Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2562 Thanks!
[Music]
yeah but we talk in English English
sorry good morning morning on day three
on the milway stage I hope you all had a
good sleep and now uh we do the program
also as announced in English and not in
German so hopefully everybody is very
happy uh with me is a first speaker
ratso and he will talk about read and
manipulate Network traffic on Android
with M proxy give him a warm welcome and
enjoy the
talk
yeah okay so thank you for the warm
welcome and as the title already
suggests I want to talk about four
things first of all I want to tell you a
bit what mid androxy the tool itself is
afterwards I want to give you some
examples on how to read Network traffic
with mitt and proxy then I want to give
you a brief introduction how to set it
up with Android and afterwards we see
more interesting examples on how to
manipulate Network traffic with mitt
proxy so first of all what is Mitt proxy
proy so they defi Define themselves as a
free and open source interactive htps
proxy under the MIT license uh it was
created by Aldo cortesi maximilan Hills
and Thomas Kish BMA in
2010 and yeah M proxy of course the MIM
stand for men in the mle H men in the
middle so uh you can use it to intercept
Network traffic between a server and a
client and as the name of the talk
already suggests it's about Mitten proxy
and Android so of course there are other
tools uh like Charles or burbu but uh I
like the terminal more and M proxy is
like mostly based on the terminal so
this is why I like M proxy and it also
seems like that you can uh set up mitt
and proxy with iOS however I have never
tried it there's also a uh like
tutorials online where it worked with
iOS 15 which is last year's iOS it seems
there are errors with iOS 16 I I can't
say anything about this you have to try
this yourself and maybe as a small
motivation why do I even want to talk
about mid and proxy there were two 3C
Talks by christofer Weatherhead and
others at 35 cc3 and 36 C3 and there
they intercepted different apps and
looked
whether um how they interact with
Facebook SDK in one talk and the other
they talked at menstruation apps for
women and checked how they sent private
data
to um
to uh networks where you don't or to
companies which you rather don't want to
have your private data and this talk
here should be like a more Hands-On
approach on how to actually use Mitten
proxy to do the same thing uh so yeah
this is what I want to talk about so
first of all as a small introduction we
will just see how mm proxy uh works so
as examples here I pre-recorded some
videos um on the right we will always
have a an Android phone and in the left
we have the terminal with mid proxy and
we will intercept the traffic of this uh
Network so now we open mid
proxy and now we open our small uh
sample app so on the right you see the
Android app uh which is just a button
which downloads text and will display
this text in the text view above so the
default default will change to hello
world in a
second uh so okay and now you can see
when we when we press the button then we
can see on the left we get the flows so
a flow is basically a request response
pair and when we now press on the flow
we can uh open it see what actually
happened there so in the for the request
we see there are headers uh or we can
see all of the headers which were sent
in the response tab we can see uh all of
the response headers and the decoded
body and there are even more details
like the time stamp the algorithms used
for encryption and so
on so uh this is basically what you this
is like the very basics of mid proxy so
you can uh see all of the data and then
again with Q you can uh close all uh
close this program again and yeah that's
the basics so now we want to have a
small a first small example which is
actually already kind of
powerful so we want to
um convert one of these requests inside
a call script which you can use then not
on your Android device but rather on
your uh computer to execute the same API
which can be already really powerful if
you have for example an API which you
can normally only access through an app
with M proxy you can export these
requests to a cur script and can use it
for your own automation on your
laptop so uh when you just press e on
one of these requests you get the small
I just
go back a bit here you can see the small
uh window where you can just select one
of these uh formats and we want to use
Curl
here then down below a small um a small
window will open where you just type in
the the name of the script you want to
save it
in um and now we we um stored this in
mm1 Dosh and if we now close mm proxy
and look inside the script we will see
we get basically the request of mid and
proxy as a curl script with all of the
headers
and the URL and if we now uh just
execute the script from our PC we see we
get the same response this hello world
text uh without using the app and as
already mentioned this can be helpful if
if you want to access some API which you
normally can only access through an
app okay so now that we have already
seen some interesting ex examples I just
want to give you a brief introduction
how to set up uh m proxy with Android I
don't want to go through all of these
steps you can do this at home or after
the talk I just want to give you some
interesting considerations here so all
of this is based on a GitHub comment
inside the mm proxy
repository and what what we basically
want is uh what we basically do is we
set up an Android emulator on a Unix
like machine like Mac OS or Linux with
mm proxy and the reason we use an
emulator is because Android made it uh
rather difficult with Android 9 to
install a root certificate so maybe as a
brief so what we basically have to do to
set it up is we have to introd we have
to install the mm proxy certificate as a
root Authority on our Android
smartphone and uh Google made it rather
hard to install such certificates with
Android 9 and
onwards and furthermore it's also
difficult to install such a certificate
if you have go play on your device this
is why we use or the easiest way to set
up M and proxy with Android is to use an
emulator with an old Android
version and also without Google Play So
at one point if you set up the emulator
it should look you have a window where
you can select all of the sdks and here
you should use like an old Android
version without Google and of course you
can always Sid load apks which you use
like apps through the terminal
and once you have this emulator you just
execute all of these commands over here
which which basically just uh copy the
certificate from mm proxy onto the
emulator and afterwards each time you
want to start the emulator you execute
this one line down below here which just
opens the emulator with the correct Port
so that mitt and proxy can
connect okay so now that we have briefly
talked about how to set everything up I
want to H give more examples on how
to uh yeah do stuff with Mitten and
proxy and now we want to manipulate data
so what we want to do next is instead of
um showing hello world here we want to
change the text to hello Camp without
changing the server nor the app and this
is where mid and proxy is handy because
it can intercept the traffic pause it
then you can edit it
and then um you can just uh ex or we can
display the different
text okay so now if you press on the
button you will see we just normally get
hello
world and now if you press I we can
create our own interception filter so
down below here you can now see we we uh
installed one till the b. hello which
basically says pause all of the requests
and responses which
contain uh the string hello inside the
body and if you now uh execute or click
the button again we will see uh the next
flow is paused or intercepted you can
see it's uh it's red instead of
green and if you now uh if we now just
open this flow you can we can already
see in the header here here it's now not
response but response intercepted and if
you open this tab and press uh e we can
edit this response as we like we want to
change the response body and we want to
change it from Hello World to hello
camp and when we now press a so we
changed it now we press a on this flow
again and we can see we get now the text
hello Camp instead of hello
world and if we press I again we can
remove the
filter and if we now press the button
again nothing is intercepted we will
just get the text as usual or the normal
text from the
server okay and here I also want to give
you a small detour if you don't like the
terminal as much as I do there are also
different front ends for mm proxy
there's also one called mum web you just
execute it the same way as M proxy
before and if you now open our app and
click on the button we can afterwards
change to the browser that's a bit small
I'm sorry but uh we basically have the
same data as before uh we can just click
on our flows and then we get uh request
response data uh so if you if you like
the mouse more or want to
um want to uh do everything inside your
browser you can also use mm web and
basically achieve the same thing and
like the m and proxy front end and also
the mm web front end are both
interactive so you change the data on
the
Fly and yeah you can fiddle around with
it while it's coming but once you get
the hang of it and actually know what
you want to do you can also use mm dump
where you can just write a a small
python script beforehand and can you can
intercept data with this automatically
without uh doing it interactively while
you're work or while the data comes in
so just as a small example here I
created or I I wrote a small python
script which uh takes
responses and we basically do the same
thing as before so if the content of the
response so the body contains the word
hello we print a small uh print log with
intercepted so that we know that
something
changed and afterwards we changed the
content from uh we change it to hello
camp we also have to append the B here
because content is not a string but a
bite array and the B will convert it for
us but this is like
technicalities and if you now execute
this small python script with mm dump
minus s and the script and just as usual
open our app and click on our button we
will see we get these intercepted
messages and always see Hello cemp
because because this interception H
script will always execute because all
of these bodies contain the world hello
and it will always change the text to
hello
Camp um yeah
exactly and this was already everything
I wanted to show you just as a uh as a
small recap so we looked on how
to uh intercept Network traffic with mid
and proxy on Android we saw the three
different front ends we saw the
terminal uh interactive one which is MM
proxy then we saw the interactive
browser one which is MM web and we saw
the non- interactive terminal based one
which is MM dump we also uh looked a bit
on how to set up oops sorry how to set
up mitt and proxy with an Android
emulator and if you want to learn even
more about this if I if this talk
started interest um of you to
and to learn a bit more about man in
the- Middle stuff and midm proxy in
itself there is this wonderful
documentation of mid proxy at this
URL and I this is basically also the
source where I everything got from and
mid and proc is also a very cool tool
because it regularly gets new features
so they also already have like a mode
where you can intercept HTTP 3
traffic or there's also a way now still
in beta in beta where you
can um where you can connect mitt and
proxy within device by using wire guard
so through a
VPN which probably makes everything much
easier and you don't have to do the
hassle of setting up an emulator but
it's still in a better but it looks
really nice because you just have to
scan a QR code and then it should be set
up but but I haven't tried it out now so
there's only one thing left to tell you
which is uh thank you thank you for your
attention and we can go on with the
questions from your
[Applause]
side and are there any
questions so does this wire thing wire
guard thing in beta also works with HTTP
3 because we still need the certificate
somehow
um I'm not completely sure as I said I
only looked like at samples because it's
right now it's a bit tricky to mes to to
set everything up but like you have to
enable HTTP 3 uh as its own flag and
there's also like this wire guard flag
I'm not 100% sure if they work together
but at least I haven't found anything
that does not work together so you can
try it out maybe it works I'm also not
completely sure which magic happens
below like this all of this QR code wire
card set up um I guess there will be
more documentation on this when it when
it's when it's
released is is this okay
okay are there further
questions or from the internet
okay the internet is still sleeping one
question
sorry um what about um certificate
pinning will it uh somehow destroy all
the um possibilities you have to to
intercept and that can be done within uh
an app so if an app uses uh certificate
pinning then you just see the encrypted
traffic yes so if you if you as an app
developer enable certif are you disable
H so when you do certificate pinning you
basically
uh you cannot use Mitten and proxy
anymore that's true but
yeah hi thank
you um the question I have is related
to replaying uh Network traffic
so in a let's say a regular application
there's um timeouts retry requests
Etc how does that work with mid and
proxy in the sense that let's say you
intercept a request then it gets paused
but eventually the OS will just say well
this doesn't come back I'm just going to
cancel it y so of course you have to
work against the time
out um the of when you do it
interactively of course you have to
hurry up a bit uh but as you saw with mm
dump so if you do this program
programmatically it's it's basically
instan instantaneously so there
shouldn't be any problems with the
timeout but of course you shouldn't just
intercept the request then grab a coffee
and do your stuff afterwards so yeah
then you get can get into trouble
yeah so we reached the end of our time
therefore as suggest we thank our
speaker again
and thank
you