Setting up MITM attack on your application [українською]

Timestamps 0:00 about SSL handshake, certificate authorities, chain of trust 8:50 OWASP ZAP setup & browser setup 13:46 adding target websites to context 15:53 change request & response with breakpoints 17:52 iOS setup 26:03 Android setup 33:45 Flutter setup 36:28 on certificate pinning 39:20 questions Source Code iOS - https://gitlab.com/divnyi/mitm_target_ios Android - https://gitlab.com/divnyi/mitm_target_android Flutter - https://gitlab.com/divnyi/mitm_target_flutter Useful links Android mitm: https://stackoverflow.com/questions/4461360/how-to-install-trusted-ca-certificate-on-android-device Android zap setup: https://brookhong.github.io/2019/04/26/capture-https-traffic-on-anroid-emulator-since-7.0.html iOS zap setup: https://www.omerlh.info/2019/05/15/debugging-ios-apps-with-zaproxy/ Flutter-specific issues: https://github.com/flutter/flutter/issues/20376 https://github.com/flutter/flutter/issues/26359 Possible ways to do real android MITM attack: https://blog.netspi.com/four-ways-bypass-android-ssl-verification-certificate-pinning/ Developers android doc on security: https://developer.android.com/training/articles/security-ssl OWASP cert pinning: https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning