hacktricks/mobile-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.md

<details>

<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako inayotangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.

</details>

<figure><img src="/.gitbook/assets/image (675).png" alt=""><figcaption></figcaption></figure>

Pata udhaifu unaowajali zaidi ili uweze kuzirekebisha haraka. Intruder inafuatilia eneo lako la shambulio, inafanya uchunguzi wa vitisho wa kujitokeza, inapata masuala katika mfumo wako mzima wa teknolojia, kutoka kwa APIs hadi programu za wavuti na mifumo ya wingu. [**Jaribu bure**](https://www.intruder.io/?utm\_source=referral\&utm\_campaign=hacktricks) leo.

{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}

***

Baadhi ya programu hazipendi vyeti vilivyopakuliwa na mtumiaji, kwa hivyo ili kuchunguza trafiki ya wavuti kwa baadhi ya programu, tunapaswa kwanza kuidondoa na kuongeza vitu kadhaa na kuirudisha.

# Kiotomatiki

Zana [**https://github.com/shroudedcode/apk-mitm**](https://github.com/shroudedcode/apk-mitm) itafanya mabadiliko muhimu kiotomatiki kwenye programu ili kuanza kukamata maombi na pia kuzima uthibitishaji wa cheti (ikiwa upo).

# Kwa Mkono

Kwanza tunaidondoa programu: `apktool d *jina-la-faili*.apk`

![](../../.gitbook/assets/img9.png)

Kisha tunakwenda kwenye faili ya **Manifest.xml** na kusonga chini hadi lebo ya `<\application android>` na tutaweka mstari ufuatao ikiwa bado haupo:

`android:networkSecurityConfig="@xml/network_security_config`

Kabla ya kuongeza:

![](../../.gitbook/assets/img10.png)

Baada ya kuongeza:

![](../../.gitbook/assets/img11.png)

Sasa nenda kwenye saraka ya **res/xml** na umbua/boresha faili iliyoitwa network\_security\_config.xml na yaliyomo yafuatayo:
```markup
<network-security-config>
<base-config>
<trust-anchors>
<!-- Trust preinstalled CAs -->
<certificates src="system" />
<!-- Additionally trust user added CAs -->
<certificates src="user" />
</trust-anchors>
</base-config>
</network-security-config>
```
Kisha hifadhi faili na rudi nyuma kutoka kwenye miongozo yote na jenga apk upya kwa kutumia amri ifuatayo: `apktool b *jina-la-folda/* -o *jina-la-faili-ya-huduma.apk*`

![](../../.gitbook/assets/img12.png)

Hatimaye, unahitaji tu **kusaini programu mpya**. [Soma sehemu hii ya ukurasa wa Smali - Kudecompile/\[Kubadilisha\]/Kukusanya ili kujifunza jinsi ya kuisaini](smali-changes.md#saini-apk-mpya).

<figure><img src="/.gitbook/assets/image (675).png" alt=""><figcaption></figcaption></figure>

Tafuta udhaifu unaofaa zaidi ili uweze kuzirekebisha haraka. Intruder inafuatilia eneo lako la shambulio, inatekeleza uchunguzi wa vitisho wa kujitokeza, inapata masuala katika mfumo wako wa teknolojia mzima, kutoka kwa API hadi programu za wavuti na mifumo ya wingu. [**Jaribu bure**](https://www.intruder.io/?utm\_source=referral\&utm\_campaign=hacktricks) leo.

{% embed url="https://www.intruder.io/?utm\_campaign=hacktricks&utm\_source=referral" %}


<details>

<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>