‫[Instructor] Hi, within this lecture
‫we are going to see how to manipulate our app,
‫how to manipulate our APK
‫so that it will trust the certificates
‫that we have downloaded.
‫The SSL certificates that we have downloaded
‫from Charles Proxy.
‫So this is not only for this purpose,
‫if you know how to do this, you can use it in your
‫other penetration tests as well.
‫So this is very critical.
‫As I said before, developers should actually allow the app
‫to trust the certificates.
‫And most of the developers do not have that intention,
‫because why would they do it in the first place?
‫It's not very safe, if they don't have any specific purpose,
‫they won't do it.
‫But we are going to edit the APK with APKtool
‫and we are going to add our own configuration
‫and we will build it again.
‫So I'm going to open my GitHub page
‫and I believe Charles is stopping us from doing so
‫so I'm going to stop the Charles,
‫so I suggest you do that as well
‫and try to open my GitHub page.
‫Okay, so go to SecureTweet application
‫that you have seen before,
‫and in the app folder, go to source, main,
‫and over here you will see the Android manifest.
‫You will see the network security configuration over here.
‫As you can see, this is a different configuration
‫than we have seen before.
‫And I have edited this
‫so that you can find it when you need it, okay?
‫So you can copy and paste it when you need it.
‫So of course this won't be here generally,
‫and this is the change that we need to do,
‫so in our own app as well.
‫And you can actually debug your app
‫or decompile your app using APKtool
‫and add this line if you want to change the settings
‫of the default network security configuration.
‫And we are going to create this xml file
‫and we will manipulate it in a way
‫that it will trust the certificates
‫that user has downloaded, okay?
‫So we need to decompile our app
‫and we need to edit the manifest
‫and we need to create this xml file
‫and we need to change the content of that xml file.
‫And then we are going to build it one more time
‫and then we will be able to actually trust the app,
‫trust the certificates inside of our app
‫so that it can send the SSL requests
‫within Charles Proxy.
‫So this is what we are going to do,
‫and let me open the app over here in the resources folder
‫and you will see the xml folder
‫and the network security config xml over here as well
‫so that you can take the content
‫and copy and paste it in order to avoid any errors
‫that you may encounter during this process.
‫So this is exactly why I have edited this, okay?
‫So when you need it,
‫you can come over here to my GitHub page
‫and copy and paste the content.
‫And if you look at the content,
‫it's a network security configuration
‫and it actually trusts the certificates.
‫So as you can see, Charles will only run for 30 minutes
‫because we are running on a trial version.
‫So it's not important, just say okay
‫and make sure you open Charles one more time from scratch.
‫And when you open it, it will just run as before
‫and we will be able to see the traffic in Charles.
‫So as you can see, it delays for 10 seconds
‫because it's trial version, it really doesn't matter for us,
‫we can wait for 10 seconds and it will run once we started.
‫So I'm going to open the app debug folder
‫because we have already decompiled it, right?
‫And I'm going to open the Android manifest with a text edit.
‫So I'm going to zoom in a little bit like this.
‫And over here,
‫we are going to add the network security thing.
‫So let me open the manifest over here
‫and as you can see, it's under the application tag.
‫And I'm going to copy it from here, okay?
‫And I'm going to paste it under the application tag.
‫So let me find the application tag,
‫and, here you go, I believe it's over here,
‫yep, application tag.
‫I'm going to leave a space
‫and paste it in this space like this.
‫So now it will try to find this xml folder
‫and network security config file
‫and it will read the content out of it.
‫But since we don't have this xml, now we have to create it
‫and make sure it's in the right folder.
‫So I'm going to open this text edit
‫and make sure it's over there.
‫Yep, it's over there.
‫I'm going to save it and close it.
‫So far so good.
‫Now we need to go to rest and find if we have xml folder.
‫No, we don't have any xml folder.
‫We can create a folder, right?
‫We can create any folder and call it xml if we want.
‫So I'm going to do that.
‫I'm going to create a new folder here and call it xml.
‫And I'm going to just take this folder
‫and put it inside of res folder.
‫So now we have the xml.
‫So all I have to do is just create an xml file
‫and change the content
‫with the content that you are seeing over here.
‫So this one, yep.
‫So as you can see, it's actually ends
‫with the .xml extension and it has this content.
‫So make sure you copy this
‫and create an xml file and paste the content over there.
‫So you can download the xml file from here if you like
‫but most of the time you won't have to deal with this, okay?
‫And you don't have to download everything
‫over here just for this xml file,
‫you can just get an xml file from here,
‫like from layout for example, okay?
‫This is an xml file, just copy it
‫and just paste it in your xml folder.
‫So I'm going to copy this, okay?
‫I'm going to come over here.
‫I'm going to paste it inside of this folder.
‫And of course I need to change its name
‫to network_security_config, like this.
‫It has to be exactly the same, right?
‫Like in the manifest, like this, network_security_config.
‫Make sure it's the same.
‫And now I'm going to change the content of it.
‫So I'm going to delete everything from here
‫and I need to copy it one more time from there.
‫And I will paste it like this.
‫So I'm going to save this and close this down.
‫Here you go, now we have the configuration file
‫and it actually complies with the system
‫and user certificates inside of the Android phone right now.
‫So now we are ready to build this APK from scratch,
‫and I'm going to delete this older APK
‫because we are going to build it one more time
‫and I'm going to open my terminal to do so
‫because we are going to use the APK tool like before, okay?
‫So maybe if you're on Windows
‫you may need to just send this folder
‫to your Kali Linux and do it from there.
‫And you need to go
‫to the file folder that your file resides in.
‫And when you see that folder like this, you can run AK tool,
‫and this time, rather than d, I'm going to call it b
‫because we are building it and I'm going to say app debug.
‫This is the folder name that I have over here
‫and I'm going to hit enter.
‫So it will create a new APK for us
‫and we're going to build the APK with the manifest,
‫with the xml that we have created.
‫And since I haven't specified any output file
‫it should have put the new APK
‫inside of this app debug folder.
‫Now we can use it to get the traffic
‫from our emulator, from our app.
‫Okay, so I'm going to open this
‫and it should be in the distribution or build folder.
‫Let me see, yep, here you go.
‫Not this one.
‫Maybe we can go for the distribution folder.
‫Yep, here you go.
‫So app debug APK is over here
‫so I'm going to take this, okay,
‫and I'm going to use this APK from now on.
‫So make sure you find your own and use it.
‫So I'm going to open this APK in my emulator like this.
‫And as you can see, it gives me an error because why?
‫Because we haven't signed it yet, right?
‫We need to use jarsigner
‫and the other tools that we need to sign it for.
‫So we're going to do it again
‫and we are going to install it,
‫then we can actually capture the traffic.
‫So let's do that within the next lecture.