Skip to content
Hallway
0:00 / 0:00

#appmon#frida#androidsecurity

AppMon Sniffer Demo: Android App Runtime Security Monitoring

Nishant Das Patnaik

491 subscribers • 1 video on Hallway

YouTube
  • Recommended by 1 person: 1 on Stack Overflow and its sister sites.
  • Presented by Nishant Das Patnaik
  • Linked in the descriptiondpnishant/appmon
  • May be out of date. The tools, versions or practices it shows have likely moved on.

Intermediate. Assumes working knowledge.

8K views10 years ago1 recommendation

SecurityMobile developmentWeb and application securityAndroid and Jetpack ComposeReverse engineering

Nishant Das Patnaik demonstrates AppMon Sniffer, a tool powered by Frida for monitoring system API calls on native Android apps.

Open-Source: github.com/dpnishant/appmon Powered by: frida.re AppMon Sniffer is a part of the AppMon project, it let's you monitor system API calls on native Android apps. Tested on macOS. Tested on Dalvik Runtime upto Android KitKat. Support for Android Lollipop and above (Android Runtime; ART) is due soon. Tested on macOS 10.11.5 This video represents my personal opinions and is, in no way, validated/endorsed by any of my past or present employers. Music used: Fire Within by Jens Kiilstofte machinimasound.com/music/fire-within Licensed under Creative Commons Attribution 4.0 International (creativecommons.org/licenses/by/4.0/)

Why it's here

1 person recommends this

What people say. Recommended as a tool for intercepting Android WebViews and bypassing certificate pinning using Frida.

atdreon Information Security Stack Exchange • Recommends

On “Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1”

Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ? If you are just looking to intercept WebViews, then the Frida extension, appmon (which allows for API interception), using these techniques will work well -- link to this video If you do end up having to rewrite some code, try to keep it really simple. I found this technique which doesn't mess with the existing cert-pinning code and instead just adds the HTTP traffic to the logging system -- https://blog.securityevaluators.com/how-to-view-tls-traffic-in-androids-logs-6a42ca7a6e55 For a series on repackaging Android ap…
9View the answer