iOS Network Instrumentation

The Challenge of Encrypted Traffic

Modern iOS applications heavily rely on HTTPS and often implement SSL Pinning to prevent Man-in-the-Middle (MITM) attacks. This makes traditional packet capture tools like Wireshark less effective, as the payload remains encrypted.

To analyze this traffic, we need to inspect it before encryption or force the application to trust our own MITM certificate. This is where dynamic instrumentation with Frida shines.

Bypassing SSL Pinning

On modern iOS versions, applications use the Security framework to validate server trust. The API SecTrustEvaluateWithError is commonly used for this purpose.

By hooking this function and forcing it to return success, we can bypass the pinning check entirely.

// Hook SecTrustEvaluateWithError to bypass SSL Pinning
try {
    var secTrustEvaluateWithError = Module.findExportByName("Security", "SecTrustEvaluateWithError");
    if (secTrustEvaluateWithError) {
        Interceptor.attach(secTrustEvaluateWithError, {
            onLeave: function (retval) {
                // Force return value to true (1) indicating trust
                retval.replace(1);
            }
        });
        console.log("[+] SecTrustEvaluateWithError hooked");
    }
} catch (e) {
    console.log("[!] Error hooking SecTrustEvaluateWithError: " + e.message);
}

Logging Requests Directly

Sometimes, bypassing SSL pinning isn't enough, or we just want a quick look at the traffic without setting up a proxy. We can hook NSURLRequest to log headers and bodies directly from the application's memory.

// Log all NSURLRequests
if (ObjC.available) {
    var className = "NSURLRequest";
    var methodName = "- initWithURL:";
    var hook = ObjC.classes[className][methodName];

    Interceptor.attach(hook.implementation, {
        onEnter: function(args) {
            // args[2] is the NSURL object
            var url = ObjC.Object(args[2]);
            console.log("[*] Request to: " + url.absoluteString());
        }
    });
}

This approach gives us immediate visibility into the API endpoints the app is communicating with, which is often the first step in reverse engineering a private API.

Conclusion

By leveraging Frida to hook into the iOS Security and Foundation frameworks, we gain complete control over the application's network layer. This allows us to audit security implementations, debug networking issues, and understand the data flow of closed-source applications.