Capturing ios application traffic using BurpSuite

Step 1: Install burp suite on your Laptop/Desktop.

If you haven’t already installed burp suite on your hacking machine please follow the blog to install burp suite.

Step 2: Get the ip of your hacking machine from the command prompt using ipconfig command. Make sure that both the devices (Windows/ linux and the ios device are on same network.)

Step 3: Configure the burp for listening the incoming traffic to your system using your system ip and any port(9999 for example)

Step 4: Open the Wifi settings on your ios device, press on “i” button next to the connected wifi name. (Make sure your hacking machine i.e., laptop/desktop and the mobile device both are connected to the same wifi for capturing the traffic.

Step 5: Once you click on “i” Button you will be on the below looking page, scroll down to the end there is an option to configure proxy. Press on the arrow mark to the right.

Step 6: Under the proxy option we need to select manual and then enter the ip of the laptop/desktop that we got from the step 2 and select any port for example, 9999, or 8080 etc.

Step 7: Save the changes.

Step 8: Now make sure that the burp intercept is turned to off.

Step 6: Open any browser(safari also works)on the ios device and browse to http://burp.

Step 7: Clicking on the CA Certificate will download a burp profile.

Step 8: Once the profile is download we need to install that profile. For that Go to Settings> General > Profile & Device Management > Downloaded profile (PortSwigger CA) > Install > Enter your passcode > Install >

Step 9: Save the changes by clicking on done once the profile installed screen is visible.

Step 10: All set to capture the traffic on burp from any app on the ios device, now turn on the intercept and browse anything on the browser/any application to check the proper configuration.

Well, Not so fast, this is not Android or your normal desktop browsers we are talking about, you will not be able to capture yet, now we need to do SSL pinning bypass for the applications for which you want to capture the traffic, unless by design it doesn’t have that implemented..

If you check you Burp suite dashboard, you must get some errors like below that means you gotta learn SSL pinning bypass for the ios application.

Well that’s for another blog, Till then Adios Amigos.