1

I have setup Charles Proxy app and it can captures my https request/response sent through browser. Now instead of using the browser, i have an app that setup a SSL connection to the server, and then the app construct a HTTP message and send over the SSL connection. I receive response from server so i believe everything is working fine. But somehow Charles Proxy cannot capture the message i sent. Technically i think what i do is not different from what the browser does. But i must be wrong here.

So what's wrong here ?

Improve this question
1

2 Answers 2

Reset to default
0

If I understand correctly, your setup is

app - mobile configured to proxy web requests - Charles Proxy on a PC - target server

If so, this is a correct setup, but the SSL traffic may be problematic, as the proxy will intercept the SSL traffic and the application may recognize this as a MitM attack (it expects to see the right certificate, but gets the one from Charles Proxy).

You can try browsing on the mobile to a http site and see if the traffic is intercepted.

  • If it is, then you will probably have a hard time analyzing the traffic from the app as it will defend itself against wht it perceives to be a MitM.

  • If it is not, then the proxy on the mobile is not set correctly

Improve this answer
2
  • Hi, thanks for your response. Yes it's actually a mobile app. If i use browser on mobile, Charles Proxy can capture the traffic. So i think the setup is correct. Do you mean that the app doesn't let Charles Proxy to intercept ?
    – namanhams
    Jul 8, 2015 at 17:57
  • The app is contacting her server in HTTPS and expects to see its certificate. What happens is that that Charles Proxy intercepts this traffic (otherwise it does not make sense to analyze it) and therefore terminates the HTTPS connection on its own certificate (ane presents it to the app). In a browser you would see a warning (certifictae does not match site, or similar) - the app just probably aborts the connection.
    – WoJ
    Jul 8, 2015 at 18:00
0

You could install Charles' Certification Authority certificate on the mobile, and try to run the proxy again. Probably the application is getting an error indicating an invalid certificate.

If this does not help, it can be possible that the application is not using the proxy indicated on the network settings. This is very common. If you use a rooted Android device (as any developer should), you can use an intercepting proxy to force all connections be routed to Charles. A good one is ProxyDroid.

This will not help if the app uses certificate pinning: it will never trust the Charles' certificate. To bypass that, you could unpack the app, change the certificate, and repack it back.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .