Description
Utility for sniffing SSL/TLS encrypted traffic on a jailbroken iOS device.
CFNetwork.framework
contains a debug/verbosity global, enforcing a dump of every packet transferred through it, to be
logged into device syslog in plaintext form. In order to have a nicer view with clean control flow of this traffic, we
attach each such packet appropriate TCP flags and write it back into a PCAP file.
This allows us to later dissect this traffic using popular and convenient tools (e.g. Wireshark 🦈).
Assuming you have a jailbroken iOS device, this Python3 tool can automate this process.
Installation
python3 -m pip install -U iosslsniffer
Prerequisites
Enable logging global
This package relies on the ability to modify Apples logging global, Thus requires a jailbroken device.
In addition, a global preference key is need to set AppleCFNetworkDiagnosticLogging
.
Howto
- Download and install
rpc_server
on
a jailbroken device. - Setting logging global, this can be done manually or using the integrated
rpc_client
in the sniffer.
CFNetworkDiagnostics
In order to enable CFNetworkDiagnostics
the key AppleCFNetworkDiagnosticLogging
needs to be set, this is done as
part of iosslsniffer setup
command.
A restart is required incase the key was not set.
Usage
Usage: python -m iosslsniffer [OPTIONS] COMMAND [ARGS]...
Options:
--help Show this message and exit.
Commands:
setup Setup all prerequisites required inorder to sniff the SSL traffic
sniff Sniff the traffic