6

I'm doing some research into the privacy of various iOS applications. My main source of data is via wireshark or Burp (HTTP/S proxy). This has been rather successful for MiTM for decrypting HTTPS traffic, however the app I'm focusing on right now appears to encapsulate XMPP/Jabber traffic in TLS, hence it does not go via the proxy and I cannot decrypt.

Is anyone aware of a good tool that acts as a general purpose protocol agnostic TLS proxy?, which will allow me to load a cert on the iOS device and the machine acting as the TLS proxy to ultimately view the unencrypted payload?

I've been looking at stunnel, but can't figure out if this is going to do the trick.

closed as off-topic by schroeder Sep 15 '18 at 7:34

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

3

You will want to read the following paper:

This is a fantastic piece of work that performs static analysis of iOS applications to detect privacy leaks.

They build a static analysis tool that analyzes iOS applications, detecting what private data the app reads, whether it sends that private data out over the network, and if so, to where. They then apply their static analysis tool to a large collection of iOS apps and show that their tool is effective and highly accurate; their work finds a large number of apps that are leaking private data (e.g., the unique ID of the phone that the app is running on).

I'd expect static analysis to be more effective than examining network traffic, and less tedious to use, so it is an important alternative to the approach you are currently taking.

Overall, this is a brilliant, innovative piece of research that I encourage you to read carefully.

2

You could try your luck with ettercap. You can configure it with a private key to use, and configure the cert that belongs with it in the iPhone's keystore. I'm not sure wether it picks up non-port-443 traffic by default, but I think it's able to decrypt any TLS connection if it has the key.

2

AFAIK Jabber and XMPP are XML based protocols, so there's no real reason why Burp couldn't intercept them.

Where you may be having problems is that there's no way within the client app to specify a proxy.

What I've done in the past with burp in this kind of instance is to use the "Support invisible proxying for non-proxy-aware client" option in the proxy options tab. you can specify your endpoint server and port there and then in the client specify a target server of the burp IP address and port and it'll forward on from there.

2

you can try using Fiddler2, it has the option of generating certificates for iOS devices and it can intercept and decrypt HTTPS traffic.

1

I wrote a MiTM extension for burp that handles Non-HTTP protocols and will also decrypt SSL connections as long as you export Burp's CA cert to the device or application you are testing.

It even includes a DNS server and custom python scirpts that can automatically modify your requests as they pass through the proxy.

http://blog.fusesoftsecurity.com/2016/08/non-http-proxy-for-burpsuite.html

0

I wrote a tool to MITM iOS XMPP apps that use XMPPFramework. It requires a jailbroken iPhone:

https://github.com/BrianHenryIE/XMPPFrameworkLogger

Not the answer you're looking for? Browse other questions tagged or ask your own question.