Intercept encrypted information transmitted over HTTPS by means of a man-in-the-middle attack

Intercept the mobile login password via Charles

1. Make the PC and Android phone in the same wifi

2. PC-side installation of Charles ' SSL certificate

2. The proxy address for setting up WiFi in the Android phone is the current address of the PC, the port number is: 8888

3. Import the certificate provided by Charles from Android phone set > Security and Privacy > Install from storage device > select certificate

4. Open the app on the phone and sign in

5. Crawl the data packets in the app login process on the PC side

6. Add the corresponding URL to Charles proxy > proxy Setting >ssl > Check on Enable SSL proxying the Add location

7. Once again impersonate the user login, at this time in Charles can intercept the encrypted plaintext information through HTTPS

This method is provided to testers to verify the security of the website and the application.

Intercept encrypted information transmitted over HTTPS by means of a man-in-the-middle attack