What software to use to analyze TCP / UDP connections from applications on Iphone, Ipad?

S

savage_me2019-04-15 12:21:47

iPhone

savage_me, 2019-04-15 12:21:47

App installed on iPhone, iPad. It sends both HTTP/HTTPS requests and TCP/UDP requests.
The laptop distributes Wi-Fi. Iphone/Ipad are connected to the internet through this point.
1. Wireshark only shows the hosts that the application is requesting. But the body of the message is encrypted and therefore cannot be viewed.
2. Burp Suite allows you to install your certificate on your iPhone/iPad and allow all traffic to pass through Burp. But it only shows HTTP/HTTPS requests. And you need to catch more TCP / UDP requests and view their body.
3. Charles proxyallows you to install your own certificate, like Burp, but like Burp only catches HTTP/HTTPS connections. I managed to configure it so that it would show socket://... connections and redirect them to its host, but it still does not show the request body.
What software shows TCP / UDP with the body of these requests?

Reply

Answer the question

In order to leave comments, you need to log in

2 answer(s)

R

rPman, 2019-04-15
@rPman

https encryption is a standard, not the only one, ie. if you do not have http there, then you will first have to understand what kind of encryption is used, i.e. one of the reasons why ready-made proxies do not decrypt it for you. By the way, if the application itself is engaged in encryption, installing a certificate may not solve the problem, since the application can monitor its own.

H

h4r7w3l1, 2019-09-25
@h4r7w3l1

You can also use the iPhone to analyze network traffic perfectly:
Paid, but worth it. It perfectly listens to traffic from both apple servers and protected apps ssl pining / etc.
You can act as a proxy for an external connection.
It is worth taking a better look at this version of the bundle from the developer. Get a complete kit for automating
and testing rest api for free.
Also numerous chips in the form of a breakpoint, flexible filter settings, export to curl / har and other formats. Reproducing and modifying requests.
Simply put, a must have.
And here's another thing, you can test it completely free of charge for 60 or 90 days through a test flight, look for the faq on the link:
https://github.com/PixelCyber/Thor