critical ops check connection blue stacks error

The techniques below all share the common goal of convincing a mobile application to trust the certificate provided by our intercepting proxy. By default, the self-signed certificate generated by tools such as Burp won’t have a valid trust chain, and if the certificate can’t be verified as trusted, most mobile apps will terminate the connection instead of connecting over a potentially insecure channel. When intercepting SSL traffic using a proxy, the SSL connection from the client is terminated at the proxy – whatever certificate the proxy sends to identify itself is evaluated by the mobile app as if the proxy were the web service endpoint. Why do we need to pay special attention to SSL MITM conditions for mobile applications? In order to view and fuzz a mobile app’s web service calls, we need to use an intercepting proxy such as BurpSuite or ZAP. These range from fairly simple to quite advanced in execution – this blog will try to cover each one without getting too bogged down in situation-specific details.

Using Frida to hook and bypass SSL certificate checks.

Overwriting a packaged CA cert with a custom CA cert.

Adding a custom CA to the trusted certificate store.

In this blog I’ll go through 4 techniques you can use to bypass SSL certificate checks on Android:

As pentesters, we’d like to convince the app that our certificate is valid and trusted so we can man-in-the-middle (MITM) it and modify its traffic. Instead, most modern applications at least check that the certificate presented chains to a valid, trusted certificate authority (CA). Gone are the days when mobile applications stoically ignored all manner of SSL errors and allowed you to intercept and modify their traffic at will.

Critical ops check connection blue stacks error