← Back to context

Comment by pimterry

2 years ago

It depends :-). If it's Android (like a Fire stick) then in some cases, but all the Android caveats apply, e.g. you'll need root access to access traffic from apps that don't opt-in to debugging. For testing your own apps that's fine, but for reverse engineering HTTPS traffic you'll generally need a rooted device. In practice, if you don't already have a rooted phone on hand it's usually best to use an Android emulator on your computer, since most of those provide root access out of the box.

Even with root, certificate pinning can cause problems (as the sibling comment points out) but you can usually defeat that fairly easily: https://httptoolkit.com/blog/frida-certificate-pinning/.

For non-Android, HTTP Toolkit can't set it up for you automatically, but you can absolutely intercept _anything_ manually if you can configure it with your own HTTP proxy setting (fairly common) and add a trusted CA certificate (less common).