v1.
MODULE 10
eLearnSecurity © 2014
2
10. iOS Network Analysis
HOME PARENT REFERENCES VIDEO
3
10. iOS Network Analysis
In this section, we will focus on Network Analysis
of iOS devices.
This means that we will investigate the traffic
generated by iOS Simulators and mobile devices
attached to a network.
HOME PARENT REFERENCES VIDEO
4
10.1. Traffic sniffing
HOME PARENT REFERENCES VIDEO
5
10.1. Traffic sniffing
Let us first see how to sniff the traffic generated by
the simulator. To do this, we will use Wireshark.
Since the simulator uses the host interface, we can
just select the Ethernet interface in the Wireshark
main panel and start the capture:
HOME PARENT REFERENCES VIDEO
6
10.1. Traffic sniffing
With Wireshark running in background, run the
simulator and start browsing any website. As we
can see in the screenshot, we are able to intercept
all traffic generated by the simulator.
HOME PARENT REFERENCES VIDEO
7
10.1. Traffic sniffing
You sniff traffic in a similar manner on a physical
device, but we need to create a physical network
where the device will be connected.
This can be done in many ways. For example, you
can create an Access Point using a Wi-Fi adapter,
connect the device, and run Wireshark against this
interface.
HOME PARENT REFERENCES VIDEO
8
10.1. Traffic sniffing
The following image summarizes this setup. Our
laptop is connected to the Internet via Ethernet,
while the Wi-Fi adapter will be used to create a Wi-
Fi hotspot.
HOME PARENT REFERENCES VIDEO
9
10.1. Traffic sniffing
Once the device is connected
to our Access Point, we can
run any traffic analyzer tool
(such as Wireshark) in order to
sniff all traffic. In this case, our
device is connected to the
network iOSFA and our IP
address is 192.168.123.26.
HOME PARENT REFERENCES VIDEO
10
10.1. Traffic sniffing
Actual device
The following image shows the
traffic when we search for
‘elearnsecurity’ using Safari on
our device and Google as the
search engine.
Wireshark
HOME PARENT REFERENCES VIDEO
11
10.1. Traffic sniffing
As you can imagine, we can sniff all traffic
generated by the device. Of course, we are not able
to read SSL traffic.
HOME PARENT REFERENCES VIDEO
12
10.1. Traffic sniffing
With this configuration we can sniff any application
traffic. This is very important for security since
sensitive information can be revealed.
HOME PARENT REFERENCES VIDEO
13
10.2. Proxying simulators and actual devices
HOME PARENT REFERENCES VIDEO
14
10.2. Proxying simulators and actual devices
Now that we know how to sniff traffic generated
with simulators or physical devices, let us see how
we can configure a web proxy to intercept the
traffic.
This will allow us to perform further tests since we
will be able to edit incoming and outgoing
communications. Let us first focus on how to use
and configure a proxy with the simulator.
HOME PARENT REFERENCES VIDEO
15
10.2. Proxying simulators and actual devices
The first thing to do is configure the web proxy; in
this case, Burp Proxy. Once we start Burp, we can
open the Proxy tab and start configuring the
listeners. Select the first entry in the table and click
Edit.
HOME PARENT REFERENCES VIDEO
16
10.2. Proxying simulators and actual devices
In the new window, click on the drop-down menu
and select the interface on which the listener will
run. Here we set the listener at the address
192.168.1.138 on port 8080. Leave all other
options default.
HOME PARENT REFERENCES VIDEO
17
10.2. Proxying simulators and actual devices
Now that we have the listener running, we need to
configure the simulator to use the address and port
we just configured on the proxy. This is something
that cannot be done
from the simulator itself.
You have to go into
System Preferences,
then Network.
HOME PARENT REFERENCES VIDEO
18
10.2. Proxying simulators and actual devices
In the new window,
select the interface
to edit and click
Advanced…
HOME PARENT REFERENCES VIDEO
19
10.2. Proxying simulators and actual devices
In the Advanced
pane, select the
proxy tab and set
the address and
the port of the
proxy server (Burp)
for both HTTP and
HTTPS protocols.
HOME PARENT REFERENCES VIDEO
20
10.2. Proxying simulators and actual devices
With these settings, you should now be able to
intercept the traffic generated by the simulator. To
test it, start the simulator and then navigate to a
few web pages. If it works, you will see the all the
HTTP requests and responses in the Burp Proxy
intercept tab.
HOME PARENT REFERENCES VIDEO
21
10.2. Proxying simulators and actual devices
As we can see in the following snapshot, opening
http://www.google.com triggers Burp proxy and we
can see the entire request.
HOME PARENT REFERENCES VIDEO
22
10.2. Proxying simulators and actual devices
The proxy works for applications, too. Below, we
can see the traffic generated by the Maps app.
HOME PARENT REFERENCES VIDEO
23
10.2. Proxying simulators and actual devices
This configuration works well for
HTTP requests and responses,
but if the app (Safari, in this
case) generates HTTPS traffic,
the user will be prompted with a
pop-up about an unverified
certificate.
HOME PARENT REFERENCES VIDEO
24
10.2. Proxying simulators and actual devices
Before we see how to intercept and manage SSL
traffic, let us see how to set up a proxy for physical
devices. The following image summarizes the
environment configuration.
HOME PARENT REFERENCES VIDEO
25
10.2. Proxying simulators and actual devices
We will have a look at configuring the web proxy
Burp Suite on Windows 7; the steps are the same
for all OSs.
HOME PARENT REFERENCES VIDEO
26
10.2. Proxying simulators and actual devices
The first thing to set up is our web proxy machine.
Start Burp suite, navigate to the Proxy tab and then
the Options tab. In the Proxy Listeners pane, select
the default listener and click Edit.
HOME PARENT REFERENCES VIDEO
27
10.2. Proxying simulators and actual devices
In the new window, we have to set the listener
interface (or IP Address) and port. In our case, we
will set the IP Address to 192.168.3.22 and the port
to 8080. We can leave the other options default
and click OK.
HOME PARENT REFERENCES VIDEO
28
10.2. Proxying simulators and actual devices
The machine 192.168.3.22 now
has the web proxy running on its
interface, but the device still
needs to be configured to send
all traffic through the proxy
(HTTP proxy settings).
To configure the device, go to
Settings->Wi-Fi and click the blue
arrow of the Network you are
attached to.
HOME PARENT REFERENCES VIDEO
29
10.2. Proxying simulators and actual devices
This will open the selected
network settings, showing us
the IP Address, the router
address, etc.
If we scroll down, we can see
the HTTP Proxy section. The
default selection is “Off”.
HOME PARENT REFERENCES VIDEO
30
10.2. Proxying simulators and actual devices
You should choose Manual and
then insert the proxy
configuration (Host Proxy IP
address and port).
In our case, this was
192.168.3.22 and port 8080.
HOME PARENT REFERENCES VIDEO
31
10.2. Proxying simulators and actual devices
Now that we have set the device and the web
proxy we should be able to intercept HTTP traffic
generated by the physical device.
To verify the configuration, open the browser on
the device and navigate to google.com.
HOME PARENT REFERENCES VIDEO
32
10.2. Proxying simulators and actual devices
As you can see in the following image, the proxy is
working and we are able to intercept the device
request to google.com.
HOME PARENT REFERENCES VIDEO
33
10.2. Proxying simulators and actual devices
From the intercept pane we can edit requests and
responses, forward or drop them in the same way
we do when we run Web App Penetration Tests.
You can edit parameters, send custom requests,
etc.
This will work for all applications on the device that
use HTTP traffic.
HOME PARENT REFERENCES VIDEO
34
10.2. Proxying simulators and actual devices
Below, we can see an intercepted request issued by
the app iBooks.
HOME PARENT REFERENCES VIDEO
35
10.2. Proxying simulators and actual devices
While this configuration works well for HTTP
requests and responses, when we face secure
connections (HTTPS - SSL), we are not able to
intercept the traffic.
If you try to browse to https://www.google.com
neither Burp nor the device will display the request
or the web page.
HOME PARENT REFERENCES VIDEO
36
10.2. Proxying simulators and actual devices
Instead, the browser will
display a pop-up warning
about an untrusted certificate.
We can choose to install the
certificate and continue, or
block the connection.
HOME PARENT REFERENCES VIDEO
37
10.2. Proxying simulators and actual devices
As you can imagine, if you click “Continue,” the
connection works as usual and you are able to
intercept the traffic.
HOME PARENT REFERENCES VIDEO
38
10.2. Proxying simulators and actual devices
This seems to solve our problems with SSL
connections, but it does not. Now, only
connections to https://www.google.com will go
through the proxy, while all traffic to different
domains still does not seem to work.
We need a way to install and trust a certificate that
works for all connections. Let us have a look at
doing this on both types of devices.
HOME PARENT REFERENCES VIDEO
39
10.3. Proxying and Intercepting SSL Traffic - Charles
HOME PARENT REFERENCES VIDEO
40
10.3. Proxying and Intercepting SSL Traffic - Charles
Now that we know how to set up a working proxy,
let us see how to manage HTTPS requests and
responses. The easiest way to intercept SSL traffic
with the iOS Simulator is by using the Charles
proxy.
Charles is similar to other web proxies (Burp or
OWASP ZAP), but it offers a very handy little script
that installs the Charles CA certificate to the
Simulator.
HOME PARENT REFERENCES VIDEO
41
10.3. Proxying and Intercepting SSL Traffic - Charles
While for physical devices, we can install the
certificate by simply downloading it, the simulator
does not allow this. We need to manually add the
certificate entries in the Simulator
TrustStore.sqlite3 database located in the following
folder:
~/Library/Application Support/iPhone Simulator/<ios version>/Library/Keychains/
HOME PARENT REFERENCES VIDEO
42
10.3. Proxying and Intercepting SSL Traffic - Charles
The script can be downloaded at the following link.
Once Charles is installed on the machine, you
should extract the file named install-charles-ca-cert-
for-iphone-simulator.command from the .zip you and
then run it. This will install the Charles certificate
onto the simulated device.
HOME PARENT REFERENCES VIDEO
43
10.3. Proxying and Intercepting SSL Traffic - Charles
The first time we run Charles it asks if we want
Charles to automatically configure our Network
Settings. Click Grant Privileges to continue.
HOME PARENT REFERENCES VIDEO
44
10.3. Proxying and Intercepting SSL Traffic - Charles
When Charles main panel
appears, you should be able to
intercept all Simulator traffic.
Open up Safari on the Simulator
and navigate to
https://www.google.com and see
what happens.
HOME PARENT REFERENCES VIDEO
45
10.3. Proxying and Intercepting SSL Traffic - Charles
As we can see in the following screenshot, Charles
intercepts the traffic and displays requests and
responses in clear text.
HOME PARENT REFERENCES VIDEO
46
10.4. Proxying and Intercepting SSL Traffic - Burp
HOME PARENT REFERENCES VIDEO
47
10.4. Proxying and Intercepting SSL Traffic - Burp
Another technique for intercepting SSL traffic is to
install custom certificates on the simulator. With
custom certificates, we can use any web proxy that
permits a custom CA certificate (such as Burp
Proxy). Burp allows you to export its own CA
certificate, so we can save that cert and import the
saved certificate into the Simulator. Let us see how.
HOME PARENT REFERENCES VIDEO
48
10.4. Proxying and Intercepting SSL Traffic - Burp
The first step is to export the Burp CA certificate.
Depending on the browser you are using, there are
a few different steps. You can use the following
guide to do your export:
http://portswigger.net/burp/help/proxy_options_i
nstallingCAcert.html
HOME PARENT REFERENCES VIDEO
49
10.4. Proxying and Intercepting SSL Traffic - Burp
Once the certificate has been exported you should
have a file named PortSwiggerCA.pem. Now, install
it in the Simulator but instead of manually adding
each entry in the database, we can use a script
called AVDTrustStore. This script offers extra
features like listing, adding or deleting certificates
and you can get it here.
HOME PARENT REFERENCES VIDEO
50
10.4. Proxying and Intercepting SSL Traffic - Burp
Once downloaded, run the script with the -a option
followed by the certificate to install - in our case:
the Burp CA certificate. If the process ends without
error, we should see, “Certificate added”.
HOME PARENT REFERENCES VIDEO
51
10.4. Proxying and Intercepting SSL Traffic - Burp
With Burp Proxy still running on the machine we
can now try to hit HTTPS websites from the
Simulator. As we can see in the following images,
we are able to intercept all traffic!
HOME PARENT REFERENCES VIDEO
52
10.5. SSL Traffic for Actual Devices
HOME PARENT REFERENCES VIDEO
53
10.5. SSL Traffic for Actual Devices
These same steps are also valid for physical devices.
The only difference is in how we install the
certificate. While in the Simulator we had to add it
to the database TrustStore.sqlite3, for a physical
device we can download or open it with the
browser to install it. Let us see how to configure
both Charles and Burp.
Note: the steps are similar for all operating systems.
HOME PARENT REFERENCES VIDEO
54
10.5.1. Charles
Let us see how to configure Charles to intercept SSL
traffic from a physical device. First, start and set up
Charles proxy. Once you have configured it, test it
by browsing to a web page.
HOME PARENT REFERENCES VIDEO
55
10.5.1. Charles
Right now we are still not able to view SSL traffic in
clear text. So, browsing https://www.google.com
will show only encrypted traffic.
HOME PARENT REFERENCES VIDEO
56
10.5.1. Charles
Before adding the certificate to the device, open
the Proxy menu and select Proxy Settings. In the
new window, select the SSL tab, check Enable SSL
Proxying, set ‘*’ as the location and restart Charles.
HOME PARENT REFERENCES VIDEO
57
10.5.1. Charles
Just like the Simulator, we
have to install the CA
certificate on the device.
With Charles, it is a breeze.
We just need to browse to
the following URL with Safari:
http://charlesproxy.com/char
les.crt
HOME PARENT REFERENCES VIDEO
58
10.5.1. Charles
This will open the
screen ‘Install Profile’
where we can view
the Charles Proxy SSL
Proxying certificate.
HOME PARENT REFERENCES VIDEO
59
10.5.1. Charles
Now just click Install to trust
and install the certificate.
HOME PARENT REFERENCES VIDEO
60
10.5.1. Charles
From now on, HTTP and HTTPS traffic should be
intercepted by Charles and displayed as clear text.
To test it, browse to https://www.google.com and
verify that the traffic is in clear text.
HOME PARENT REFERENCES VIDEO
61
10.5.1. Charles
This works for applications, too. Here, we can see
the traffic intercepted while running Dropbox.
HOME PARENT REFERENCES VIDEO
62
10.5.1. Charles
Note that if we want to
delete the certificate from
the device, we can go to
Settings->General->Profile
and then click Remove.
HOME PARENT REFERENCES VIDEO
63
10.5.2. Burp
Now that we know how to set up Charles, let us see
how to configure Burp proxy. You should already
know how to configure the proxy, so we will focus
on how to extract and install the certificate on the
device. This is very similar to the steps that we saw
for Android and the iOS Simulator.
HOME PARENT REFERENCES VIDEO
64
10.5.2. Burp
Once the proxy is running, we need to download
the Burp CA Certificate to our system. This is the
certificate that we will install on the device.
Here is a guide that explains how to export it using
several different browsers.
HOME PARENT REFERENCES VIDEO
65
10.5.2. Burp
Now that we have the certificate stored on our
machine, we need to open it on the device.
We could take any of a few routes, here: we can
upload it to a web server and then browse to it
from the device, we can send it through email or
directly copy it to the device.
HOME PARENT REFERENCES VIDEO
66
10.5.2. Burp
In our case we will upload
it to a local web server and
then browse to the address
from the device. In the
same way we did with
Charles, we are asked if
we’d like to install the
certificate…
HOME PARENT REFERENCES VIDEO
67
10.5.2. Burp
Here again, click Install to
trust the certificate.
HOME PARENT REFERENCES VIDEO
68
10.5.2. Burp
With the proxy and the device set up, let us open
https://mobile.twitter.com. As we can see in the
following screenshot, we are finally able to
intercept the traffic in clear text.
HOME PARENT REFERENCES VIDEO
69
VIDEO: iOS Network Analysis
Click on the image to open the video.
HOME PARENT REFERENCES VIDEO
70
10. iOS Network Analysis
With these network settings, you are now able to
intercept all incoming and outgoing traffic from the
simulator and devices.
You can now perform any web-based security test
against the installed apps. So, we can try to find
and exploit SQL injections, Cross Site Scripting,
sensitive data leaks and so on.
Here is an example of an iOS app that is vulnerable
to XSS.
HOME PARENT REFERENCES VIDEO
71
References
WireShark Burp Proxy
Charles Proxy ADVTrustStore
iOS Skype XSS
HOME PARENT REFERENCES VIDEO
72
Video
HOME PARENT REFERENCES VIDEO
