Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

IOS 13.4.1 Jailbreaked with Burp 2021.7.1 cert doesn't work

Marco | Last updated: Jul 27, 2021 09:53AM UTC

Hi to all, I'm using Burp 2021.7.1 Windows versione with Iphone 6s IOS 13.4.1 with Jailbreak I have tried to use burp for http traffic but it doesn't works in any way. I have also restored the device at factory reset, jailbreaked and tried to install cert that I have activated and full trusted in General --> About --> Certificate Trust I also have tried with mobile assistant but when I run Test cert check fails. There is no way to have a works cert. Please help me. I need to use it for my works.

Ben, PortSwigger Agent | Last updated: Jul 27, 2021 06:28PM UTC

Hi Marco, Just to confirm, when you are proxying traffic from the browser on your mobile device through Burp, are you seeing any errors being reported or is it simply the case that you are not seeing any requests being proxied?

Marco | Last updated: Jul 28, 2021 12:54PM UTC

If I browse bing, google and other https generally works but for https://www.apple.com the browser response is the the cert is invalid and connnection is not privated. Also app like appstore and all other apps doesn't works.

Marco | Last updated: Jul 30, 2021 07:01AM UTC

Any solution? I need to use burp for mobile app testing.

Uthman, PortSwigger Agent | Last updated: Aug 02, 2021 08:17AM UTC

Hi Marco, Can you please try some of the suggestions in the threads below? - https://forum.portswigger.net/thread/ios-13-burp-ssl-certs-not-able-to-be-fully-trusted-2b208cf6 - https://forum.portswigger.net/thread/configuring-a-burp-root-ca-certificate-in-ios13-4844f34d

Marco | Last updated: Aug 05, 2021 11:08PM UTC

Operation seems to be improved in android by applying the solution from second link https://forum.portswigger.net/thread/configuring-a-burp-root-ca-certificate-in-ios13-4844f34d even if not all applications works. Amazon for example still doesn't works. For Android device I'm using V9 rooted with ProxyDroid and Magisk module to move from user cert to system cert root. In IOS 13.4.1 nothing is changed and still to works only some https site. Apple.com doesn't work and also all apps can't works. Please helpme because I need it for my works. The problem is not Amazon app (I don't need to test it), but some customer application that can't works like Amazon app. (proxy is configured as transparent)

Uthman, PortSwigger Agent | Last updated: Aug 06, 2021 09:06AM UTC

Have you asked the developers of the app about certificate pinning? Could there be some hardcoded logic preventing the use of a proxy? Have you tried disabling TLSv1.3 on your proxy listener in Burp? Can you please email support@portswigger.net so that we can assist you further?

Marco | Last updated: Aug 06, 2021 04:00PM UTC

I have send email as requested.... I wrote my response also here in the forum... Thanks a lot 1) Yes, I have disabled TLSv1.3 2) Yes, there is logic to prevent proxy usage so in Android I'm using proxydroid..... For IOS I have tried to setup a local VPN with OpenVPN to redirect traffic to proxy but problem still with all apps therefore the problem is wider 3)in Android I'm using LSPOSED with SSLUnpinning module. For IOS I haven't found any way for Unpin ssl cert So with Android the situation is better although not all apps work. I can't share customer app but if you want to test I think that you can use latest Amazon app for Android (very old version of Amazon app works). With IOS the problem seems to be more serious because with the exception of some https site nothing works. Thanks a lot Best Regards.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.