I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite Community Edition, Charles Proxy and Wireshark.
I have tested the following strategies with various degrees of success (but never full success):
Burp Suite and Charles Proxy
Setup: Burp Suite/Charles Proxy running on a Mac, with the proxy's CA certificate installed on the iOS device. The iOS device is configured to use an HTTP proxy.
Problem: Only intercepts certain requests not made by Xamarin's native
HttpClient API, such as Google Analytics, which is not useful in analyzing the API of interest.
Setup: iOS device connected via USB cable to the Mac, made a network interface on the Mac per this guide so as to capture packets direct from the iOS device by letting Wireshark read from that network interface.
Problem: All requests are HTTPS and can't be decrypted.
VPN and Burp Suite
Setup: By making a VPN that the iOS device connects to, all traffic will be routed through that VPN and into Burp Suite. The VPN is set up on a Linux Mint VM with its network adapter bridged to my Mac's Wi-Fi card.
Problem: I partially followed a tutorial that describes a PPTP VPN with Burp Suite, but iOS 10 and above has dropped support for PPTP. Attempts to replicate with OpenVPN yielded unsatisfactory results (another post on ServerFault here).
Question of the day
How does one effectively and (hopefully relatively easily) intercept HTTP(S) traffic from an iOS mobile app that does not respect system proxy settings?