Skip to content

Commit 557e9fb

Browse files
author
eleguevel
committed
fix(agent): okhttp3 sslpinning bypass
From sensepost#572 (review)
1 parent 5081750 commit 557e9fb

File tree

1 file changed

+17
-14
lines changed

1 file changed

+17
-14
lines changed

agent/src/android/pinning.ts

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -144,20 +144,23 @@ const okHttp3CertificatePinnerCheckOkHttp = (ident: string): any | undefined =>
144144
return wrapJavaPerform(() => {
145145
try {
146146
const certificatePinner: CertificatePinner = Java.use("okhttp3.CertificatePinner");
147-
send(c.blackBright(`Found okhttp3.CertificatePinner, overriding CertificatePinner.check$okhttp()`));
148-
149-
const CertificatePinnerCheckOkHttp = certificatePinner.check$okhttp.overload("java.lang.String", "u15");
150-
151-
// tslint:disable-next-line:only-arrow-functions
152-
CertificatePinnerCheckOkHttp.implementation = function () {
153-
qsend(quiet,
154-
c.blackBright(`[${ident}] `) + `Called check$okhttp ` +
155-
c.green(`OkHTTP 3.x CertificatePinner.check$okhttp()`) +
156-
`, not throwing an exception.`,
157-
);
158-
};
159-
160-
return CertificatePinnerCheckOkHttp;
147+
const CertificatePinnerCheckOkHttpOverloads = [];
148+
149+
certificatePinner["check$okhttp"].overloads.forEach((overload) => {
150+
// preserve the implementations so that we can create a proper job
151+
CertificatePinnerCheckOkHttpOverloads.push(overload);
152+
153+
// get the argument types for this overload
154+
const calleeArgTypes = overload.argumentTypes.map((arg) => arg.className);
155+
send(c.blackBright(`Found okhttp3.CertificatePinner.check$okhttp(${calleeArgTypes.join(", ")}), overriding ...`));
156+
overload.implementation = function () {
157+
qsend(quiet, c.blackBright(`[${ident}] `) + `Called check$okhttp ` +
158+
c.green(`OkHTTP 3.x CertificatePinner.check$okhttp()`) +
159+
`, not throwing an exception.`);
160+
}
161+
});
162+
163+
return CertificatePinnerCheckOkHttpOverloads;
161164

162165
} catch (err) {
163166
if ((err as Error).message.indexOf("ClassNotFoundException") === 0) {

0 commit comments

Comments
 (0)