Mobile Networking · Watching Traffic · Lesson 2 of 4

Intercepting Proxies

Route your own test phone through a proxy and read what its apps send.

A proxy on your own phone

An intercepting proxy is a program that sits between a phone and the internet and shows you every request the phone's apps make. Developers use one to debug their own apps. Security testers use one to check apps for leaks. Free tools such as mitmproxy do this job.

HTTPS normally blocks this, which is a good thing. The proxy can only read encrypted traffic if the phone trusts the proxy's own certificate, and that means you install it on the phone yourself, on purpose. Without that step, apps and browsers see a certificate they don't trust and refuse to connect, just like the café attacker in Course 2.

Only do this on a phone you own, or one you have clear permission to test. Reading other people's traffic without permission can be illegal, and it's a serious breach of trust.

The lab shows your own test phone running a demo weather app through a proxy. Tap each request in the log and look at its headers. Then switch on App uses certificate pinning and watch what changes.

Why phones push back

Installing a proxy's certificate is harder than it used to be. Both phone systems now add hurdles, to protect people from being tricked into it.

On Android, certificates you add yourself go into a user certificate store. Since Android 7.0, called Nougat, apps built for that version or newer ignore this store by default. They only trust the certificate authorities that came with the phone. An app has to opt in to trust yours, often only in its debug builds. That's why the demo app in the lab is a test build set up for this.

On iPhone, installing the certificate as a profile is only step one. Since iOS 10.3, you also have to switch it on in Settings, under General, About, Certificate Trust Settings. Apple calls this enabling full trust. Until you do, the phone won't trust it for secure connections.

These hurdles exist for good reason. A trusted rogue certificate could let someone who controls your network read your private traffic. If you find one on your phone that you or your workplace didn't add, remove it.