To sniff https traffic on a cert-binded app, do I need to disable Charles cert?

I know there's a couple brilliant coders on here so I'm going to take a shot with this q.

I'm sniffing android HTTPS traffic with Charles proxy. For example, Google.com in chrome on Android, no issues.

Then I go to something like Instagram (which I believe has an internal cert used to sign the requests but am not 100% sure), and well, no luck. Charles says I need to configure my certificate, which I clearly did because https google was fine.

So I get Xposed and install that with unbinding module. Then I enable it for the app Instagram or Uber. Still same issue.

Do I need to disable the Charles cert?

Instagram does SSL Pinning... It's a way to verify the SSL Cert used while communicating with the servers. AFAIK xPosed method is patched. If you have an Android, go check on github, I cannot add links right now but you will find an SSL Unpinned APK (has both arm and x86). You can use that to sniff all the traffic.


EDIT: To answer your question, no you do not need to disable the Cert on Charles. Also, I would suggest using Burpsuite, works better than Charles for Instagram.

As said above, you need a unpinned apk to sniff traffic for Android. I guess there is no publicly available unpinned apk so you have to buy or hire someone to get it done. Also, you will need key to sign if you want to play with requests.

Xposed doesn't works ñow for Instagram. Just get unpinned apk and any traffic sniffer will work fine.

If you find any public unpinned apk, please pm me too: -)

There is actually an available unpinned apk on github. I think its the 35th version.

Miraz0 said:

There is actually an available unpinned apk on github. I think its the 35th version.

Click to expand...

Can you link it? I'm interested too.