Charles Proxy now available on iOS

Post by s14ve » Wed, Mar 28, 2018, 3:43 PM UTC

jawngee wrote: post #49

yodon wrote: post #34

Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)

Except on iOS you get: - Prompt to allow app to act like VPN - Having to enter your passcode after said prompt It's impossible for apps to MITM silently.

Post by robterrell » Wed, Mar 28, 2018, 3:52 PM UTC

t1o5 wrote: post #92

zuck9 wrote: post #41

Earlier quoted context omitted.

How do you intercept traffic from apps that use cert pinning? Is the only way to patch the app binary and reinstall the patched binary using a dev certificate? How exactly does one go about patching the binary – is there a tutorial somewhere?

Won't an app worth its salt use certificate pinning to prevent this mitm ? In other words - Can I use Charles to sniff FB or watsapp traffic ? I do not use both services, but interested in analyzing their traffic.

Post by robterrell » Wed, Mar 28, 2018, 4:00 PM UTC

joshenders wrote: post #50

joshenders wrote: post #3

mitmproxy has worked on iOS and Android for years now and is OSS and easy to use

I get the sense the Charles users are just not familiar with mitmproxy. Here’s a guide I wrote awhile ago to get you up to speed: https://gist.github.com/joshenders/2b0dc14c89a8769f64a7

Post by dsl » Wed, Mar 28, 2018, 4:32 PM UTC

olliepop wrote: post #4

Charles can already be used as an http/https proxy on iPhone via https://www.charlesproxy.com/documentation/faqs/using-charle... I generally would only be needing to inspect requests when developing at my workstation, so how is this native app providing additional value beyond what the Charles Mac software already provides? Big fan of Charles over here, I just don't understand the use case for the native app.

Post by evilduck » Wed, Mar 28, 2018, 5:11 PM UTC

Operyl wrote: post #108

evilduck wrote: post #100

Earlier quoted context omitted.

Charles for the desktop can intercept secure websocket traffic.

Yes, but the problem with Charles (well, iOS related at least) is that iOS websockets don't go through the HTTP Proxy configured. They're just considered a raw socket. Thus, even on desktop Charles, it's a nogo.