Get inside of Viber Messenger

[d1sm4tch]

Hi all! I need to make my own lightweight web client of that messenger Viber.
So I need somehow get the way of client-server communication(auth, send message, receive message).
I tried to decompile android apk with apktool but haven’t found anything useful.
Also tried to intercept packages with Wireshark and get encrypted TLS with some hardcoded cert (I think so).
Please, help me with ideas I can try!

[cicada]

If you can defeat the cert pinning, you could use something like Burp or Caido to intercept the traffic and go from there.

[d1sm4tch]

Thank you. it’s a good start. Should I try to replace cert? Maybe you have some articles about that kind of exploits?

[cicada]

So the cert pinning will prevent you from putting your own certificate into the mix, but if you can defeat the cert pinning, you can use the Burp Suite certs to start intercepting traffic. It’s not a guarantee, but a good place to start. If the protocol is something entirely unrelated to HTTP, you may have to take a different approach.

Give this a read and go from there: Installing Burp's CA certificate - PortSwigger

[c0z (Impetus Omnia Omnem Impetum)]

How do I capture all network traffic on a phone

Also you should use FRIDA to practice a technique called bypassing certificate pinning to see traffic of applications using HTTPS unencrypted. Pinning is the process of associating a host with their expected X509 certificate or public key. Once a certificate or public key is known or seen for a host, the certificate or public key is associated or ‘pinned’ to the host. What is certificate pinning The way it works is that you can hook into different functions that use the native SSL librar…

[d1sm4tch]

Thank you! I will try it