Sniffing iOS apps traffic

Recently, I wanted to find out how other developers deal with subscription related issues on Apple’s Newsstand for iPhone/iPad, i.e. whether and if yes how developers use Urban Airship or other solutions.
I couldn’t find a useful app that can do what I wanted to do: To find out what conversation is going on between the app and the server. I ended up with the following setup:

• Pair iPad/iPhone with Mac (or Windows) via Bluetooth
• Share Internet connection (on Mac: Share LAN or WiFi on Bluetooth – see screenshot):

Settings for sharing internet on bluetooth

Settings for sharing internet on bluetooth

• Install Wireshark on Mac
• Log traffic using Wireshark while using the Newsstand app.

Below is a screenshot of what has been captured from the iPad Newsstand app:

Wireshark protocol example

Wireshark protocol example

Downside: If you connect your device to the internet via Bluetooth and a shared internet connection, iOS won’t allow to download new issues or connect to the AppStore. I.e. you’ll have to sniff WiFi traffic and connect via Wifi (or find an app that can monitor all outgoing traffic on your apple device) to log this part of the conversation. As far as I know, a jail-broken iThing can override the “WiFi only” limitation, but I haven’t tried it myself.

The above way to capture network traffic from iPhones/iPads should also be a warning to iOS developers using their own servers to communicate with the app: It is quite easy to see where the app is connecting too, so the server side should better be ready for dealing with unauthorized access.

Post a Comment

You must be logged in to post a comment.