Not able to bypass pinning in Twitter app 5.47.0

[fuzion24]

Not able to bypass pinning in Twitter app 5.47.0

[jakev]

@clviper have you tried using my fork: https://github.com/jakev/JustTrustMe?

[clviper]

Hi. Just compiled your fork but the behavior is the same.
Could you test on your environment if you have the same problem just to discard if it is a problem on my environment?
Thank you.

[jakev]

It does not appear to work for me either. I just pushed a commit that I thought would address it (jakev@7fb0278), but I guess no dice. I will try to look into this tonight if I get some free time.

[clviper]

Thank you. I will try to help you out also, probably they implemented a custom pinning functionality, I´m going to look at the app.

[clviper]

Hi there. Any news on this issue? Thank you.

[Fuzion24]

How are you mitm'ing the app? I'm suspect parts of this app might not be using HTTP. I didn't dig too deeply, but I was able to using mitmproxy to snag registration, but not not stuff from the timeline (even though it was loading properly)

[testmanager92]

Any updates on this guys?

I've came across an app which uses amqp protocol. Is this applicable to twitter as well?

[clviper]

On the case of twitter, with an up to date version of the app the bypass worked.

[testmanager92]

Is it working for all the internal pages or just the login form?

[clviper]

It looks like twitter is not respecting proxy anymore. I have tried with JustTrustMe and with Cydia Substrate+SSLTrustKiller and the behaviour is the same.

[Alexzha]

Did anyone get this working? Doesn't work for me either...

[Fuzion24]

What specifically doesn't work for you?

[Alexzha]

I've downloaded the latest twitter apk and attempted to MiTM it using this module...There simply isn't any traffic to be seen; i figured maybe the app ignores wifi proxy settings so i used proxydroid (which uses iptables i believe) and afterwards it says "No request was made. Possibly the SSL certificate was rejected.".

Here's a screenshot from charles - https://i.gyazo.com/9b21bc3144314a06888d61de773bfa5e.png'

Have you had sucess intercepting the latest twitter app traffic?

The last twitter version that i've been able to intercept was ~5.20 or so

[Fuzion24]

I think this should fix it: 482d116