luciopaiva

Android APK HTTPS user certificates how-to

Starting with Android Nougat, Google changed the way apps handle user certificates:

Apps that target API Level 24 and above no longer trust user or admin-added CAs for secure connections, by default.

This means that certificates issued by applications like [Charles][charles] or [mitmproxy][mitmproxy] are no longer accepted, so these proxies won't work for HTTPS traffic.

This tutorial explains what needs to be done to overcome that restriction and be able to sniff any Android app's HTTPS requests.

luciopaiva

Android APK hacking how-to

Install and configure SDK

• install Android Studio (google it)

• configure your shell (considering Linux+Bash):

  export ANDROID_HOME=$HOME/Android/Sdk
  export PATH=$PATH:$ANDROID_HOME/tools
  

export PATH=$PATH:$ANDROID_HOME/platform-tools

luciopaiva

List files touched:

git diff --stat commit-1 commit-2

List change counts:

git diff --shortstat commit-1 commit-2 | cat

List authors between two commits:

luciopaiva

class FileDropZone {

    /**
     * @param {HTMLElement|String} dropZoneElement
     */
    constructor (dropZoneElement) {
        dropZoneElement = typeof dropZoneElement === "string" ? document.getElementById(dropZoneElement) : dropZoneElement;
        dropZoneElement.addEventListener("drop", this.onDrop.bind(this));
        dropZoneElement.addEventListener("dragover", event => event.preventDefault());

luciopaiva

#!/usr/bin/env node

const
    path = require("path"),
    fs = require("fs");

/**
 * List all files in a directory recursively in a synchronous fashion
 *
 * @param {String} dir

luciopaiva

function sleep(ms) {
    return new Promise(resolve => setTimeout(resolve, ms));
}

/**
 * Shows how a timer fails to execute when we block the main thread. See `setIntervalDoesNotWorkWithBlockingWait()` for
 * a solution to this.
 * @returns {void}
 */

luciopaiva

Example .ssh/config file:

# severals rules that depend on the wildcard rule at the bottom

Host foo.com
    HostName foo.com
    User foo
    IdentityFile /path/to/id-1

luciopaiva

Quick Guide to Flexbox

Flex container

display: flex;
flex-direction: row | column;
/* main axis alignment: */
justify-content: flex-start | flex-end | center | space-between | space-around | space-evenly;
/* cross axis alignment: */

align-items: flex-start | flex-end | center | baseline | stretch;

luciopaiva

/**
 * Asynchronously sleep for the specified amount of time.
 * @param {Number} millis
 * @return {Promise}
 */
function sleep(millis) {
    return new Promise(resolve => setTimeout(resolve, millis));
}

luciopaiva

async function getJson(url) {
    return JSON.parse(await getFile(url));
}

async function getFile(url) {
    return new Promise((resolve, reject) => {
        const request = new XMLHttpRequest();
        request.addEventListener("load", function () {
            try {
                resolve(this.responseText);