I have some iOS app to pentest, and the target server is accessible only through the jailbroken iPhone's APN. My problem is, that I want to configure the traffic in such way so I can intercept and tamper HTTP request / responses in my desktop using Burp, and route them back to iPhone:


Should I install HTTP proxy on the iPhone, or is there another way of doing this?


I maybe completely wrong because I don't have a phone to test it, but if your computer provided a WiFi access point, then the phone would route to it. If you tethered your computer back to your phone, I believe all tethered traffic goes over the cellular side. If that works, then you have a nice circular route without any need to be jailbroken.

Since you are jailbroken anyway, though, you can accomplish the same thing by using pf with the route-to filter to force traffic from the PC to the outside interface. Appropriately modify the commands found at http://www.openbsd.org/faq/pf/pools.html#outgoing

| improve this answer | |
  • I might assuming something completely wrong, but isn't the phone needs a proxy listener in order to get back the HTTP request? – pert123 Feb 1 '13 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.