2

I followed a guide where the author connected Windows PC and iPhone to his home WiFi network. He installed mitmproxy and ran mitmweb.exe on PC. On iPhone he went to wifi settings and set a manual proxy setting to the local IP of the PC and he set for port the default port where mitmproxy listens at, which is 8080.

I followed it and it works for browser apps (after installing certificate from mitm.it). It even worked for an app like “Maps” but it doesn’t work for many others. I was unable to use App Store, it said “unable to connect”.

My questions are: did these apps detect a local proxy configuration and refused to connect? Why are they set up like? How can I bypass it?

1

The apps don't directly detect a local proxy configuration. In fact, if the proxy would only be a proxy by directly forwarding the traffic, it would probably work. The mitm proxy also breaks up any encryption in the traffic by issuing its own certificate instead of the server supplied one.

The problem here is, that every application that actually verifies the server certificate will notice that the supplied certificate from mitm.it is not valid.

There are some methods that are in place to check the validity.

The simplest one is, that the mitm.it certificate is not issued by a trusted CA (Certificate Authority).

Another method that could be at work here is public key pinning. By using this the application does not just expect any matching trusted certificate of the server, but a very specific one. If gets any other certificate, the validation fails.

Also see OWASP PKP

Now to the question on how to bypass this. This does depend on the configuration of the app. If you can import the CA of mitm into the iPhone and set it as trusted, it should work. At least if PKP is not used. There is not workaround for PKP that I know of. I hope there isn't one.

6
  • "There is not workaround for PKP that I know of": export the app, change the certificate, rebuild, reinstall.
    – ThoriumBR
    Nov 18 '19 at 21:44
  • I see that the documentation page of mitm.it actually has a pretty good description. docs.mitmproxy.org/stable/concepts-certificates Nov 18 '19 at 22:00
  • @ThoriumBR which would only be possible for jailbroken iPhones though. Nov 18 '19 at 22:01
  • "If you want to intercept the pinned connections, you need to patch the application manually. For Android and (jailbroken) iOS devices, various tools exist to accomplish this." Could it be done on a not-jailbroken android? Will this always involve recompiling the apps externally and then sideloading them as a developer or is there a mobile app that could modify other installed apps on phone itself to help mitmproxy to bypass PKP? What tools does the doc page refers to?
    – miran80
    Nov 18 '19 at 22:09
  • Non-rooted Android phones can use it too, if you allow "Insecure sources". That setting can be toggled without having root.
    – ThoriumBR
    Nov 19 '19 at 3:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.