starred/Proxyman

Fork 0

mirror of https://github.com/ProxymanApp/Proxyman.git synced 2026-04-27 00:55:57 +03:00

[GH-ISSUE #1835] SSL Pinning is globally not working properly on Proxyman #1826

New issue

Open

opened 2026-03-03 19:54:42 +03:00 by kerem · 3 comments

kerem commented

2026-03-03 19:54:42 +03:00

Owner

Originally created by @novitae on GitHub (Oct 31, 2023).
Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1835

Description

Few times in the past I've reported in the issues of this app that some requests from my jailbroken iPhone, with all the ssl bypass setup done, are mysteriously not being read on Proxyman, having the SSL error. And few weeks ago I switched to burp suite. And on burp suite I've not had once an issue with the requests that are failing to be decrypted on Proxyman.

Steps to Reproduce

The best step to reproduce to be sure is the Madrid identity lookup of FaceTime on iPhones. I guess that you won't have the appropriate stuff at disposition to test it yourself, but I'm writing it anyway.

Get an iPhone 7
Jailbreak it using palera1n and setup fakefs, then boot the phone with palera1n -f
On the iPhone, install SSL Kill Switch 2. Switch it on.

You can follow more precisely on the gist I made here https://gist.github.com/novitae/2f04999039a6012813fb122d35a4c044

Install the root certificate of Proxyman on the iPhone, and also the one of burp suite (I'm on not professional)
Listen and do SSL Proxying on *
Open FaceTime.
Type an email or phone number, and validate.
A request should be sent to query.ess.apple.com. This request is to check if the phone or email is connected to FaceTime, and so, callable.
The request on Proxyman will fail. The request on burp (default settings) will be decrypted.

Current Behavior

Not decrypted.

Expected Behavior

Should've been read.

Environment

App version: e.g Proxyman 4.13.0
macOS version: e.g macOS Sonoma

Originally created by @novitae on GitHub (Oct 31, 2023). Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1835 ## Description Few times in the past I've reported in the issues of this app that some requests from my jailbroken iPhone, with all the ssl bypass setup done, are mysteriously not being read on Proxyman, having the SSL error. And few weeks ago I switched to burp suite. And on burp suite I've not had once an issue with the requests that are failing to be decrypted on Proxyman. ## Steps to Reproduce The best step to reproduce to be sure is the Madrid identity lookup of FaceTime on iPhones. I guess that you won't have the appropriate stuff at disposition to test it yourself, but I'm writing it anyway. 1. Get an iPhone 7 2. Jailbreak it using palera1n and setup fakefs, then boot the phone with `palera1n -f` 3. On the iPhone, install SSL Kill Switch 2. Switch it on. You can follow more precisely on the gist I made here https://gist.github.com/novitae/2f04999039a6012813fb122d35a4c044 5. Install the root certificate of Proxyman on the iPhone, and also the one of burp suite (I'm on not professional) 6. Listen and do SSL Proxying on `*` 7. Open FaceTime. 8. Type an email or phone number, and validate. 9. A request should be sent to `query.ess.apple.com`. This request is to check if the phone or email is connected to FaceTime, and so, callable. 10. The request on Proxyman will fail. The request on burp (default settings) will be decrypted. ## Current Behavior Not decrypted. ## Expected Behavior Should've been read. ## Environment - App version: e.g Proxyman 4.13.0 - macOS version: e.g macOS Sonoma

kerem added the

bug

label

2026-03-03 19:54:42 +03:00

kerem commented

2026-03-03 19:54:43 +03:00

Author

Owner

@NghiaTranUIT commented on GitHub (Nov 1, 2023):

Thanks for opening the ticket but I'm not sure how to reproduce it since I don't have any jailbreak iPhone 7.

Can you get me the error log in the Help menu -> Advance -> Enable Debug Mode -> and copy me the SSL Error in the Terminal App?

One thing difference between Burp and Proxyman is:

Burp uses HTTP/2 by default
Proxyman use HTTP/1

=> Can you switch to HTTP/1.1 from Burp to confirm that you can decrypt HTTPS data?

@NghiaTranUIT commented on GitHub (Nov 1, 2023): Thanks for opening the ticket but I'm not sure how to reproduce it since I don't have any jailbreak iPhone 7. Can you get me the error log in the Help menu -> Advance -> Enable Debug Mode -> and copy me the SSL Error in the Terminal App? One thing difference between Burp and Proxyman is: - Burp uses HTTP/2 by default - Proxyman use HTTP/1 => Can you switch to HTTP/1.1 from Burp to confirm that you can decrypt HTTPS data?

kerem commented

2026-03-03 19:54:43 +03:00

Author

Owner

@novitae commented on GitHub (Nov 1, 2023):

Mmmmh well I didn't tested before submitting this issue, but now it seems it is working. You probably did a fix that I didn't know of since my configuration is the same as before.

@novitae commented on GitHub (Nov 1, 2023): Mmmmh well I didn't tested before submitting this issue, but now it seems it is working. You probably did a fix that I didn't know of since my configuration is the same as before.

kerem commented

2026-03-03 19:54:43 +03:00

Author

Owner

@novitae commented on GitHub (Dec 5, 2023):

@NghiaTranUIT I finally found an example of app that has this issue, and not on burp. Im going to put all the screenshots, and do my best to assist you to find a solution !

So the traffic of application of Kick (the streaming platform) on iOS is not decrypted in Proxyman, but is in Burp. Here is my Proxyman trying to pass the traffic in it (the SSL proxying is activated, it is just disabled for gateway.apple.com, it's normal, but otherwise it's a *).
Capture d’écran 2023-12-05 à 18 54 18

And here is Burp's interface with the same requests (simply opening the app Kick):
Capture d’écran 2023-12-05 à 18 56 32

My iPhone has both certificates installed and trusted, and as root. It is jailbroken, but I've disabled SSL Kill switch on the iPhone for the test, so the request should be as on a regular iPhone. iPhone 7, iOS 15.5.

@novitae commented on GitHub (Dec 5, 2023): @NghiaTranUIT I finally found an example of app that has this issue, and not on burp. Im going to put all the screenshots, and do my best to assist you to find a solution ! So the traffic of application of `Kick` (the streaming platform) on iOS is not decrypted in Proxyman, but is in Burp. Here is my Proxyman trying to pass the traffic in it (the SSL proxying is activated, it is just disabled for `gateway.apple.com`, it's normal, but otherwise it's a `*`). <img width="1512" alt="Capture d’écran 2023-12-05 à 18 54 18" src="https://github.com/ProxymanApp/Proxyman/assets/85891169/ea972edb-ba99-44ff-8bb7-5d5623fccbd1"> <img width="1137" alt="Capture d’écran 2023-12-05 à 18 54 10" src="https://github.com/ProxymanApp/Proxyman/assets/85891169/15a3595e-2ef6-4e75-bd65-6f71f4e76637"> And here is Burp's interface with the same requests (simply opening the app Kick): <img width="1512" alt="Capture d’écran 2023-12-05 à 18 56 32" src="https://github.com/ProxymanApp/Proxyman/assets/85891169/6e6138fd-c19b-4c29-872c-e7d71fc06bda"> My iPhone has both certificates installed and trusted, and as root. It is jailbroken, but I've disabled SSL Kill switch on the iPhone for the test, so the request should be as on a regular iPhone. iPhone 7, iOS 15.5.