mitmproxy.org

Mitmproxy - An interactive console program that allows traffic flows to be intercepted, inspected, modified and replayed.

1. mitmproxy.org An interactive console program that allows traffic flows to be intercepted, inspected, modified and replayed. -Vishal Vyas

2. Me? Into mobile application development for 6 years Developed mobile advertising SDKs (Android and iOS)

3. Me? Working with a Startup from past 6 months Developed mobile advertising SDKs (Android and iOS) and I am NOT a HACKER :?

4. A basic mobile application Web Server Web Services Database Mobile Device Local Database (cached data) Application PLAIN TEXT, JSON, XML ...

5. Man in the Middle Attack?

6. What is mitmproxy? Web Server Web Services Database Mobile Device Local Database Application My Laptop running MITMproxy

7. An SSL-capable man-in-the-middle proxy Generic pentest/debug tool Interactive, console based intercept & modify Extensible – invoke Python modules What is mitmproxy?

8. How to … ? MITMproxy is not an attack tool! Configure it as a proxy Import the CA Root cert Run as interactive console app Or 'mitmdump' - Think tcpdump for HTTP

9. To get started Install pip install mitmproxy See the installation instructions for more

10. Start MITM proxy vishal@vishal:~$ sudo mitmproxy -b 192.168.1.108 -p 8080 --no-upstream-cert -b ADDR, --bind-address ADDR Address to bind proxy to -p PORT, --port PORT Proxy service port --no-upstream-cert Don't connect to upstream server to look up certificate details

11. Configure Proxy

12. Configure Proxy Proxy Settings To automate this step BUT! No support for Android Marshmallow

13. Download and Add Certificate Custom SSL certificate that allows mitmproxy to decrypt the HTTPS traffic.

14. Start monitoring your traffic

15. 3G/4G connections? :(

16. 3G/4G connections? :( BUT! You still can use your nifty hotspot feature! What you need is: a device with a 3G/4G connection the development device your laptop

17. How we used mitmproxy for QA testing? For mobile operator targeting Spoofing operator name(s) in the HTTP request to check if server response

18. Any Alternatives? Charles (Paid) Fiddler

19. www.hashbinary.com HashBinary Software Development Services Company Mobile Application Development Consulting

20. Thank You! Slides https://goo.gl/ TJHQ4I References https://medium.com/@rotxed/how-to-debug-http-s-traffic-on-android-7fbe5d2a34#.ozotqeton https://www.owasp.org/images/7/73/SlayingDragons-ccbysa30nz.pdf https://github.com/mitmproxy/mitmproxy/tree/master/examples Have any questions? Email : [email protected] Twitter : @veshalvyas