Meh
So now we know that sonims update server is password protected. Can’t “sniff” it
Question is if its possible to get the password out of the updater APK.
Looks like it’s not a hardcoded password.
Send like the APK builds and auth key based on your device:
const-string v2, "?auth_key=%s-%s-0-%s"
And there’s no way to reverse engineer that?
I mean, you could set up a mitm proxy in your PC. Haven’t done it , but the info is available online.
Should be able to see everything
Basically, everything would go through there by setting a proxy on the phone. Might need to install a cert there. Dunno how that would work.
To be clear again, there is very little chance the firehose is in there.
I tried that already.
It wouldn’t trust the user certificate.
https://d.offlinesoftware.solutions/t/capturing-and-inspecting-ota-firmware-updates/4136/68?u=dev-in-the-bm_2.0
You have a nextdns account, does that log querys for you to see?
Probably logs queries, but we need URL’s and the actual traffic/communication, not just domains.