0

I am attempting to check our Android app's SSL Certificate Validation.

I have MITM Proxy running on my Mac and am using the Mac as a Proxy for my Android phone. I can see all of the Android's http/s requests in MITM Proxy on the Mac.

Looking at the CERT Tapioca intro (http://www.cert.org/blogs/certcc/post.cfm?EntryID=203) it says, near the bottom of the page:

As I mentioned previously, if you ever see an https:// URL in mitmproxy, you're either dealing with an application that fails to validate SSL certificate chains or you have manually accepted the invalid certificate. We can easily check for this programmatically:

grep "scheme,5:https" ~/logs/flows.log

This command determines whether the client successfully sent or retrieved data through the HTTPS connection.

Can someone explain how this command "determines whether the client successfully sent or retrieved data through the HTTPS connection" ? As far as I can tell, that command only finds instances of "scheme,5:https" in the log file... but how do I then use that information to understand what is going on?

3
  • 1
    The command does indeed only find instance of the string in the log file. The key is that string only shows up in the log file if you were using HTTPS as the protocol, and you could only use HTTPS as the communication protocol if the application doesn't validate SSL cert chains, or you manually accepted the invalid cert, since the cert provided by mitmproxy is certainly not the valid cert for the site.
    – ssnobody
    Oct 2 '14 at 18:43
  • So, if I remove the MITMProxy CA from my Android and I am still getting calls with https, then that means the certificate is not being properly validated. Correct?
    – Chris
    Oct 2 '14 at 18:52
  • 1
    That is correct, it means that someone could provide a cert that does not have a valid chain to an installed trusted root and the app in question is still accepting that cert and using it to communicate.
    – ssnobody
    Oct 2 '14 at 18:54
0

You can interact with the mitmproxy terminal window to see what is going on. You can use your eyeballs to look for URIs that begin with "https://" if you perfer. But grep seems less prone to mistake.

Any time there's an https URI there, that means that the app has successfully sent or received data over an HTTPS connection with an invalid SSL chain. That either happened because it just accepted the invalid certificate, or because it warned you and you proceeded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.