When reviewing suspicious network activity, we often run across encrypted traffic. The instructions assume you are familiar with Wireshark, and it focuses on Wireshark version 3.x. Note: In case you are getting a JavaScript error, you have to edit ssl_logger.py and insert a line with var addresses, SSL_get_fd, SSL_get_session, SSL_SESSION_get_id, getpeername, getsockname before the line with function initializeGlobals.This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps) of the traffic.You then have a file log.pcap which you can analyze in Wireshark. Let it run until you are done, quit with Ctrl+C.

You can add -verbose to see live traffic output.

(Note that -remote is not explained in the readme, but it's necessary!.)

Run python ssl_logger.py -pcap log.pcap -remote on your computer.

Forward Frida's ports: adb forward tcp:27042 tcp:27042 adb forward tcp:27043 tcp:27043.

List processes to see if everything works, by running frida-ps -U on your computer with the phone connected.

On your computer, install frida-tools using pip install -user frida-tools.

Run /data/local/tmp/frida-server on the phone.

Push to /data/local/tmp of Android (as root), make executable ( chmod 755).

To know which CPU architecture your device is using (for getting the right download), you can run getprop ro. on the phone.

Download frida-server for the right CPU architecture from.

You have to install Frida Android server: This works by hooking functions inside OpenSSL so that the raw traffic can be dumped before encryption/after decryption. Take a look at (5alt's fork works with Android). If you want to avoid changing the certificate (which won't work with many applications), you could try injecting code into the Android app to sniff and dump SSL traffic.

Wireshark certificate ssl iphone