Reverse-Engineering iOS Apps: Hacking on Lyft(realm.io)
realm.io
Reverse-Engineering iOS Apps: Hacking on Lyft
https://realm.io/news/conrad-kramer-reverse-engineering-ios-apps-lyft/
18 comments
Terminal addicts will enjoy the ncurses-based mitmproxy as an alternative to Charles.
Or maybe cheapskates, since technically you're supposed to buy Charles after a 30-day trial (which didn't attempt to enforce itself in my experience.) I like Fiddler2 on Windows, and I almost had it working well on Wine/Linux, but had some issues with SSL. I should try mitmproxy for the SSL and Fiddler for the UI, but lately I haven't needed a proxy.
I just made the switch from Charles to mitmproxy. The only issue I've found with it so far is that it seems really slow in returning responses. I'm not doing anything crazy with it either, but Charles was getting content to the device way faster.
I keep hearing rumors that Apple and Google are going to require that app developers start pinning SSL certs as a security measure to help prevent the MITM cert setup demonstrated here.
For if that happens, or just for general convenience: https://github.com/iSECPartners/ios-ssl-kill-switch
Interesting! So in that case pinning would only help against upstream attacks in actual traffic - but would still allow for reverse engineering?
Yeah, as long as you have control of the device.
That hack only works if you have root, which means you have to be jailbroken, and Apple is always trying to stop that. I keep a jailbroken device around specifically for disabling all SSL for debugging and dumping app binaries/assets.
I wish they'd just let me buy the thing rooted like Google does.
That hack only works if you have root, which means you have to be jailbroken, and Apple is always trying to stop that. I keep a jailbroken device around specifically for disabling all SSL for debugging and dumping app binaries/assets.
I wish they'd just let me buy the thing rooted like Google does.
As long as you have control of the device, you can force it to do what you want by patching the code.
He is also using a jailbroken device, which means he could see the built NSURL request and whatnot anyway.
This is actually a pretty cool talk. We're kind of lulled into thinking our Apps are super secure, he seems to take them apart fairly easy, SSH seems simple to ignore.
[deleted]
Great video, worth watching even on mobile IMO.
Are there cyript like alternative for Android?
Check out Frida (iOS and Android) http://www.frida.re/
[deleted]
Video is not working... Video is hosted with 'wistia' and the ID is 52endf5e4h, can someone stitch together a working URL? I'm on mobile
Worked fine for me on mobile (chrome on iOS)... What browser are you using?