This is useful for determining what domains apps need to access and creating whitelists.īut this is a decision you in effect made, those devices needn't even use TLS, they could use Jim Bob's secret MITM-defeating crypto thing and you can't "hack" that either, you bought devices that are resistant to being reverse engineered. It can also export a list of all domains that the user allows to be resolved. It falls short of instecting the contents of the requests, but it does allow the user to export lists of all DNS/HTTP requests.
In that case, installing NetGuard available from F-Droid will allow the user to list and optionally block DNS/HTTP requests. "Tech" companies do not pay the costs of transferring the data/information, users foot the bill.Ī cautious user could decide that if the "tech" company will not share with her the deatils of the user's data/information being sent to the mothership, then she will just block the requests. After all, it is the user's network, it is the user's computer and it is the user's data/information, not the "tech" company's. Assuming the people running "tech" companies wants users to trust them, the user's data/information being transferred to the "tech" company should be available to the user. The part about being able to see "what they're saying" is interesting. I have not run into any problems with HSTS.
Instead of Burp, I use Haproxy running in Termux. I added the ssl configuration to the /etc/nginx/sites-enabled/default file the certificate."All I want is to be able to see who my device is using my network to call, and what they're saying." I created a self-signed certificate with the next command: sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out localhost.crt What I did was to add an Nginx as a reverse proxy. (For testing I am using Postman to create a request to a secure server.)
I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet.
0 kommentar(er)
