1

I have to be able to intercept the traffic from my mobile app and Chrome both. Now I can't because of Google certificate transparency policy. This is very inconvinient because so many mobile apps use WebSocket which doesn't work without TLS. And here I'm stuck. I don't know why but reinstalling the Magisk on my phone usually solving the problem for a few days (that's strange but when I reinstall Magisk I can see the traffic from mobile app and from Chrome in my BurpSuite but it works temporarily).

So, I found the guide https://httptoolkit.com/blog/chrome-android-certificate-transparency/ but can't reproduce these steps:

#Create a file containing one line
-chrome --ignore-certificate-errors-spki-list=$YOUR_SPKI_FINGERPRINT

#Use adb push to store this on your Android device at:
/data/local/chrome-command-line
/data/local/android-webview-command-line
/data/local/webview-command-line
/data/local/content-shell-command-line
/data/local/tmp/chrome-command-line
/data/local/tmp/android-webview-command-line
/data/local/tmp/webview-command-line
/data/local/tmp/content-shell-command-line

As I understood I must put the file containing this string "chrome --ignore-certificate-errors-spki-list=$YOUR_SPKI_FINGERPRINT" to the folders above but I don't have these folders on my device. Should I create it or not? Pls could somebody explain me what I have to do.

Dscarve
  • 11
  • 1
  • 4
  • I wrote that article. Can you explain which bit is confusing? In short, yes, you need to create those files and put that command (with your SPKI fingerprint) on your device. If that's difficult or it doesn't work, you can use HTTP Toolkit itself (https://httptoolkit.com) which will do this automatically for you if you use ADB-based setup. – Tim Perry Nov 03 '22 at 12:03
  • TIm, Hello. First of all thank you for the article! If I understood right I have to make "8" files (in data/local and in data/local/tmp): chrome-command-line, android-webview-command-line, webview-command-line, content-shell-command-line etc... And each of these files should contain only one string -chrome --ignore-certificate-errors-spki-list=$MY_SPKI_FINGERPRINT am I right? – Dscarve Nov 03 '22 at 13:50
  • Tim, I back with a little feedback: everything works PERFECT! Just amazing, you just saved my life:) Thank you! – Dscarve Nov 06 '22 at 11:28

0 Answers0