Frida Mobile Interception Scripts

Part of HTTP Toolkit: powerful tools for building, testing & debugging HTTP(S)

This repo contains Frida scripts designed to do everything required for fully automated HTTPS MitM interception on mobile devices.

This set of scripts can be used all together, to handle interception, manage certificate trust & disable certificate pinning & transparency checks, for MitM interception of HTTP(S) traffic on Android and iOS, or they can be used and tweaked independently to hook just specific features.

The scripts can automatically handle:

• Redirection of traffic to an HTTP(S) proxy - modifying both system settings & directly redirecting all socket connections.
• Injecting a given CA certificate into the system trust stores so they're trusted in connections by default.
• Patching many (all?) known certificate pinning and certificate transparency tools, to allow interception by your CA certificate even when this is actively blocked.
• On Android, as a fallback: auto-detection of remaining pinning failures, to attempt auto-patching of obfuscated certificate pinning (in fully obfuscated apps, the first request may fail, but this will trigger additional patching so that all subsequent requests work correctly).
• Disabling many common root & jailbreak detections.
• Blocking most HTTP/3 connections (all UDP to port 443), which may be inconvenient to intercept, ensuring apps fall back to HTTP/2 or HTTP/1.

Android Getting Started Guide

1. Start your MitM proxy (e.g. HTTP Toolkit), and set up your rooted Android device or emulator, connected to ADB.
2. Find your MitM proxy's port (e.g. 8000) and its CA certificate in PEM format
   • The CA certificate should start with -----BEGIN CERTIFICATE-----. You can open it with a text editor to see and extract this content.
   • In HTTP Toolkit, both details can be found in the 'Anything' option on the Intercept page.
3. Open config.js, and add those details:
   • CERT_PEM: your CA certificate in PEM format.
   • PROXY_PORT: the proxy's port
   • PROXY_HOST: the address of your proxy, from the perspective of your device (or use adb reverse tcp:$PORT tcp:$PORT to forward the port over ADB, and use 127.0.0.1 as the host)
4. Install & start Frida on your device
   • The steps here may depend on your specific device & configuration.
   • For example: download the relevant frida-server from github.com/frida/frida, extract it, adb push it to your device, and then run it with the following 4 commands: adb shell, su, chmod +x /.../frida-server, /.../frida-server.
   • If you have issues, remember to check the device is on & connected (using adb devices) before running commands. Note that Frida will only run on the device as root, which is what su provides in the example above, when run on a rooted device. To check you are root after running su or similar, check that running whoami in the shell prints root.
5. Find the package id for the app you're interested in (for a quick test, try using github.com/httptoolkit/android-ssl-pinning-demo - the package id is tech.httptoolkit.pinning_demo)
6. Use Frida to launch the app you're interested in with the scripts injected (starting with config.js). Which scripts to use is up to you, but for Android a good command to start with is:

   frida -U \
       -l ./config.js \
       -l ./native-connect-hook.js \
       -l ./native-tls-hook.js \
       -l ./android/android-proxy-override.js \
       -l ./android/android-system-certificate-injection.js \
       -l ./android/android-certificate-unpinning.js \
       -l ./android/android-certificate-unpinning-fallback.js \
       -l ./android/android-disable-root-detection.js \
       -f $PACKAGE_ID
   

7. Explore, examine & modify all the traffic you're interested in! If you have any problems, please open an issue and help make these scripts even better.

iOS Getting Started Guide