5 ms·
Download the Charles app on your iPhone, turn it on, use the app you’re interested in, then look at Charles to see what network calls the app made while you wer
by zachrose 5y ago
Download the Charles app on your iPhone, turn it on, use the app you’re interested in, then look at Charles to see what network calls the app made while you were using it.
- hamburglar 5y agoOr install MITMProxy on your laptop, install your newly-generated root CA cert on your phone, and point your phone’s http proxy to your MITMproxy port. I prefer this to installing an app on my phone.
- tome 5y agoSurely the phone notices that the root certificate is not one of those it already knows about?
- NovemberWhiskey 5y agoAll the device knows is that it trusts some root CAs and not others. You add your personal root CA to the trusted list; so it's trusted. Unless the site uses some kind of certificate pinning (c.f. HPKP), one trusted root is as good as another. This is how TLS inspection is done on corporate networks. IT will apply a group policy that puts a company-owned root certificate into the trusted roots on your Windows machine - maybe the same one that's used for the rest of your internal PKI. You then issue a subordinate CA from that root, and your web proxy infrastructure (Bluecoat or whatever) then uses that CA to do just-in-time provisioning of certs for whatever domains you're intercepting.
- saagarjha 5y agoThe phone doesn’t, as the sibling comment mentions, but the app might (if it’s doing certificate pinning).
- sbmthakur 5y agoDoes this work with SSL-pinning enabled?
- jasonladuke0311 5y agoNo, I believe you would have to recompile the app with your cert or use Frida or something to hook the cert check function.
- mraza007 5y agoWow this is very useful and I’ll definitely try that app to see which apps are making what network calls
- deleted 5y ago[deleted]