I'm using a free version (3.11.5 as of this writing) of Charles Proxy and proxying my iPhone through it to attempt to reverse engineer some real-time features of an app I'm using.
I'm successfully able to see all http/https request in and out of the device. There are, however, web sockets (was://) that are open on the app that I cant see. It's only listing http/https requests.
Is there a setting I'm missing? Is the free version limited? Thanks.
It could be that the app you are proxying is not using the proxy settings you have defined in your iPhone’s “Settings”. If this is the case, you’d need a version of the app which adheres to the user defined proxy settings in order to see the WebSocket traffic in Charles.
Related
When I use Charles Proxy for iOS and play some games, I recognize that they etablish connections with the protocol prefix "socket://" followed by an IP address (instead of a hostname, which is always present for other HTTP(s) connections). I'd assume that those are websockets.
Currently, I'm trying to implement a tool to track rudimentary network activity. To archive that, I'm using the NEKit (https://zhuhaow.me/NEKit/) in combination with the NEPacketTunnelProvider extension for iOS. Using that, I was able to set up a local HTTP Proxy server and setup the network interface to redirect every HTTP(s) request over that local proxy. Through an observer, I was able to see all the requested hostnames.
Now I found out, that some games (those which are using websockets) are not working properly with my solution. Regarding to this discussion https://news.ycombinator.com/item?id=16694670 it seems like proxying the HTTP(s) data flow doesn't enable me to handle websocket connections:
Yes, but the problem with Charles (well, iOS related at least) is that iOS websockets don't go through the HTTP Proxy configured. They're just considered a raw socket. Thus, even on desktop Charles, it's a nogo.
Due to that, some apps don't even work when my tracker is enabled, since they can't etablish a connection to their servers.
Is there the possibility to archive something similar for the websocket connections since the combination of GCDHTTPProxyServer (NEKit) and NEProxySettings (NetworkExtension) is only working for HTTP(s)? How can I track and (even better) proxy websocket connections?
I'm using Charles Proxy and Wireshark to monitor http(s) traffic from various iOS apps I'm using on my iPhone. These apps require me to set the HTTP Proxy under the iOS Wifi settings (let's call these the Proxy Settings).
My business needs to see ALL URL's that are being called from my phone. From all apps. All URL's, not some of them.
Now Charles and Wireshark both work fine and I can see a ton of traffic coming from my phone.
However, I can't help but wonder whether I might be missing some HTTP calls. Maybe calls that don't use the Cocoa Core Foundation libraries as the basis for their networking.
For instance, I could write my own HTTP library out of TCP/IP and these would bypass the Proxy Settings.
So my question is: what is the likelihood that some apps are using custom-rolled HTTP libraries and side-stepping my Proxy Settings. Or worse, they're using raw TCP/IP to communicate with a server. I know it's possible, but do any APIs work this way? Does anyone do it?
I found the answer: Use mitmproxy in transparent mode. proxy is not used. harder to setup because it needs work on the router, but it reliably captures every packet on port 80 and 443 regardless of proxy settings.
Assuming that you are able to keep your device tethered, then you may be able to use the pcap service to monitor all traffic. According to the following paper (2014) the pcap service is running on every iOS device:
"Identifying back doors, attack points, and surveillance mechanisms in iOS devices"
You should be able to connect to it via usbmuxd. I'm not sure whether there is a pre-rolled client for the pcap service. There is a list of services supported by libimobiledevice here. Pcap is not on that list.
Alternatively, you can use wireshark to capture all traffic on your wifi network.
Is there a way to intercept HTTP requests in the iPhone? e.g. something in the NSNotificationCenter I can register for so my app would get notified each time an HTTP request will go out or an HTTP response will come in?
I searched a lot but no luck,
Thank you
no you cant intercept HTTP requests with your app - you can of course act as a proxy for your OWN app's request but you cant proxy other apps' requests
From your question its not clear what you want to do, but i would suggest either implementation NSURLProtocol class or using PonyDebugger.
NSURLProtocol:
Create a subclass of NSURLProtocol class that will handle all web protocols such as HTTP, HTTPS, SSL etc. This is a abstract class that provides the basic structure for performing protocol-specific loading of URL data.
Once your created your custom URL protocol, register it in appDelegate class so your protocol will have priority over any of the built-in protocols.
[NSURLProtocol registerClass:[MyURLProtocol class]];
PonyDebugger:
if you just looking to intercept all your http request i would try this tool. PonyDebugger is a remote debugging toolset. It is a client library and gateway server combination that uses Chrome Developer Tools on your browser to debug your application's network traffic and managed object contexts.
AFNetworking:
if your using the very popular AFNetworking for your network request they automatically send notification. try to register the following two:
AFNetworkingTaskDidResumeNotification
AFNetworkingTaskDidCompleteNotification
Do you just want to view all of the HTTP/HTTPS traffic going to / from a single device that you have control of (e.g for debugging purposes)? If so, just setup a proxy and use that to monitor the requests.
If you're talking about building this into an app for general release, I'd very much hope this wasn't possible, and that if it was, I'd suspect it wouldn't make it through app store approval.
If you just want a debugging proxy:
For Windows, download Fiddler (free), and use your and follow the instructions here (install a cert on your phone and use the IP address of the machine running Fiddler as the proxy address):
http://docs.telerik.com/fiddler/configure-fiddler/tasks/ConfigureForiOS
For Mac OSX, Charles will also do the job (I've used it for this purpose and it works well):
http://www.charlesproxy.com/documentation/faqs/ssl-connections-from-within-iphone-applications/
I am working on an ios app which communicate with the server via http request. And I want to monitor the network traffic when testing my app in ios simulator/devices.
Is there any software or tools I can used to inspect the http requests of a specified application on mac/ios, just like firebugs for web developers?
Thanks.
As far as I know, there are several tools in App Store that provide the network traffic monitor feature. But, they could only view iPhone as a whole and stay at that level. In other words, they could only tell how much traffic has been consumed of this iPhone. For each app? No data.
You can use HTTP Catcher to capture web traffic. It's a Web debugging proxy for iOS, so you can view requests and responses directly on iPhone.
You can use Proxyman to record/capture all the requests & responses from your app while developing.It will support ios simulators also. Without doing any code change we use this.
First Download the Proxyman app form the above link after that just go through this documentation for references.
Charles has recently released an iOS version for http traffic monitoring. it is a paid app though. Good news is that you can set up Charles free desktop version then setup HTTP proxy from your iOS device.
I'd like to see the request / responses that an iphone app makes.
I mostly work on web apps, and I can use firebug / fiddler to see them. But how can I see incoming/outgoing traffic of an iOS app, if im running it on my wireless?
The Charles Web Proxy (and I believe Fiddler as well) allow connections from external hosts, when configured properly. In Charles, you will need to make sure your iPhone is added to the Access Control List in Proxy -> Access Control Settings.
After that, you can simply set your iPhone's proxy to your computer's Charles or Fiddler instance. In my case, my local desktop is at 192.168.10.1, thus my iPhone's proxy is set to:
192.168.10.1:8888
One problem, however, may be if you want to decrypt SSL traffic. It may be difficult to get the iPhone to add Fiddler or Charles' certificate to the keychain.
You could share your mac wireless to the iphone
And then use some tool, i personally use http://www.charlesproxy.com/ for these kind of issues
You could pick a tool from
https://superuser.com/questions/99870/mac-wireshark-alternatives