The ssl_pinning_remover from hexnio

ssl_pinning_remover's Introduction

Brief history

All it started with two simple questions:

How we can sniff ssl traffic in order to understand which services are invoked?

and

Is there a method to automate all the process from decompile a .apk to upload on your device?

For the first questions i found a lot of guides that explain the procedure of modify the AndroidManifest.xml and the network_security_config.xml but there is not a single formula, there are different factors to understand in order to do it correctly.

For the second question is: Yes... but.

i found different types of project the on Github but they aren't completely automated in all those phases so here we are.

I read a lot of guides most of those requires to have a rooted device so i tried to create something to sniff the encrypted traffic unrooted devices in order to help all security researchers, this software is UNSTABLE for now, a lot of "unlocked" apps maybe will not work with this mod.

How it works?

ssl_pinning_remover has all the following phases:

Unpack the .apk app with apktool
Check if the AndroidManifest.xml has the correct attributes and if network_security_config.xml exists with the correct tags
Repack the modified files in a new apk packet
Sign the new apk with a self signed certificate
Align the certified apk
it upload the new jar in the connected android device (Optional)

Prerequisites

To use this script you need to install all those softwares in your environment:

On your device:

Enable USB Debugging

How to install

$ pip install -r requirements.txt
$ pip install ssl-pinning-remover

How to use

Parameter	Description	Mandatory
`-i --input`	Used to specify the input .apk path	Yes
`-v --verbose`	Used to increase the stdout verbosity	No
`-u --upload`	Used to specify if you want upload the "unlocked" apk in the connected device or not	No

Example

Elaborate without uploading .apk:

ssl_pinning_remover -i test.apk -v

Elaborate and upload .apk:

ssl_pinning_remover -i test.apk -v -u

The output path is the path where you launch the script. The modified apk will have the same name of the original apk but before the extension will be added ".unlocked.apk"

ToDo List

frida-gadget implemetation
Continue implementing studying difference configuration cases
Make the software working for most of the applications in the play store
Add more options
Code review

Disclaimer

This project is for educational and research purposes only. Any actions and/or activities related to the material contained on this GitHub Repository is solely your responsibility. The misuse of the information in this GitHub Repository can result in criminal charges brought against the persons in question. The author will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this GitHub Repository to break the law.

ssl_pinning_remover's People

Contributors

Stargazers

Watchers

ssl_pinning_remover's Issues

Index out of range

I am trying to run it on my macOS but getting this below error.
chmosama@Chs-Mac Desktop % ssl_pinning_remover -i world.apk -v [+] Cleaning... Traceback (most recent call last): File "/Library/Frameworks/Python.framework/Versions/3.7/bin/ssl_pinning_remover", line 8, in <module> sys.exit(main()) File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/ssl_pinning_remover/ssl_pinning_remover.py", line 64, in main unlock_apk(args.input, args.upload) File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/ssl_pinning_remover/ssl_pinning_remover.py", line 13, in unlock_apk output_folder = core.unpack_jar(input_path) File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/ssl_pinning_remover/core/core.py", line 37, in unpack_jar output_dir = input_path.rsplit('/',1)[1].rsplit('.', 1)[0] IndexError: list index out of range

Plss Fix this issue!

input ssl_pinning_remover -i test.apk -v
output output_dir = input_path.rsplit('/',1)[1].rsplit('.', 1)[0] IndexError: list index out of range

after setup there are some errors

So when i am trying to run
ssl_pinning_remover -i test.apk -v
this will show as output
Traceback (most recent call last): File "c:\users\----------\appdata\local\programs\python\python38-32\lib\runpy.py", line 194, in _run_module_as_main return _run_code(code, main_globals, None, File "c:\users\----------\appdata\local\programs\python\python38-32\lib\runpy.py", line 87, in _run_code exec(code, run_globals) File "C:\Users\----------\AppData\Local\Programs\Python\Python38-32\Scripts\ssl_pinning_remover.exe\__main__.py", line 4, in <module> File "c:\users\----------\appdata\local\programs\python\python38-32\lib\site-packages\ssl_pinning_remover\ssl_pinning_remover.py", line 5, in <module> from .core import core File "c:\users\----------\appdata\local\programs\python\python38-32\lib\site-packages\ssl_pinning_remover\core\core.py", line 4, in <module> import magic File "c:\users\----------\appdata\local\programs\python\python38-32\lib\site-packages\magic.py", line 201, in <module> raise ImportError('failed to find libmagic. Check your installation') ImportError: failed to find libmagic. Check your installation

Recommend Projects

hexnio / ssl_pinning_remover Goto Github PK