3

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text XML requests inside the packets sent over https protected channel?

Please note, the attacker has access to the application and could use a packet sniffer/analyzer but wouldn't the SSL encryption prevent them from getting the contents of the packets? How could they overcome that...

Improve this question

2 Answers 2

Reset to default
3

The attacker can perform a man-in-the-middle attack on him self. Basic steps are:

  1. Setup a proxy like SSLsplit or Charles Proxy on a computer.
  2. Install a custom SSL root certificate on the device (iPhone).
  3. Add the proxy in the device settings.

Now the device will route all traffic over the proxy. Normally you could not decrypt this traffic but the proxy will use his own fake SSL keys to do this. The device does accept your fake certificate because you added a root certificate on the device. Based on this certificate the proxy can create valid SSL keys for every domain you like as a CA would do.

For details look at a tutorial:

Improve this answer
4

The attacker could Man-In-The-Middle attack their own iPhone by creating a custom CA. SSL/TLS prevents third parties they don't trust from listening in. The attacker has no reason to distrust themselves and their iPhone allows them to make it trust whatever they want.

The format won't be safe, and shouldn't be (be, not contain) sensitive information.

Improve this answer
1
  • I really liked an upvoted your answer. I felt the other answer offers more detail and might be more useful for future readers if they happen to stumble upon this question.
    – AturSams
    Nov 5, 2014 at 20:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .