0

I have an iOS app with certificate pinning to two different servers.

I want to test this certificate pinning with a MITM attack, so I did:

  1. Set proxy at my PC, in macos wifi settings -> advanced -> proxies -> enabled http/https proxy.
  2. Installed Dynamic SSL cert on simulator.
  3. It works, I can see https data when I open some webpage in Safari.
  4. Run the app. App doesn't work (because one of this two certificate pinnings did work).
  5. I'm unable to test the second certificate pinning.

Is it possible to disable proxying for one URL and enable for second? Make some requests go straight to desired URL, with SSL certificate at that URL?

Improve this question

1 Answer 1

Reset to default
1

Yup we have an FAQ for that: https://www.zaproxy.org/faq/what-options-exist-for-selective-proxying/

Options include:

  1. Via a Browser Add-on/Extension
  2. Via Global Excludes
  3. Via a PAC (Proxy Auto-Config) File
  4. Set “No Proxy For” in Your Browser
Improve this answer
3
  • 1 and 4 won't work for me, since I'm not using browser. Tried 2: added Global Exclude URL ^.*$ and enabled. It still uses OWASP Zed Attack Proxy Root CA (for this page right now in macos chrome browser, for example). Will try to set up PAC in macos wifi settings.
    – desudesudesu
    Mar 21, 2020 at 16:26
  • PAC did work, although PAC setup on macos does not work with file:/// -- easiest solution was "python -m SimpleHTTPServer 8000". Also, I've noticed macos network has exception list under "Bypass proxy settings for these Hosts & Domains", this works too.
    – desudesudesu
    Mar 21, 2020 at 17:17
  • 1
    Glad one of the options worked for you, thanks for following up with additional details too. That'll help others in the future.
    – kingthorin
    Mar 21, 2020 at 22:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .