This is one of those things that is super simple and I figure most folks have already done or know how to do. There may be a few people out there whose time I save with this post. Who knows. Lets get on with it.
Just as with the Droid apps, when an untrusted certificate (Burp) shows up for an app requiring SSL/TLS, the app crashes and burns. The best way (same as Droid) to fix this is to import Burp as a trusted Certificate Authority (CA).
Why would we want to do this? Apps on mobile phones are cool but some would argue the web-services the apps are communicating with can be even juicier. We'd like to intercept the communication to the web-services and play around a bit.
You'll need to export the Burp Certificate, I usually open Firefox, set the browser to run thru Burp, view the certificate, export the certificate. Much like this.........
Hopefully that was easy enough to follow along. Now you can proxy your iPhone apps thru Burp.
~Happy Hacking
Just as with the Droid apps, when an untrusted certificate (Burp) shows up for an app requiring SSL/TLS, the app crashes and burns. The best way (same as Droid) to fix this is to import Burp as a trusted Certificate Authority (CA).
Why would we want to do this? Apps on mobile phones are cool but some would argue the web-services the apps are communicating with can be even juicier. We'd like to intercept the communication to the web-services and play around a bit.
You'll need to export the Burp Certificate, I usually open Firefox, set the browser to run thru Burp, view the certificate, export the certificate. Much like this.........
Browse to https://twitter.com (while proxying thru Burp)
"Get Certificate"
Select PortSwigger's cert
Save Certificate with a .cer extension (.cer is what the iPhone recognizes)
Start a web server to host the PortSwiggerCA.cer
Browse to the location of the PortSwigger.cer file
The iPhone detects .cer, asks you to install as a CA, do it :-)
WiFi configuration, click the blue arrow on the right of your network
Configure with Burp's IP & Proxy
~Happy Hacking