{"id":2180,"date":"2023-08-22T10:33:28","date_gmt":"2023-08-22T10:33:28","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2180"},"modified":"2023-08-22T10:33:28","modified_gmt":"2023-08-22T10:33:28","slug":"flutter-ios-ssl-pinning-bypass","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2023\/08\/22\/flutter-ios-ssl-pinning-bypass\/","title":{"rendered":"Flutter iOS &#8211; SSL Pinning Bypass"},"content":{"rendered":"<h1>Giri\u015f<\/h1>\n<p>Daha \u00f6ncesinde flutter testi yapt\u0131\u011f\u0131m\u0131 hat\u0131rlam\u0131yorum. Yeni bir i\u015f geldi\u011finde uygulaman\u0131n kaynak kodlar\u0131n\u0131 <strong>jadx-gui<\/strong> ile inceledi\u011fimde uygulaman\u0131n flutter ile yaz\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fcm. Tabi ki bu kodlar\u0131 apk \u00fczerinden inceledim ilk olarak. Buradan \u00e7\u0131kar\u0131mla ios kodlar\u0131n\u0131nda flutter ile geli\u015ftiridi\u011finin yorumunu yapt\u0131m. Android uygulamas\u0131nda geli\u015ftirici ekip birka\u00e7 sorun oldu\u011funu dile getirdi ben de bunun \u00fczerine ios uygulamas\u0131 \u00fczerinden teste ba\u015flamaya karar verdim. Bu yaz\u0131 i\u00e7erisinde flutter uygulamas\u0131n\u0131n SSL Pinning mekanizmas\u0131n\u0131 nas\u0131l bypass edebilece\u011fimizi a\u00e7\u0131klamaya \u00e7al\u0131\u015faca\u011f\u0131m. \u0130lk olarak ihtiyac\u0131m\u0131z olan varl\u0131klara bakal\u0131m:<\/p>\n<ul>\n<li>Jailbroke edlmi\u015f bir iPhone<\/li>\n<li>iPhone'a Cydia \u00fczerinden frida server kurun<\/li>\n<li>Bilgisayar\u0131n\u0131zda frida y\u00fckl\u00fc olsun<\/li>\n<li>Burp Suite<\/li>\n<li>Open VPN<\/li>\n<\/ul>\n<h1>Flutter Framewok<\/h1>\n<p>Normal \u015fartlar alt\u0131nda kotlin ya da swift gibi native dillerle kod yazd\u0131\u011f\u0131n\u0131zda siz \u00f6zellikle belirtmedik\u00e7e uygulamalar cihaz\u0131n root sertifikas\u0131n\u0131 kullan\u0131rlar. Burp'\u00fcn sertifikas\u0131n\u0131 root sertifika olarak belirlerseniz ve e\u011fer SSL Pinning uygulamada yoksa direkt olarak b\u00fct\u00fcn trafi\u011fi elde edebilirsiniz.<\/p>\n<p>Flutter geli\u015ftiricileri bunu bir zafiyet olarak g\u00f6rm\u00fc\u015f olacaklar ki cihaz\u0131n root sertifikas\u0131n\u0131 kullanm\u0131yorlar. Buda demek oluyorki siz root sertifikay\u0131 de\u011fi\u015ftirseniz bile flutter uygulamalar\u0131 i\u00e7in bir anlam ifade etmeyecektir. Bunun i\u00e7in ipa dosyas\u0131n\u0131 elde edip i\u00e7erisindeki flutter framework\u00fcn\u00fc patchlememiz gerekcektir. Github \u00fczerinden mevcut framework\u00fc indirip root sertifikas\u0131n\u0131 kullanmas\u0131 gerekti\u011fini s\u00f6yleyip daha sonras\u0131nda build alarak mevcut ipa i\u00e7erisindeki k\u00fct\u00fcphanelerle de\u011fi\u015ftirmemiz ve tekrardan paketlememiz gerekecek. \u015eakayd\u0131 \ud83d\ude00<\/p>\n<h1>Open VPN Kurulumu<\/h1>\n<p>Normalde elbette proxy ayarlar\u0131n\u0131 de\u011fi\u015ftirerek istekleri elde edebiliriz. Ancak uygulamada proxy detection gibi bir \u00f6nlem varsa bu i\u015flem i\u015fe yaramayacakt\u0131r. Ayr\u0131ca VPN ile daha kesin bir \u015fekilde y\u00f6nlendirme yap\u0131lacakt\u0131r.<\/p>\n<pre><code class=\"language-sh\">wget https:\/\/git.io\/vpn -O openvpn-install.sh\nsed -i &quot;$(($(grep -ni &quot;debian is too old&quot; openvpn-install.sh | cut  -d : -f 1)+1))d&quot; .\/openvpn-install.sh\nchmod +x openvpn-install.sh \nsudo .\/openvpn-install.sh<\/code><\/pre>\n<p>Yukar\u0131daki komutlar\u0131 kali \u00fczerinde \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131m\u0131zda \u00e7ok h\u0131zl\u0131 bir \u015fekilde vpn sunucusu kurabilirsiniz. sh dosyas\u0131n\u0131 ba\u015flatt\u0131ktan sonra a\u015fa\u011f\u0131daki gibi bir konfig\u00fcrasyon ger\u00e7ekle\u015ftirebilirsiniz.<\/p>\n<pre><code class=\"language-sh\"># Choose the following options:\nPublic IPv4 address \/ hostname [xx.xx.xx.xx]: 192.168.1.193     &lt;&lt;&lt; Change with your public IP address.\nProtocol [1]: 1         (UDP)\nPort [1194]: 1194 \nDNS server [1]: 3              (1.1.1.1)\nName [client]: kuday<\/code><\/pre>\n<p>Bu i\u015flem sonucundan root klas\u00f6r\u00fc alt\u0131nda profil olu\u015fturulmu\u015f olacakt\u0131r. VPN sunucusunu ba\u015flatabilirsiniz. \u015eimdi ise bu dosyay\u0131 telefonumuza y\u00fcklememiz gerekir. Marketten direkt olarak Openvpn uygulamas\u0131n\u0131 telfona indirin ve profili \u00e7al\u0131\u015ft\u0131r\u0131n.<\/p>\n<h1>MITM<\/h1>\n<p>\u015eimdi MITM yapal\u0131m. isteklerimiz kalimize yani vpn sunucumuza gelecek. Buraya gelen HTTP ve HTTPS isteklerini Burp Suite y\u00f6nlendirmemiz gerekecektir. A\u015fa\u011f\u0131daki iptables komutlar\u0131 ile bu i\u015flemi ger\u00e7ekle\u015ftirebilirsiniz.<\/p>\n<pre><code class=\"language-sh\"># For OpenVPN: -i tun0\nsudo iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 80 -j REDIRECT --to-port 8080\nsudo iptables -t nat -A PREROUTING -i tun0 -p tcp --dport 443 -j REDIRECT --to-port 8080\nsudo iptables -t nat -A POSTROUTING -s 192.168.10.0\/24 -o eth0 -j MASQUERADE\n<\/code><\/pre>\n<p><strong>Not:<\/strong> Burp ekran\u0131nda <strong>Invisible Proxy<\/strong> ayar\u0131n\u0131 enable edin.<\/p>\n<h1>Frida<\/h1>\n<p>Lab ortam\u0131n\u0131 kurduktan sonra <strong>BoringSSL<\/strong> k\u00fct\u00fcphanesini <a href=\"https:\/\/raw.githubusercontent.com\/NVISOsecurity\/disable-flutter-tls-verification\/main\/disable-flutter-tls.js\">https:\/\/raw.githubusercontent.com\/NVISOsecurity\/disable-flutter-tls-verification\/main\/disable-flutter-tls.js<\/a> adresindeki frida scripti ile patchleyip bypass edebiliriz.<\/p>\n<hr \/>\n<p>Referans:<\/p>\n<ul>\n<li><a href=\"https:\/\/github.com\/NVISOsecurity\/disable-flutter-tls-verification\">https:\/\/github.com\/NVISOsecurity\/disable-flutter-tls-verification<\/a><\/li>\n<li><a href=\"https:\/\/blog.nviso.eu\/2020\/06\/12\/intercepting-flutter-traffic-on-ios\/\">https:\/\/blog.nviso.eu\/2020\/06\/12\/intercepting-flutter-traffic-on-ios\/<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Giri\u015f Daha \u00f6ncesinde flutter testi yapt\u0131\u011f\u0131m\u0131 hat\u0131rlam\u0131yorum. Yeni bir i\u015f geldi\u011finde uygulaman\u0131n kaynak kodlar\u0131n\u0131 jadx-gui ile inceledi\u011fimde uygulaman\u0131n flutter ile yaz\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fcm. Tabi ki bu&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2023\/08\/22\/flutter-ios-ssl-pinning-bypass\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">Flutter iOS &#8211; SSL Pinning Bypass<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[695,662,603],"tags":[696],"class_list":["post-2180","post","type-post","status-publish","format-standard","hentry","category-flutter","category-ios","category-ssl","tag-flutter","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2180"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2180\/revisions"}],"predecessor-version":[{"id":2181,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2180\/revisions\/2181"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}