httptoolkit with reflutter

[smsactives]

Does httptoolkit work with reflutter if so how?

[pimterry]

I've never used reflutter myself, but as far as I can tell, no special configuration should be required. You can use reflutter to repack an app, install the app, and then interception with that app using HTTP Toolkit should work automatically just like any normal app. Are you having issues with this?

As an aside, it's not yet available, but there is now a Frida script for intercepting Flutter on Android available in https://github.com/httptoolkit/frida-interception-and-unpinning/blob/main/android/android-disable-flutter-certificate-pinning.js. In an upcoming release this will be used automatically when using the 'Frida' interception option, so you will be able to intercept Flutter app HTTPS without using Reflutter or similar at all.

[smsactives]

Hey @pimterry I've been following you for a while, in this case it's not to disable any SSL Pinning, Flutter has a custom configuration where when you try to intercept it it goes through another channel, so we modified it with reflutter to put our proxy inside the application, even running this script it was not possible to intercept

[pimterry]

I'm not totally sure what "a custom configuration where when you try to intercept it it goes through another channel" means. Can you explain in more detail? What exactly is a 'channel' in this context?

Are you saying that the network connections don't go where you expect, or that the certificate isn't trusted, or both, or something else?

The network connection redirection can be handled by https://github.com/httptoolkit/frida-interception-and-unpinning/blob/main/native-connect-hook.js. I'm not aware of any way to make connections (in Flutter, or native code, or anything) that can avoid being captured by that script - it directly hooks the connect() function itself and rewrites every single packet (and optionally blocks HTTP/3 UDP packets entirely, to avoid any proxy evasion there). That should just work very easily.

Similarly, HTTP Toolkit's "Android Device via ADB" interception uses Android's VPN APIs which give access to all packets on the device, and that will capture almost everything as well, regardless of how the app works internally (this does have some small exceptions: it intentionally only captures traffic to specific ports, and it doesn't intercept UDP i.e. HTTP/3, but neither is likely to matter for normal Flutter cases).

Both approaches are effectively OS-level packet redirection, so Flutter or Java or anything shouldn't make any difference.

For certificate trust meanwhile, Flutter is quite a bit more complicated, so I can definitely imagine weird edge cases there. The script above should handle well this, judging by from my testing so far. That was only added last week, it's very new, but it directly hooks Dart's certificate internals and should override both default and custom certificate pinning settings for all TLS connnections in any app using Flutter v2 or newer.

[smsactives]

Let's get to it so you can understand better and help me. According to HttpToolkit, the application is in these versions with scripts, and I couldn't intercept it at all, only with Reflutter. Crazy, right?

Dart/3.8
Okhttp/4.11.0
( Android 9 )

[pimterry]

@smsactives ah yes, you'll also need the config.js file (with your configuration) to use any of the Frida scripts in that repo. Take a look at the README there for more info.

When you say:

I couldn't intercept it at all

Do you mean that the traffic doesn't reach the proxy, or the certificate is rejected, or the app crashes, or something else? It's helpful to be specific because they're very different problems.

[smsactives]

I was digging deeper and realized that ReFlutter injects Dart code directly into the APK to intercept and redirect HTTP/HTTPS calls made via dart:io. It forces them to pass through a manually specified proxy, completely bypassing the Android networking stack. This solves a fundamental problem with modern Flutter apps: they don't respect proxies or Android system certificates by default.

It's as if it places a proxy within the app and creates a new one in config.js. If I specify my proxy (IP and port), will I be able to do this?

[pimterry]

Yes - the native-connect-hook.js script takes over all network connections, and redirects them to your proxy (at a layer below Dart - it'll intercept absolutely anything in the target process, using any framework or any other tools).

You can use this alongside Reflutter for other features if you like. It will override Reflutter's network configuration to use the settings in config.js, but it won't change anything else.

This is only configuring network redirection though, not the certificate trust. You may see connections reach your proxy but fail because the certificate isn't trusted. You can use the android/android-disable-flutter-certificate-pinning.js script to handle that part, if you put your certificate details in config.js.

[smsactives]

Then the command would be ?
frida -U -l config.js ( Sem mexer nada do Codigo JS ) -l native-connect-hook.js -j android/android-disable-flutter-certificate-pinning.js -f br.com.... ?

[pimterry]

It should be -l for android/android-disable-flutter-certificate-pinning.js. You'll need to make sure the details in config.js are correct, just follow the instructions in the repo.

[smsactives]

Cool, thanks a lot for the advice and your time @pimterry, I'm contributing by buying the tool.