approovm

Android Bypass Certificate Pinning and MitM Attack Setup

This is a gist used in the following blog posts:

• How to MitM Attack the API of an Android App
• How to Bypass Certificate Pinning with Frida on an Android App

approovm

{
	"info": {
		"_postman_id": "770bac2a-db1f-412a-870a-ea5328cdcebc",
		"name": "Approov 2 - Shapes API",
		"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
	},
	"item": [
		{
			"name": "http://localhost",
			"item": [

approovm

SECURING HTTPS WITH CERTIFICATE PINNING ON ANDROID

The blog post can be found here.

TLDR

In this article we will learn what certificate pinning is, when to use it, how to implement it in an Android app, and how it can prevent a MitM attack.

approovm

APPROOV INTEGRATION IN A JAVA SPRING STATELESS API

The blog post can be found here

TLDR

This Approov Integaration example will show us how simple it is to integrate Approov in a stateless API server using Java and the Spring framework.

We will see the requirements, dependencies and a step by step walk-through of the code necessary to implement Approov in a Java Spring stateless API.

approovm

APPROOV INTEGRATION IN A NODEJS EXPRESS API

The blog post can be found here.

TLDR

This walk-though will show us how simple it is to integrate Approov in a current API server using NodeJS and the Express framework.

We will see the requirements, dependencies and a step by step walk-through of the code necessary to implement Approov in a NodeJS Express API.

approovm

HOW TO EXTRACT AN API KEY FROM A MOBILE APP WITH STATIC BINARY ANALYSIS

You can read the blog post here.

TLDR

An API key is probably the most common method used by developers to identify what is making the request to an API server, but most developers are not aware how trivial is for a hacker or even a script kid to steal and reuse an API key for unauthorized access to their APIs.

We will see how to grab an API key by reverse engineering the binary of a mobile app in an effective and quick way with an open source tool, and once we see how easy it can be, we will realize why it is even achievable by non developers.

approovm

APPROOV INTEGRATION IN A PYTHON FLASK API

The blog post can be found here.

TLDR

This walk-though will show us how simple it is to integrate Approov in a current API server using Python and the Flask framework.

We will see the requirements, dependencies and a step by step walk-through over the code necessary to implement Approov in a Python Flask API.

approovm

WHY DOES YOUR MOBILE APP NEED AN API KEY?

The blog post can fe found here.

TLDR

Mobile apps are becoming increasingly important in the strategy of any company. As a result, companies need to release new application versions at a fast pace, and this puts developers under pressure with tight deadlines to complete and release new features very quickly.