Added ios & android technique and tool for re-flutter (by @appknox) #2600

sk3l10x1ng · 2024-04-08T12:03:25Z

closes #2592

…H-0099.md, tools/generic/MASTG-TOOL-0099.md

cpholguera

Awesome, thank you @sk3l10x1ng! Here you have some suggestions.

techniques/android/MASTG-TECH-0099.md

techniques/ios/MASTG-TECH-0099.md

tools/generic/MASTG-TOOL-0099.md

techniques/android/MASTG-TECH-0099.md

techniques/ios/MASTG-TECH-0099.md

techniques/android/MASTG-TECH-0099.md

techniques/ios/MASTG-TECH-0099.md

cpholguera · 2024-04-10T07:41:23Z

And some questions more in general:

How does this technique using re-flutter differs from:
- https://blog.nviso.eu/2020/06/12/intercepting-flutter-traffic-on-ios/
- https://blog.nviso.eu/2019/08/13/intercepting-traffic-from-android-flutter-applications/
There's also this one, which could potentially be a new technique to intercept but using Frida:
- https://blog.nviso.eu/2022/08/18/intercept-flutter-traffic-on-ios-and-android-http-https-dio-pinning/

Do you have any reference apps we can link to. If not, maybe you could re-test suing these and link them as examples: https://github.com/NVISOsecurity/disable-flutter-tls-verification

We could also add them to https://mas.owasp.org/MASTG/apps/

sk3l10x1ng · 2024-04-18T11:57:26Z

And some questions more in general:

How does this technique using re-flutter differs from:

https://blog.nviso.eu/2020/06/12/intercepting-flutter-traffic-on-ios/

https://blog.nviso.eu/2019/08/13/intercepting-traffic-from-android-flutter-applications/

sure will add it.

There's also this one, which could potentially be a new technique to intercept but using Frida:

https://blog.nviso.eu/2022/08/18/intercept-flutter-traffic-on-ios-and-android-http-https-dio-pinning/

This is related to ssl pinning bypass and not about intercepting the traffic.

Do you have any reference apps we can link to. If not, maybe you could re-test suing these and link them as examples: https://github.com/NVISOsecurity/disable-flutter-tls-verification

We could also add them to https://mas.owasp.org/MASTG/apps/

sure , can test for intercepting the traffic and add it to https://mas.owasp.org/MASTG/apps/

techniques/ios/MASTG-TECH-0110.md

cpholguera · 2024-04-27T09:18:18Z

techniques/android/MASTG-TECH-0109.md

+
+
+
+**How does re-flutter method differs from other techniques ?**


@sk3l10x1ng thanks for all the updates, I've fixed a couple of typos for now.

Also thanks for checking those blog posts. I think the only think that remains open is the consideration of the 3rd alternative technique. If I'm not misunderstanding anything they are 2 alternative approaches,

(re-flutter) requires patching

(nviso script) doesn't require patching, it uses Frida

Using these apps:

https://github.com/NVISOsecurity/disable-flutter-tls-verification/blob/main/test_app/pinning.apk

https://github.com/NVISOsecurity/disable-flutter-tls-verification/blob/main/test_app/pinning.ipa

Could you please validate that your technique works with them and also using this alternative technique via Frida, it seems easy to run using codeshare (as indicated here):

frida -U --codeshare TheDauntless/disable-flutter-tls-v1 -f YOUR_BINARY

If all of this works we can confirm that both techniques are equivalent and could be summarized as:

re-flutter

setup interception proxy

patch app using re-flutter

inspect intercepted traffic

nviso

setup interception proxy

run frida script

inspect intercepted traffic

@TheDauntless Would you mind chiming in to confirm my hypothesis (or not)?

re-flutter also configures the proxy of the app, which is something that my script doesn't do.

So for disable-flutter-tls.js, you would need to pair that with VPN / ARP/ WIFI / DNS / ProxyDroid mitm.

cpholguera · 2024-04-27T09:24:35Z

tools/generic/MASTG-TOOL-0100.md

Could you add a new TOOL file for disable-flutter-tls-verification?

--- title: disable-flutter-tls-verification platform: generic source: https://github.com/NVISOsecurity/disable-flutter-tls-verification --- [disable-flutter-tls-verification](https://github.com/Impact-I/reFlutter) is a Frida script that disables Flutter's TLS verification and works on Android x86, Android x64 and iOS x64. It uses pattern matching to find [ssl_verify_peer_cert in handshake.cc](https://github.com/google/boringssl/blob/master/ssl/handshake.cc#L323). Further information can be found in [this blogpost](https://blog.nviso.eu/2022/08/18/intercept-flutter-traffic-on-ios-and-android-http-https-dio-pinning/). You can use it via Frida codeshare or by downloading disable-flutter-tls.js from the repo as indicated in these [instructions](https://github.com/NVISOsecurity/disable-flutter-tls-verification).

TheDauntless

Hi! Thanks for contributing to the MASTG! 🥳

I added some comments, both grammar and content-wise. These techniques can be quite tricky, and we try to give different alternatives and explain pros/cons of the different tools. This is important as these tools can (and will) fail at some point, and it's important to know all the possibilities.

Can you apply these comments to the iOS section, too?

(And, just for transparency, I'm also the author of disable-flutter-tls.js)

TheDauntless · 2024-05-03T07:46:37Z

techniques/android/MASTG-TECH-0109.md

@@ -0,0 +1,51 @@
+--- 
+title: Intercepting Flutter HTTP Traffic


Suggested change

title: Intercepting Flutter HTTP Traffic

title: Intercepting Flutter HTTPS Traffic

@cpholguera or are we using HTTP everywhere? The difficulty is that it has its own cert store. The proxy-unaware is not Flutter specific.

You're correct! Thanks

TheDauntless · 2024-05-03T07:48:54Z

techniques/android/MASTG-TECH-0109.md

+platform: android 
+---
+
+Flutter is an open-source UI software development kit (SDK) created by Google. It is used for building natively compiled applications for mobile, web, and desktop from a single codebase. Flutter uses Dart, which is not proxy-aware and uses its own certificate store. The application doesn't take proxy configuration from the system and send the data directly to the server. Due to this, it is not possible to intercept the request using the BurpSuite or any MITM tools.


Suggested change

Flutter is an open-source UI software development kit (SDK) created by Google. It is used for building natively compiled applications for mobile, web, and desktop from a single codebase. Flutter uses Dart, which is not proxy-aware and uses its own certificate store. The application doesn't take proxy configuration from the system and send the data directly to the server. Due to this, it is not possible to intercept the request using the BurpSuite or any MITM tools.

Flutter is an open-source UI software development kit (SDK) created by Google. It is used for building natively compiled applications for mobile, web, and desktop from a single codebase. Flutter uses Dart, which is not proxy-aware and uses its own certificate store. The application doesn't use the proxy configuration of the system and sends the data directly to the server. Connections are verified against built-in certificates, so any certificates installed on the system are simply ignored. Due to this, it is not possible to intercept HTTPS requests as the certificate of the proxy will never be trusted.

I modified this a bit, since the proxy-unaware isn't really an issue (you could use a VPN, arp spoofing, DNS spoofing, WIFI MITM, ...), but the fact that it has a built-in cert store is an issue that can't be solved by any conventional technique.

TheDauntless · 2024-05-03T07:50:49Z

techniques/android/MASTG-TECH-0109.md

+
+
+
+**How does re-flutter method differs from other techniques ?**


re-flutter also configures the proxy of the app, which is something that my script doesn't do.

So for disable-flutter-tls.js, you would need to pair that with VPN / ARP/ WIFI / DNS / ProxyDroid mitm.

TheDauntless · 2024-05-03T07:51:07Z

techniques/android/MASTG-TECH-0109.md

+
+
+
+**How does re-flutter method differs from other techniques ?**


Suggested change

**How does re-flutter method differs from other techniques ?**

Would delete this line

TheDauntless · 2024-05-03T08:14:44Z

techniques/android/MASTG-TECH-0109.md

+
+**How does re-flutter method differs from other techniques ?**
+
+There are alternative methods for intercepting traffic, such as [sending traffic to the proxy through ProxyDroid/iptables](https://blog.nviso.eu/2019/08/13/intercepting-traffic-from-android-flutter-applications/). However, these techniques require some configuration. By employing the re-flutter command-line tool, the application can be patched effortlessly without the need for any setup.


Suggested change

There are alternative methods for intercepting traffic, such as [sending traffic to the proxy through ProxyDroid/iptables](https://blog.nviso.eu/2019/08/13/intercepting-traffic-from-android-flutter-applications/). However, these techniques require some configuration. By employing the re-flutter command-line tool, the application can be patched effortlessly without the need for any setup.

In order to intercept Flutter HTTPS traffic we need to deal with two problems:

* Make sure the traffic is sent to the proxy

* Disable the TLS verification of any HTTPS connection

There are generally two approaches to this: reFlutter and Frida.

* reFlutter: This tool creates a modified version of libFlutter.so which is then repackaged into the APK. It configures the internal libraries to use a specified proxy and disable the TLS verification

* Frida: The [disable-flutter-tls.js script](https://github.com/NVISOsecurity/disable-flutter-tls-verification) can dynamically remove the TLS verification without the need for repackaging. As it doesn't modify the proxy configuration, additional steps are needed (e.g. ProxyDroid, DNS, iptables, ...)

The re-flutter app also has downsides, so this is pretty one-sided:

Only works on known/published hashes, otherwise you have to rebuild the engine yourself

Repackages the app. This brings complications (e.g. iOS or any app that detects repackaging)

I've used reFlutter a few times (mostly for the object-dump) and it's great when it works, but not straightforward if it doesn't.

So I modified this section to give a more generic introduction of what needs to be done, and then the rest can explain both reFlutter and Frida+(eg)ProxyDroid

We should also use reFlutter, as the tool calls itself, and not re-flutter.

TheDauntless · 2024-05-03T08:15:30Z

techniques/android/MASTG-TECH-0109.md

+
+1. Patch the app to enable traffic interception.
+
+Run the command to patch the app and select the option **Traffic monitoring and interception** and then the IP of the machine which the interception proxy is running.


Suggested change

Run the command to patch the app and select the option **Traffic monitoring and interception** and then the IP of the machine which the interception proxy is running.

Run the command to patch the app and select the option **Traffic monitoring and interception** and then enter the IP of the machine on which the interception proxy is running.

TheDauntless · 2024-05-03T08:17:19Z

techniques/android/MASTG-TECH-0109.md

+
+3. Install the signed patched app on the mobile device.
+
+4. Configure the interception proxy.For example, in Burp-suite:


Suggested change

4. Configure the interception proxy.For example, in Burp-suite:

4. Configure the interception proxy. For example, in Burp:

We use 'Burp' as the consistent name for PortSwigger's Burp Suite throughout the MASTG.

TheDauntless · 2024-05-03T08:17:46Z

techniques/android/MASTG-TECH-0109.md

+4. Configure the interception proxy.For example, in Burp-suite:
+ - Under Proxy -> Proxy settings -> Add new Proxy setting.
+ - Bind listening Port to 8083.
+ - Select Bind to address to All interfaces.


Suggested change

- Select Bind to address to All interfaces.

- Select `Bind to address` to `All interfaces`.

TheDauntless · 2024-05-03T08:17:52Z

techniques/android/MASTG-TECH-0109.md

+
+4. Configure the interception proxy.For example, in Burp-suite:
+ - Under Proxy -> Proxy settings -> Add new Proxy setting.
+ - Bind listening Port to 8083.


Suggested change

- Bind listening Port to 8083.

- Bind listening Port to `8083`.

sk3l10x1ng · 2024-05-03T11:55:57Z

@TheDauntless , Thanks , will work on the changes

Added techniques/android/MASTG-TECH-0099.md ,techniques/ios/MASTG-TEC…

1570297

…H-0099.md, tools/generic/MASTG-TOOL-0099.md

sk3l10x1ng changed the title ~~Added ios & android technique and tool for re-flutter~~ Added ios & android technique and tool for re-flutter (@appknox) Apr 8, 2024

sk3l10x1ng changed the title ~~Added ios & android technique and tool for re-flutter (@appknox)~~ Added ios & android technique and tool for re-flutter (by @appknox) Apr 8, 2024

sk3l10x1ng added 2 commits April 8, 2024 19:23

updated title

c66ad79

small correction fixes

67ef2c4

cpholguera requested changes Apr 10, 2024

View reviewed changes

sk3l10x1ng added 5 commits April 10, 2024 14:14

renamed file to MASTG-TECH-0109.md

55cceab

updated ios & android techniques

c7b2103

update ios technique

a8e2af9

added link

bab130a

added content

3e8026e

sk3l10x1ng added 4 commits April 22, 2024 11:11

updated mastg-tech-0109

4400933

updated mastg-tech-0110

2e8a6db

removed duplicate re-flutter mastg-tool-0099

a7313bf

removed duplicate file mastg-tech-0099

58a0c5b

sk3l10x1ng requested a review from cpholguera April 22, 2024 06:10

cpholguera reviewed Apr 27, 2024

View reviewed changes

techniques/ios/MASTG-TECH-0110.md Outdated Show resolved Hide resolved

fix typo

a739edc

cpholguera reviewed Apr 27, 2024

View reviewed changes

techniques/ios/MASTG-TECH-0110.md Outdated Show resolved Hide resolved

fix typo

987322d

cpholguera reviewed Apr 27, 2024

View reviewed changes

cpholguera assigned sk3l10x1ng Apr 27, 2024

cpholguera added the changes-requested label Apr 27, 2024

TheDauntless self-assigned this Apr 30, 2024

TheDauntless requested changes May 3, 2024

View reviewed changes

updated

b3fc2e1

rename filename

2f9e0bd

sk3l10x1ng requested review from cpholguera and TheDauntless May 14, 2024 08:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added ios & android technique and tool for re-flutter (by @appknox) #2600

Added ios & android technique and tool for re-flutter (by @appknox) #2600

sk3l10x1ng commented Apr 8, 2024

cpholguera left a comment

cpholguera commented Apr 10, 2024

sk3l10x1ng commented Apr 18, 2024

cpholguera Apr 27, 2024

cpholguera Apr 27, 2024

TheDauntless May 3, 2024

cpholguera Apr 27, 2024

TheDauntless left a comment

TheDauntless May 3, 2024

cpholguera May 3, 2024

TheDauntless May 3, 2024

TheDauntless May 3, 2024

TheDauntless May 3, 2024

TheDauntless May 3, 2024

TheDauntless May 3, 2024

TheDauntless May 3, 2024

TheDauntless May 3, 2024

TheDauntless May 3, 2024

sk3l10x1ng commented May 3, 2024




		How does re-flutter method differs from other techniques ?

	title: Intercepting Flutter HTTP Traffic
	title: Intercepting Flutter HTTPS Traffic


		How does re-flutter method differs from other techniques ?

		There are alternative methods for intercepting traffic, such as [sending traffic to the proxy through ProxyDroid/iptables](https://blog.nviso.eu/2019/08/13/intercepting-traffic-from-android-flutter-applications/). However, these techniques require some configuration. By employing the re-flutter command-line tool, the application can be patched effortlessly without the need for any setup.

-There are alternative methods for intercepting traffic, such as [sending traffic to the proxy through ProxyDroid/iptables](https://blog.nviso.eu/2019/08/13/intercepting-traffic-from-android-flutter-applications/). However, these techniques require some configuration. By employing the re-flutter command-line tool, the application can be patched effortlessly without the need for any setup.
+In order to intercept Flutter HTTPS traffic we need to deal with two problems:
+* Make sure the traffic is sent to the proxy
+* Disable the TLS verification of any HTTPS connection
+There are generally two approaches to this: reFlutter and Frida.
+* reFlutter: This tool creates a modified version of libFlutter.so which is then repackaged into the APK. It configures the internal libraries to use a specified proxy and disable the TLS verification
+* Frida: The [disable-flutter-tls.js script](https://github.com/NVISOsecurity/disable-flutter-tls-verification) can dynamically remove the TLS verification without the need for repackaging. As it doesn't modify the proxy configuration, additional steps are needed (e.g. ProxyDroid, DNS, iptables, ...)


		1. Patch the app to enable traffic interception.

		Run the command to patch the app and select the option Traffic monitoring and interception and then the IP of the machine which the interception proxy is running.


		3. Install the signed patched app on the mobile device.

		4. Configure the interception proxy.For example, in Burp-suite:

	4. Configure the interception proxy.For example, in Burp-suite:
	4. Configure the interception proxy. For example, in Burp:

	- Select Bind to address to All interfaces.
	- Select `Bind to address` to `All interfaces`.

	- Bind listening Port to 8083.
	- Bind listening Port to `8083`.

Added ios & android technique and tool for re-flutter (by @appknox) #2600

Are you sure you want to change the base?

Added ios & android technique and tool for re-flutter (by @appknox) #2600

Conversation

sk3l10x1ng commented Apr 8, 2024

cpholguera left a comment

Choose a reason for hiding this comment

cpholguera commented Apr 10, 2024

sk3l10x1ng commented Apr 18, 2024

Choose a reason for hiding this comment

re-flutter

nviso

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TheDauntless left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sk3l10x1ng commented May 3, 2024