Bypassing Flutter TLS/SSL Verification When reFlutter Fails#2331
Open
carlospolop wants to merge 1 commit into
Open
Bypassing Flutter TLS/SSL Verification When reFlutter Fails#2331carlospolop wants to merge 1 commit into
carlospolop wants to merge 1 commit into
Conversation
Collaborator
Author
🔗 Additional ContextOriginal Blog Post: https://petruknisme.medium.com/bypassing-flutter-tls-ssl-verification-when-reflutter-fails-a4c41ff758a3 Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting -> Flutter, or Android Applications Pentesting -> Android Anti Instrumentation And SSL Pinning Bypass". Repository Maintenance:
Review Notes:
Bot Version: HackTricks News Bot v1.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 Automated Content Update
This PR was automatically generated by the HackTricks News Bot based on a technical blog post.
📝 Source Information
🎯 Content Summary
Bypassing Flutter TLS/SSL Verification When reFlutter Fails
This post describes a manual runtime bypass for TLS/SSL certificate verification in Flutter Android applications when
reFluttercannot automatically patch the APK. It is not a CVE; it is a mobile application security testing technique based on reverse engineeringlibflutter.soand dynamically forcing Flutter/BoringSSL certificate-chain verification to return success with Frida.Flutter embeds B...
🔧 Technical Details
Exact-engine Flutter/BoringSSL TLS bypass: Instead of using generic offsets, identify the Flutter snapshot hash from
libapp.so, map it to a Flutter version and engine commit via reFlutter'senginehash.csv, then read the Flutter releaseDEPSfile to recover the exact BoringSSL commit. This allows the tester to inspect the same BoringSSL source revision used by the target app and target the correct implementation ofssl_crypto_x509_session_verify_cert_chain.Finding stripped native functions using source-line constants: In BoringSSL,
OPENSSL_PUT_ERRORencodes the source line number into compiled error-handling code. After identifying the line number ofOPENSSL_PUT_ERRORinside the target source function, search that scalar value in Ghidra insidelibflutter.so. Filter hits, especiallymovinstructions, and inspect candidates until a three-argum...🤖 Agent Actions
Done: updated
src/mobile-pentesting/android-app-pentesting/flutter.md.Added:
reFlutterfailure workflowlibapp.sonotlibflutter.soenginehash.csv/gen_enginehash.pyfallback flowDEPS→ BoringSSL revision resolutionOPENSSL_PUT_ERRORline-number scalar search trick in Ghidralibflutter.soload via linker hooksreFlutterValidation:
mdbook buildcould not be run here becausemdbookis not installed (mdbook: command not found)This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.