iOS security attack using Charles for network data capture

Charles is a common Web Capture tool under MAC systems (Paros is also good), commonly used fiddler under Windows. The genuine Charles is charged (PS: Support Genuine), the Chinese people prefer to crack version of Charles (thank bloggers, good people for a lifetime of peace, please support bloggers).

The main functions are as follows:

1. Intercepts Http and HTTPS network packets.
2. Support to re-send network requests, convenient back-end debugging.
3. Support for modifying network request parameters.
4. Supports interception and dynamic modification of network requests.
5. Supports analog slow networks.

After the software is installed:

　　

　　

The next crawl of the phone software packet needs to be configured: Proxy->proxy settings, port: 8888, tick the Enable transparent HTTP proxying.

　　

is the IPhone and the computer under the same LAN, open the system settings, network Proxy settings: Mobile browser access: Http://charlesproxy.com/getssl Install the description file.

　　

After setting a successful access to the network, Charles will pop up the box below and click Allow.

　　

If you need to intercept information about the HTTPS protocol, you need to install Charles's CA certificate. Select "Help", "SSL proxying", "Install Charles Root Certificate"

　　

After the keychain is successfully installed, you will need to enter a user name password to trust the certificate.

If you need to get the HTTPS protocol content on your phone, you'll need to install the certificate on your phone. "Help", "SSL proxying", "Install Charles Root Certificate on a Mobile Device or Remote Browser"

Note that even after the certificate is installed, Charles does not intercept HTTPS network traffic by default, and if you want to intercept all HTTPS network requests on a site, you can right-click on the request and select SSL Proxy.

Next the Mode network:

Simulate a slow network or a high-latency network to test whether the application behaves properly under a mobile network. Charles has provided a good support for this requirement. On the Charles menu, select "Proxy", "throttle Setting", in the dialog box that pops up, we can tick "Enable throttling" and set the type of throttle Preset. As shown in the following:

　　

　　

Use Charles's Repeat feature to simply test the concurrency of the server, by right-clicking and selecting Repeat Advanced. The number of measurements can be selected.

　　

　　

　　

To modify the contents of a network request:

　　

iOS security attack using Charles for network data capture