Hacker News Reader

Comment by 2h | Hacker News Reader

I wonder if you can use a proxy with this, I would like to run this through MITM Proxy to see the requests made by different Android apps. Current I am using Android Studio or GenyMotion

View on HN

If it works at all like WSL, you might want to look at wsl-vpnkit.

https://github.com/sakai135/wsl-vpnkit

It's not a proxy, but would give some idea how to shim into the middle.

Uses gvisor-tap-vsock underneath: https://github.com/containers/gvisor-tap-vsock

Unless you found a way to break HTTPS, that won't do. Android uses certificate pinning, and any MITM attempt (such as running through a proxy) won't even send the requests through.

No, Android doesn't. Some apps do. And in many cases, the pinning code can be removed in real time with Frida. Please don't spread misinformation.

Android apps do not trust anything out of the system default CA since Android 7.0, which is "light" pinning. https://android-developers.googleblog.com/2016/07/changes-to.... Additionally, certificate pinning can be done in multiple ways, and your Frida bypass will not do anything in the case of a simple reimplementation of pinning for OkHttp means you now have to find also that code (which has most likely been proguarded and obfuscated) to replace.

The only ways your certificate works are:

* Your self signed certificates are marked as trusted in the app manifest (which, since it isn't your app, you have to rebuild an APK to modify the network_security_config)

* There's a leftover "accept everything" in the manifest, and that can only work with debug builds.

* You ran it through apktool/equivalent to insert a permissive network_security_config (which only has this ability since 2022, but other scripts have existed before).

Running it through Frida for that purpose is needlessly overkill.

Please know your shit.

you missed the step, where you can just install a certificate to

    /system/etc/security/cacerts

which unlocks most current Android apps. so maybe learn your own tactics, before commenting further.

The system volume on WSA is a static image and can’t be mounted as readwrite the last time I checked. You pretty much have to use something like MagiskTrustUserCerts.

> can’t be mounted as readwrite

yeah it can. you just mount it as tmpfs.

Reply on news.ycombinator.com