Snapshotting memory to scrape encrypted network requests

https://blog.jonlu.ca/posts/heap-snapshot-scraping?ref=hn2

by jonluca • 5 years ago

78 8 5 years ago

blog.jonlu.ca

uniqueuid• 5 years ago

This is an awesome method. But it's not where I need it - if you have the site in your browser, you can already do most interesting things with DOM scraping or MITM (as mentioned in the article).

Now, if we had a tool to extract the DOM from a mobile device and/or from apps that use pinning, that would be MUCH more interesting.

PS yes, I know frida, but last time I looked it's basically a platform that you'd need to build all the machinery on top of.

jonluca2• 5 years ago

If your device is jailbroken you can use SSL Kill Switch 2 + Burp Suite to get past TLS pinning. It doesn't do much if the actual payload is encrypted (then you'll need to use Frida, or lldb-debugger or something else like that)

rmac• 5 years ago

last i tried none of the tools work well out of the box for the interesting cases (e.g., tiktok tls mitm on mobile)

publishers using custom http2/http3 libs, NDK obfuscators, etc all break the "auto patch" sslstrip stuff

kingcharles• 5 years ago

This is great. I've never even used that function of the devtools. I have a site I want to scrape but it encrypts the hell out of everything with a bunch of horrible obfuscated Javascript that I didn't want to reverse engineer. This should hopefully make it easier to find the values I want.

xuhu• 5 years ago

Why not get the symmetric key from process memory and then decrypt the recorded or live traffic with it ? https://www.youtube.com/watch?v=Vj_FjO6TqXg

strich• 5 years ago

Is that even open source anywhere? Seems a PoC was never released.

jonluca2• 5 years ago

That's the TLS key. It's trivial to read the "plain text" contents of the HTTP request - this is for when the contents are actually encrypted at Layer 7, the application layer, not the transport layer.

I did write up how to do it for Blind, though, here https://blog.jonlu.ca/posts/decrypting-blind

coolgeek• 5 years ago

The rise of SPAs has made this approach a bit less impractical

I think you meant "less practical", or "more impractical"

Snapshotting memory to scrape encrypted network requests

Related Stories