4 ms·

How I Indexed The Daily (HTTP proxying using Charles for Mac)

40 points by conesus 16y ago

iuguy 16y ago
Charles is a reasonably ok tool, but if you want the equivalent of Charles on steroids, we use Burp Suite Pro (http://www.portswigger.net/ http://www.portswigger.net/) at Mandalorian. Burp suite pro costs about $200 and is worth every penny for both web app security testing and general web debugging. There's also a free version for personal use with a few things disabled, but still perfectly useful for debugging web apps.
brokentone 16y ago
Good writeup on the service. Too bad to hear it won't be continuing. The Daily needs to figure out information archival both in device and on their website.
bkaid 16y ago
Any suggestions on how The Daily (or others) could prevent people from using tools like Charles to capture SSL traffic?
- pretz 16y ago
  Verify the certificate you get during the SSL connection is the certificate you expect to see.
- moeffju 16y ago
  They could verify the server's certificate. Even if the user installs a new (trusted) certificate - as in this case - the app could still check the certificate information (fingerprint, domain name, O, etc.).
  - bkaid 16y ago
    I assume The Daily is using NSURLConnection. Doesn't NSURLConnection by default reject self signed certificates?
fdb 16y ago
I didn't know about the Charles tool. I've installed it and it really acts like a microscope for HTTP; sort of like Wireshark but higher-level. The ability to debug SSL is definitely the killer feature, though.
pyre 16y ago
Note: Trusting the cert @ http://charlesproxy.com/charles.crt http://charlesproxy.com/charles.crt could open you up to MitM attacks by other people using Charles. (This is assuming that it's a global cert for all Charles installs, which is what it sounds like from the article)
jipumarino 16y ago
Depending on your specific requirements, I recommend HTTP Scoop (http://www.tuffcode.com/ http://www.tuffcode.com/) for Mac OS X ($15). Not as feature packed, but it's been more than enough for my needs. It also does not require one to change the global network settings.
- mattfawcett 16y ago
  Scoop does not support viewing HTTPS traffic though as it just listens on the network interface rather than acting as a proxy.

40 points by conesus 16y ago

iuguy 16y ago

Charles is a reasonably ok tool, but if you want the equivalent of Charles on steroids, we use Burp Suite Pro (http://www.portswigger.net/ http://www.portswigger.net/) at Mandalorian. Burp suite pro costs about $200 and is worth every penny for both web app security testing and general web debugging. There's also a free version for personal use with a few things disabled, but still perfectly useful for debugging web apps.

brokentone 16y ago

Good writeup on the service. Too bad to hear it won't be continuing. The Daily needs to figure out information archival both in device and on their website.

bkaid 16y ago

Any suggestions on how The Daily (or others) could prevent people from using tools like Charles to capture SSL traffic?

pretz 16y ago
Verify the certificate you get during the SSL connection is the certificate you expect to see.
moeffju 16y ago
They could verify the server's certificate. Even if the user installs a new (trusted) certificate - as in this case - the app could still check the certificate information (fingerprint, domain name, O, etc.).
- bkaid 16y ago
  I assume The Daily is using NSURLConnection. Doesn't NSURLConnection by default reject self signed certificates?

fdb 16y ago

I didn't know about the Charles tool. I've installed it and it really acts like a microscope for HTTP; sort of like Wireshark but higher-level. The ability to debug SSL is definitely the killer feature, though.

pyre 16y ago

Note: Trusting the cert @ http://charlesproxy.com/charles.crt http://charlesproxy.com/charles.crt could open you up to MitM attacks by other people using Charles. (This is assuming that it's a global cert for all Charles installs, which is what it sounds like from the article)

jipumarino 16y ago

Depending on your specific requirements, I recommend HTTP Scoop (http://www.tuffcode.com/ http://www.tuffcode.com/) for Mac OS X ($15). Not as feature packed, but it's been more than enough for my needs. It also does not require one to change the global network settings.

mattfawcett 16y ago
Scoop does not support viewing HTTPS traffic though as it just listens on the network interface rather than acting as a proxy.