How to Proxy iOS Applications

This tutorial will demonstrate how to proxy / intercept encrypted traffic from your iPhone browser or iOS apps. Making load testing and penetration testing of APIs much simpler and realistic.
This tutorial should work on any recent version of iOS (mine is 10) and on any recent iPhone (mine is a 5s)
This process will work similar on any major proxy, the only difference is getting the CA certificate on to the device as well as configuring the proxy to listen for the iPhone, but again. The process should be very similar.

[@frozen_tortus]

Very well done tutorial. Thanks man!

[@2704minhmeo]

Thank you very much :) Your video is exactly what I have been looking for. Very short and easy to follow.

[@ogre43]

Thank You Bro. Concise, clear description. Best of

[@imransyafiq9100]

Very helpful video, thanks mate!!!

[@richarddobson4marrickville]

that was dope dude - thanks

[@hildafardiah9593]

it's worked. thanks dude!

[@patricklaffey]

Thanks, this was exactly what I was looking for for a project I'm working on!

[@JSONSEC]

Thanks for letting me know you found it helpful ☺️

[@zarulnizar5696]

Why i didn’t found the http proxy in my wifi setting as you show? 😭

[@dt99]

Am I able to simply remove the PortSwigger CA profile after installing it?

[@chibunmar7313]

is there a way that iphone can be the proxy server like the "every proxy" in android

[@foxgameplay5449]

i face one issue when i use vpn in ios , than it never receive any request in burp ? any solution for this ?

[@Luey2.0]

Can you use any proxy or do you need specifics?

[@jamesleetrigg]

Thanks for the help, it would be nice to split the video up so we can skip to the part we need :)

[@user-bq1bv3vc4y]

instructions unclear im in the electric chair in prison

[@Pwnedby]

What abouts TLS?

[@fatihsahin6863]

isnt ip address changing every time you connect to the wifi ? so the thing you done isnt temporary until the next connection? thank you very much

[@JSONSEC]

IP's refresh somewhat randomly, but if that's a problem you can always set it to static :)

[@user-rr8jg5hn5b]

Thanks for sharing, this is really cool, even 4 yrs later LOL! Please correct me if I’m wrong, this is only for when you are on the same network as your laptop with burp running, and for specific use case, right? Thx! @Jason

[@JSONSEC]

Yep , have to be on the same network

[@user-rr8jg5hn5b]

Ah okay, still very cool, thanks for sharing 😃

[@fxiittthhh]

hi, when i press allow download, it says "Profile Downloaded. Review the profile in the Settings app if you want to install it". However, i cant find the certificate. How can i solve this?

[@fxiittthhh]

ok i found it but the certificate is unverified, what could be the issue?

[@animaljam1231]

so when im on the last step to search and make sure burp is capturing anything, it does capture something but the internet is still unusable so it doesnt actually capture anything useful.

[@animaljam1231]

nevermind! i was confused. i was turning intercept on and then i realized that i needed to go to http traffic on burp to see. when i had intercept on, is when the wifi on my ios device would stop working. thanks!

[@user-wm1xe7vy2j]

Can Burp filter the intercepted traffic by app, instead of having a large list of traffic which could be coming from multiple apps and the OS itself?

[@JSONSEC]

Yep, you can adjust this in the scope settings

[@akankshachand2644]

I am not able to access internet on the ios device when the proxy is changed to manual.

[@JSONSEC]

This looks like the certificate wasnt installed properly

[@gagansharma9999]

Sir in started which website from purchase a proxy

[@JSONSEC]

Are you asking where to download the proxy? You can get Burp Suite from portswigger.net/

[@soufiane-wu3mb]

How do I know the correct PORT for my device? I put yours and it didn't work

[@JSONSEC]

It can be anything, so long as they match, default should be 8080

[@drip3889]

my phone isn't able to connect to the internet and post anything while proxy'd. Help

[@fedemolto]

Same problem here, cant find any solution...

[@user-vn2og3wn7v]

The CA certificate page doesn’t load, i have everything set up good and tried multiple times do you know why its not working?

[@JSONSEC]

Seems like burp isn't running on that port, check it's enabled and the proxy is running into the port you're trying

[@user-vn2og3wn7v]

@@JSONSEC The proxy is running, but once I connect, it says next to my wifi name “No Internet Connection” and on safari “server stopped responding”

[@user-oc4fu7zy9t]

thank you for your video, but my iphone can't connect to internet when I set up the proxy. (it works on wifi without proxy) Burp Alert Menu message said that "the client failed to negotiate an SSL connection to ~~~~443: Remote host closed connection during handshake". can you help me please ?

[@user-oc4fu7zy9t]

oh it works on the other iphone that even i didnt jailbreak.. anyway thank you for your video

[@JSONSEC]

Seems like it's a problem with the certificate for the first issue. Try generating it and importing it again

[@Blue-Robin]

Is there a way to block traffic? Like a Crunchyroll ad or something. That would be AWESOME right? Then you can block ads without downloading and paying for AdGuard or something.

[@JSONSEC]

I think you can set up some rules in the proxy config yeah. But would probably be better building a pi hole for your home network

[@kingeasy2701]

can i do that to an application?

[@JSONSEC]

Any that doesn't bundle is own certs and use SSL pinning

[@devious7590]

i keep getting "burps server ip address could not be found" any suggestions?

[@devious7590]

when trying to get my ca certificate

[@fany6051]

What iphone do you use sir? iphone 7 or 6 or 5?

[@JSONSEC]

I think this was a 6s

[@fany6051]

@@JSONSEC okay sir, thanks for your information

[@niraj5302]

How to jailbreak iphone 7

[@JSONSEC]

You don't need it for this tutorial. But checkout Reddit r/jailbreak for specific instructions

[@michaelprenez-isbell8672]

sorry, doesn't work at all. as soon as I enter the proxy on the iphone, disconnected from internet. no good.

[@JSONSEC]

Thats 'meant' to happen, you need to install the certificates to allow it to pass through SSL traffic

[@vegetamoustache4556]

Unfortunately it doesn't work on all applications, which is a shame

[@Motionk3]

what applications does it not work on?

[@Motionk3]

does it work on snapchat and tiktok and messages?

[@JSONSEC]

The apps it dosent working have SSL pinning, this can be bypassed too but much more difficult. Have a video planned to go over it.

[@maasondelgado8001]

@@JSONSEC Did you make that video mate, I did not work for instagram, and on HelloTalk I was only able to send post requests, but my device was still somehow recieveing data but it was not working properly

[@sosadollaz5538]

What if I don’t have a lap top

[@JSONSEC]

Then this tutorial will not work for you...

[@sosadollaz5538]

JSON SEC any methods for people to do it solely on there iPhone?

[@sosadollaz5538]

JSON SEC I mean, imagine the the market that could be tapped into for a proxy server for ios 🤷‍♂️ 🤔

[@JSONSEC]

I guess I've never really considered that as a practical use-case. I have seen some proxy apps out there on the app store, but haven't bothered with them really you'll just be too constrained carrying penetration tests just from an iPhone. far too limiting...

[@sagarsk9956]

You said applications but it's not..

[@JSONSEC]

It's not what....?

[@tuna2188]

does the device need to be jailbreaked?

[@zxbushidoxz]

Are they any free alternatives?

[@JSONSEC]

Burp is free

[@zxbushidoxz]

@@JSONSEC for the professional ?

[@KwanasiaReynolds]

Hello new here need help !

[@JustDaixD]

dude its not working on ios 16?

[@JSONSEC]

Whats your issue?

[@JustDaixD]

@@JSONSEC its not capturing the traffic on ios 16, even though I installed the certificate

[@JSONSEC]

Have you configured ip address and ports correctly?

[@JustDaixD]

@@JSONSEC yea i did, now the problem is solved, in ios 16 we have to enable developer options first or else debugging just wont work!

[@Jaikumar-gt7mh]

want jailbreak ??? the iphone

[@JSONSEC]

Yes.

[@stinkybread5177]

Why would you show your IP address

[@JSONSEC]

I could explain why it's safe for me to show that IP address, but I want to understand why you think it's an issue.

[@stinkybread5177]

@@JSONSEC because you are showing other people your location

[@JSONSEC]

@BigCheese Wheel That's actually incorrect. An IP Address does not reveal your exact physical location, you can also use other tools to obscure it further. Additionally this IP address shown is an *Internal* IP address which is what's used for my local network only. Each device on your local network has it's own IP address, but when you connect to the internet, all the devices on your network share the same IP Address and your router forwards the packets to the correct device. This process is known as NAT. This is all to say that revealing an Internal IP address within my network (not my public IP) is harmless, most networks by default will have the same IP Range internally (192.168.0.xx). Does that make sense, let me know if you need anything clarified :)

[@AbelPinales]

@@JSONSEC I've always wondered WHY some people show it and other's don't this makes so much sense. Thanks

[@hesburgerhelsinki3479]

mmm

[@wicorn29]

Bob

[@rifqiggkrinyol6937]

Hi, my name is Rifqi and I'm from Indonesia, help me sir, currently in my country everyone is playing Higgss domino island, can you make a cheat / mod apkk / trick trick that is not detected and can be used in the game? please help sir, so that our family life can change,,. I hope there is a way or trick / application that you gave...