[BUG] Disable HTTP/3 about instagram-ssl-pinning-bypass

[Eltion]

Seems like there is a configuration file located at /data/data/com.instagram.android/mobileconfig/<sessionId>.data/0.mctable which can be used to configure if app will use HTTP/3.
This file is created after login, after the app sends a request to https://b.i.instagram.com/api/v1/launcher/mobileconfig/, unfortunately it's not clear which parameter is for HTTP/3 😥.

Seems like deleting the file disables HTTP/3 so I'll do that until I figure out a better solution.

0da439c

[tulir]

I think Instagram may have enabled HTTP/3 recently, which is UDP and bypasses usual proxy configurations. There's an issue for mitmproxy at mitmproxy/mitmproxy#4170, and I'd guess the Android emulator's proxy configuration also doesn't affect HTTP/3 at all.

As a quick workaround, I blocked all UDP traffic on my machine except port 53 (DNS) using iptables:

sudo iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
sudo iptables -A OUTPUT -p udp -j DROP

(if you have IPv6, repeat those with ip6tables)

After that all requests are visible in mitmproxy

@Eltion perhaps it would be possible to patch the app to not use HTTP/3?

[polatdev]

this problem still persists.

[Eltion]

@tulir Your right about this. It seems like after login and reopening the app instagram is using HTTP/3. Thanks for reporting it.

I've been trying to force HTTP2, had some success with it but the script is not as robust as it was before so I need to work a bit more into it. I just created a new branch for it here: disable-http3.

main...disable-http3

Like this it will work for the current version (260.0.0.23.115) but it will break for each release, so I need to find a better way to do it.

[ChrisVinall]

I am still getting the same issue as #27 (HTTPS capturing works on first app run, not on subsequent runs) but no mobileconfig directory even exists in the specified location. Any idea what is going on here? I'm running instagram-v265.0.0.19.301-x86.apk. Thanks!

[Eltion]

@ChrisVinall can you test using the latest version

https://github.com/Eltion/Instagram-SSL-Pinning-Bypass/releases/download/v275.0.0.27.98/instagram-v275.0.0.27.98-x86.apk

[ChrisVinall]

Ah, my bad, that works. Not sure how I was running such an old version, I thought I was up to date.

The nuking of the whole config is causing another issue for me related to app behaviour, but I'll try to figure it out.

[Anilmemis]

when to share ssl pinning bypass for 284 version ?