In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text XML requests inside the packets sent over https protected channel?
Please note, the attacker has access to the application and could use a packet sniffer/analyzer but wouldn't the SSL encryption prevent them from getting the contents of the packets? How could they overcome that...
Install a custom SSL root certificate on the device (iPhone).
Add the proxy in the device settings.
Now the device will route all traffic over the proxy. Normally you could not decrypt this traffic but the proxy will use his own fake SSL keys to do this. The device does accept your fake certificate because you added a root certificate on the device. Based on this certificate the proxy can create valid SSL keys for every domain you like as a CA would do.
The attacker could Man-In-The-Middle attack their own iPhone by creating a custom CA.
SSL/TLS prevents third parties they don't trust from listening in. The attacker has no reason to distrust themselves and their iPhone allows them to make it trust whatever they want.
The format won't be safe, and shouldn't be (be, not contain) sensitive information.