https://github.com/intrepidusgroup/trustme
Disable certificate trust checks on iOS devices.
https://github.com/intrepidusgroup/trustme
Last synced: 6 months ago
JSON representation
Disable certificate trust checks on iOS devices.
- Host: GitHub
- URL: https://github.com/intrepidusgroup/trustme
- Owner: intrepidusgroup
- License: other
- Created: 2013-01-25T02:18:22.000Z (over 13 years ago)
- Default Branch: master
- Last Pushed: 2013-02-07T13:33:41.000Z (over 13 years ago)
- Last Synced: 2024-08-04T04:06:38.019Z (almost 2 years ago)
- Size: 209 KB
- Stars: 116
- Watchers: 12
- Forks: 15
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesomemobilepentest - iOS TrustMe - Disable certificate trust checks on iOS devices. (Awesome Mobile Application Penetration Testing  / iOS Application Penetration Testing)
README
iOS TrustMe
===========
An extreme method of disabling most certificate verification checks within iOS applications.
TrustMe will defeat certificate pinning in most cases.
Description
-----------
Requires a jailbroken device. This "Tweak" disables the SecTrustEvaluate. It should
only be used on testing devices with no personal data or information, since this
will completely disable most SSL safeguards.
Requirements
------------
* MobileSubstrate (Should come with jailbroken devices)
* dpkg (Install from Cydia)
Installation
------------
Download the dpkg
wget https://www.dropbox.com/s/zyltyoa7s1x3m47/com.intrepidusgroup.trustme_0.1-4_iphoneos-arm.deb
dpkg -i com.intrepidusgroup.trustme_0.1-4_iphoneos-arm.deb
Usage
------------
To disable it, uninstall the deb:
dpkg -r com.intrepidusgroup.trustme
Alternately, you can edit the plist located at /Library/MobileSubstrate/DynamicLibraries/trustme.plist
Documentation on the format of the plist can be found at
http://iphonedevwiki.net/index.php/MobileSubstrate
Build
-----------
Building requires theos.
http://iphonedevwiki.net/index.php/Theos
This is a Theos 'tweak' project. Use theos to create the required files and then run:
make
Acknowledgements
-----------
This tool is patterned on ios-ssl-kill-switch (https://github.com/iSECPartners/ios-ssl-kill-switch). Trustme
uses a similar technique, but targets a C function that is lower in the call chain of most SSL certificate
validation code, which allows it to disable more SSL validation code.