SSL Pinning

SSL Pinning is a method to check the ssl certificate and decline the connect if the check fails.

Setup

1. In the OWASP VM open the folder ~/OWASP/Resources/https/.
   1. Start the python file in the folder with following command sudo python https.py.
   2. This will start a lightweight HTTPS server. The certificate is signed for the domain *.pentest.vm.
   3. Therefore the /etc/hosts file in both VMs has following lines:

   10.13.13.101 101.pentest.vm
   10.13.13.102 102.pentest.vm
   

2. Configure the iptablesrules as following via the command adb shell via the OWASP VM or press Alt + F1 in the Android VM:
   1. iptables.proxy (Please interchange the IP address with the one of the OWASP VM):

   iptables -t nat -A OUTPUT -o eth0 -p tcp --dport 443 -j DNAT --to 10.13.13.102:8080
   

3. Start Burp Suite in the OWASP VM.