RSA keys in iOS

darkly · 2015 年9 月 23 日 14:10

Hi.

I want to decrypt https traffic, taken by tcpdump from my jailbroken iphone (ios 8.3). As i understand, i have to use private RSA key to decrypt incoming https traffic. I explored my filesystem and find only Keychains database, but it looks like to be quite useless.

Does anybody know, how can i get RSA private key used by Safari?

snakeninny · 2015 年9 月 24 日 13:57

If your target is analyzing https traffic, take a look at Charles

darkly · 2015 年9 月 24 日 16:08

Thanks for answer. I thought about http proxy, but i found no way to implement automatic proxy configuration when my phone enters new network, and i really need it. Do you know, is itpossible to dedicate proxy settings for all the networks at all?

So, my decision is to write shell-script which runs tcpdump and sends captured packets to my server in internet using sftp. But so i have to decrypt https traffic, and i need to have private RSA key Safari uses.

darkly · 2015 年9 月 25 日 08:34

It looks like there is pf in ios, which can be used to perform proxy settings, but there’s no pf.conf file in filesystem.

darkly · 2015 年10 月 5 日 08:47

The solution is - Apple Configurator + mitmproxy.

snakeninny · 2015 年10 月 5 日 13:39

Can you give us a more detailed solution?