there.
So I'm looking forward to see you in the next section.