2

I'm just learning the iOS security. This is completely a beginner question.

I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning functionality.

I've currently checked the SSL traffic of some apps over Burp Proxy. Even after installing Burp Proxy Certificate, some apps are throwing some Alerts, such that there is a fatal error, so the client failed to negotiate an SSL Connection. And I'm not sure whether it is the appropriate way or not.

But what is the exact and perfect way to figure it out ?

Thanks in Advance

1

Using Burp is a good way to test it. But don't forget to import Burp's CA certificate on the device so that it is trusted by the device. Visit http://burp in the device's browser and download and install the certificate.

Most apps will now work over SSL and you can see their traffic in Burp. But apps that still fail are doing more checks, i.e. 'pinning'.

You can do the same using mitmproxy. In that case, visit mitm.it in the browser to import mitmproxy's CA certificate into your device.

Edit It occurred to me that in Burp, you are not seeing the failed connections that the apps tried to make - you will only see successful ones. What I use to solve that is a tool called mitmdump, which is like a basic version of mitmproxy (mitdump comes with mitmproxy). It will not only show successful connections but also what SSL connections were refused by the client, so you will know what the app tried to do, and you can see that it was the app that refused to go any further.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.