Hacker News new | past | comments | ask | show | jobs | submit login

That is why these systems generate their own certificate that you add to your phone, so you still can see the traffic.

For MITMProxy you can visit http://mimt.it when the setup is running.

A bit more difficult with “pinned-setificate” where you have to:

1) Decompile the app (easy if you search for the online APK-download and APK-decompile tools)

2) Move the certificate out of the APK and use it for the traffic between MITMProxy/Charles and the server

3) Replace the certificate in the APK with one generated for MITMProxy/Charles, or just delete it if that works for the app (most likely not)

4) Re-compile the APK and install on your device

5) Run MITMProxy/Charles as before, just with some parameters to load the “pinned-certificate”

(There is also a lot of guides for this. Maybe not for pinned-certificate.)




1) decompile 2) remove the line that does the pinning (Easy to find) 3) recompile and sign

5 minutes




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: