[HFZhyonn]

Hey guys I have been looking into the credential harvester method in the SEToolkiit and I have a question. Let's say I was targeting users that use a specific application on their mobile device. For example the application iFunny. It has no web browser version as it is only available for mobile devices such as iPhone or Android etc. I don't have a login url to clone the website. Is there a way to get around this?

[zer0pwn]

you would have to intercept the credentials as they're being sent to ifunny's login server. either that or you could make a fake ifunny apk and get an android user to download it

[Inferno]

and probably the first method wouldnt work cause it would probably have https and not http

[zer0pwn]

and probably the first method wouldnt work cause it would probably have https and not http

there are still ways to break ssl

[n3cr0]

If they are on wifi network would trying a fake router MitM attack with something like sslstrip work. Another far fetched idea maybe phishing attack. (I have only touched on these areas myself please steer me right if im wrong)

[lIIlIIl]

Create a website that looks like the apps loginpage? Or did i missunderstand the question?

[BiometriX]

Don't think k4rm4's method would work, they open the app and only connect via api's like OP mentioned no browser involved.
Look into mitm and test it first with your phone