0

I need to inspect some traffic from my iPhone to debug an application, which is going and coming from an https address.

Since I don't have a Mac at the moment, I tried with Paros proxy, which I had used before. It's working fine with http connections, but whenever I try to open a website with SSL encryption in Mobile Safari it says that the certificate is not trusted. I can "Continue" and it would work, but not on Applications.

How can I set up a trusted certificate with Paros and the iPhone?

Thanks in advance, Alex

UPDATE: I'm going to try and create my own SSL certificate for testing with Windows' MakeCert

UPDATE 2: For some reason I could get Windows SDK to install, so I haven't tried this yet...

UPDATE 3: Now trying with OWASP ZAP, in case someone has more experience with it.

1 Answer 1

0

Have you tried using OWASP ZAP?

The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.

Its a fork of Paros which is being actively developed (unlike Paros;) I havnt tried proxying traffic from an iPhone, but we have rewritten the SSL handling, so it may work.

Generate a root CA cert for ZAP and then import it into your iPhone.

Let me know how you get on!

3
  • I have generated a certificate using ZAP, in the Dynamic SSL Certificates tab, and imported it to the iPhone. Also installed it on my computer. But whenever I browse an https address it shows an error message saying it's not trusted (On the iPhone) Am I missing something? Jul 3, 2012 at 11:02
  • I'm afraid I dont have an iPhone so I cant try this out myself. But I've asked on our dev list: groups.google.com/d/topic/zaproxy-develop/SxGsm3phKWw/… and will update this thread if anyone has any good suggestions. Jul 4, 2012 at 9:23
  • When you imported it into your iPhone, did you have the option to install it as a trusted CA? I've just found this article, which is a bit old, but may help importing Root certs: searchconsumerization.techtarget.com/tutorial/… Jul 4, 2012 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .