Sniff Android and IOS app traffic for privacy audit

Question

I am trying to figure out a way to sniff Http and Https traffic from app, to see who the app is sharing data with, and what data the app is sharing. The information should be used to audit whether the privacy policy informs correct or not. The solution must be viable both on windows and OS X.

So far I have tried charlesproxy(on OS X and Iphone), but whenever I set up a proxy I cannot get any internet connect through the app I am testing. Does anyone know what might cause this? Or is there a better setup I should try?

Answer 1

Have you installed the certificate from Charlesproxy on your Android/IOS device? If no, the TLS handshake will fail, and you have no connection. If yes, it is possible that the app uses Certificate/Private-Key Pinning. In case it's very difficult to intercept the connection.

For Android you can setup an Android-Emulator with root (https://www.genymotion.com/) and install the xposed framework. There is a Module too hook the validation-funktion. But this don't work for all ways of implementin certificat-pinning.

You can also disassemble the APK-file and patch the code. After that you can reassemble the code and install the app.

Answer 2

Troy Hunt advocates the use of Fiddler in his Pluralsight video "Hack yourself first". see here

So if you install Fiddler on your pc, and then share your internet connection to your phone, then you can see the traffic flow. HTTPS will be encrypted, naturally.

Answer 3

I would use Kali, arpspoof your target and gateway and then open wireshark

1.Open Kali and connect to the network

2.Identify your interface (eth0 or wlan0)

3.Identify your target's ip address with nmap. Also make sure to identify the gateway address.

Example:

nmap 192.168.1.0/24

• Let's assume our target is 192.168.1.50
• Let's assume our gateway is 192.168.1.254

4.setup your kali box to forward ip traffic

echo 1 > /proc/sys/net/ipv4/ip_forward

Make sure you include the target in the arpspoof otherwise you will poison the entire network and you're going to have a bad time

5.aprspoof your gateway and tell it to associate your mac address with the target's ip address

arpspoof -i wlan0 -t 192.168.1.254 192.168.1.50

6. arpsoof your target and tell it to associate your ip with the gateway's mac address

arpspoof -i wlan0 -t 192.168.1.50 192.168.1.254

7. open wireshark and use your interface (wlan0 in my example)

8.profit

--As a side note it is easy to SSL strip from this point as well if you wanted to see what was being sent over HTTPS

You can read more here on arpspoofing (not my site)