[GH-ISSUE #945] Some iOS apps does not show traffic #940

Open
opened 2026-03-03 19:23:11 +03:00 by kerem · 12 comments
Owner

Originally created by @caioaugustofr on GitHub (Jul 29, 2021).
Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/945

Originally assigned to: @NghiaTranUIT on GitHub.

Proxyman version? (Ex. Proxyman 1.4.3)

2.30.0

macOS Version? (Ex. mac 10.14)

Big Sur (11.2)

Steps to reproduce

I configured the proxy on my iOS device to start monitoring traffic. When I open Safari and type an URL (even if HTTPS), I can see its traffic, however, when I open a certain app, I cannot see the traffic generated by it. The app in question is called "Tecnofit Box". I can make a video if it helps.

Originally created by @caioaugustofr on GitHub (Jul 29, 2021). Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/945 Originally assigned to: @NghiaTranUIT on GitHub. ### Proxyman version? (Ex. Proxyman 1.4.3) 2.30.0 ### macOS Version? (Ex. mac 10.14) Big Sur (11.2) ### Steps to reproduce I configured the proxy on my iOS device to start monitoring traffic. When I open Safari and type an URL (even if HTTPS), I can see its traffic, however, when I open a certain app, I cannot see the traffic generated by it. The app in question is called "Tecnofit Box". I can make a video if it helps.
Author
Owner

@onikishov commented on GitHub (Jul 30, 2021):

I have the same issue with Clubhouse app.

<!-- gh-comment-id:889881573 --> @onikishov commented on GitHub (Jul 30, 2021): I have the same issue with Clubhouse app.
Author
Owner

@NghiaTranUIT commented on GitHub (Jul 30, 2021):

After setting HTTP Proxy on your iPhone and you can see HTTPS Traffic (from Safari iOS) on the Proxyman app, it means you've set it up properly.

I'm not sure why some app traffic doesn't go through Proxyman via HTTP Proxy. Let me download the app and check it 👍

<!-- gh-comment-id:889883145 --> @NghiaTranUIT commented on GitHub (Jul 30, 2021): After setting HTTP Proxy on your iPhone and you can see HTTPS Traffic (from Safari iOS) on the Proxyman app, it means you've set it up properly. I'm not sure why some app traffic doesn't go through Proxyman via HTTP Proxy. Let me download the app and check it 👍
Author
Owner

@NghiaTranUIT commented on GitHub (Jul 30, 2021):

@onikishov Just wondering:

  1. Set HTTP proxy on wifi in your iPhone to Proxyman
  2. Open Safari iOS -> visit https://google.com
  3. Do you see the traffic on Proxyman app?
<!-- gh-comment-id:889883788 --> @NghiaTranUIT commented on GitHub (Jul 30, 2021): @onikishov Just wondering: 1. Set HTTP proxy on wifi in your iPhone to Proxyman 2. Open Safari iOS -> visit https://google.com 3. Do you see the traffic on Proxyman app?
Author
Owner

@onikishov commented on GitHub (Jul 30, 2021):

@NghiaTranUIT Yes, I see all traffic from Safari browser and many other apps, but not from this one. It seems like the app is ignoring proxy settings.

<!-- gh-comment-id:889887532 --> @onikishov commented on GitHub (Jul 30, 2021): @NghiaTranUIT Yes, I see all traffic from Safari browser and many other apps, but not from this one. It seems like the app is ignoring proxy settings.
Author
Owner

@NghiaTranUIT commented on GitHub (Jul 30, 2021):

@onikishov I've downloaded the lasted Clubhouse app, and I'm able to see its traffic

Screen_Shot_2021-07-30_at_20_21_30

Can you check other apps (such as Product Hunt, Unsplash, ...), which don't have SSL-Pinning.

<!-- gh-comment-id:889890972 --> @NghiaTranUIT commented on GitHub (Jul 30, 2021): @onikishov I've downloaded the lasted Clubhouse app, and I'm able to see its traffic <img width="1733" alt="Screen_Shot_2021-07-30_at_20_21_30" src="https://user-images.githubusercontent.com/5878421/127659124-a340f608-0c02-449d-9397-94eaa372ec49.png"> Can you check other apps (such as Product Hunt, Unsplash, ...), which don't have SSL-Pinning.
Author
Owner

@NghiaTranUIT commented on GitHub (Jul 30, 2021):

@caioaugustofr I tried Proxyman on your app, and it looks like Tecnofit Box is using Firebase for the authentication & APIs.

If it's, we could not intercept Firebase traffic because it doesn't use the HTTP transport layer.

Screen_Shot_2021-07-30_at_20_27_55

Ref: https://groups.google.com/g/firebase-talk/c/RPSQwV7WpLs

<!-- gh-comment-id:889895511 --> @NghiaTranUIT commented on GitHub (Jul 30, 2021): @caioaugustofr I tried Proxyman on your app, and it looks like Tecnofit Box is using Firebase for the authentication & APIs. If it's, we could not intercept Firebase traffic because it doesn't use the HTTP transport layer. <img width="1526" alt="Screen_Shot_2021-07-30_at_20_27_55" src="https://user-images.githubusercontent.com/5878421/127660422-2fe3f812-430f-48d4-8e40-3c6cdaee061d.png"> Ref: https://groups.google.com/g/firebase-talk/c/RPSQwV7WpLs
Author
Owner

@onikishov commented on GitHub (Jul 30, 2021):

@NghiaTranUIT Many thanks for investigating the issue. It seems the problem with my iPhone. Tried another iPhone, works fine.

<!-- gh-comment-id:890015808 --> @onikishov commented on GitHub (Jul 30, 2021): @NghiaTranUIT Many thanks for investigating the issue. It seems the problem with my iPhone. Tried another iPhone, works fine.
Author
Owner

@caioaugustofr commented on GitHub (Jul 30, 2021):

@NghiaTranUIT, thanks for the info. So, in other words, it is not possible to intersept the traffic of this app?

Another thing, I tried it with android emulator. It shows a request made to rest.tecnofit.com.br, however, I cannot see its content, because I get ssl handshake failed.

<!-- gh-comment-id:890219683 --> @caioaugustofr commented on GitHub (Jul 30, 2021): @NghiaTranUIT, thanks for the info. So, in other words, it is not possible to intersept the traffic of this app? Another thing, I tried it with android emulator. It shows a request made to rest.tecnofit.com.br, however, I cannot see its content, because I get ssl handshake failed.
Author
Owner

@NghiaTranUIT commented on GitHub (Jul 31, 2021):

@caioaugustofr Yes, there is no way to intercept Firebase SSL traffic.

Regarding the Android app,

  1. Do you installed & trusted Proxyman Certificate on your Android Emulator?
  2. Have you added a config to security.xml and manifest.xml? (Step 4 in this guideline https://docs.proxyman.io/debug-devices/android-device)

Both steps are required in order to intercept HTTPS Traffic from Android app.

<!-- gh-comment-id:890268178 --> @NghiaTranUIT commented on GitHub (Jul 31, 2021): @caioaugustofr Yes, there is no way to intercept Firebase SSL traffic. Regarding the Android app, 1. Do you installed & trusted Proxyman Certificate on your Android Emulator? 2. Have you added a config to security.xml and manifest.xml? (Step 4 in this guideline https://docs.proxyman.io/debug-devices/android-device) Both steps are required in order to intercept HTTPS Traffic from Android app.
Author
Owner

@jesus-mg-ios commented on GitHub (Aug 7, 2021):

@NghiaTranUIT, Why iOS App cannot capture TCP or UDP datagrams? Is that possible with packet tunnel or I'm wrong?

<!-- gh-comment-id:894692962 --> @jesus-mg-ios commented on GitHub (Aug 7, 2021): @NghiaTranUIT, Why iOS App cannot capture TCP or UDP datagrams? Is that possible with packet tunnel or I'm wrong?
Author
Owner

@NghiaTranUIT commented on GitHub (Aug 8, 2021):

@jesus-qt It's possible to capture TCP/UDP from Proxyman, Charles Proxy or Fidder if this feature is supported. At the moment, none of them supports it.

If you use Packet Tunnel from the NetworkExtension framework from Apple, you can capture TCP/UDP.

If you'd like to see TCP/UDP traffic, please try Wireshark 👍

<!-- gh-comment-id:894728361 --> @NghiaTranUIT commented on GitHub (Aug 8, 2021): @jesus-qt It's possible to capture TCP/UDP from Proxyman, Charles Proxy or Fidder if this feature is supported. At the moment, none of them supports it. If you use Packet Tunnel from the `NetworkExtension` framework from Apple, you can capture TCP/UDP. If you'd like to see TCP/UDP traffic, please try Wireshark 👍
Author
Owner

@jesus-mg-ios commented on GitHub (Aug 9, 2021):

@NghiaTranUIT I'm trying to do this without external vpn server, but I cannot redirect traffic to internet reading with packet flow and writing to packetFlow. Any suggestions? I don't want to create by hand a socket to redirect the traffic to internet and then to the apps (because I think it's too complex and I have no idea how to do this)

<!-- gh-comment-id:895027929 --> @jesus-mg-ios commented on GitHub (Aug 9, 2021): @NghiaTranUIT I'm trying to do this without external vpn server, but I cannot redirect traffic to internet reading with packet flow and writing to packetFlow. Any suggestions? I don't want to create by hand a socket to redirect the traffic to internet and then to the apps (because I think it's too complex and I have no idea how to do this)
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Proxyman#940
No description provided.