|
11 months ago | |
---|---|---|
README.md | 11 months ago |
Using a Mac with Xcode for non jail broken devices.
iDevice, Mac with Xcode and tcpdump installed.
Wireshark (Multiplatform)
connect iDevice to a MAC
get your iDevice UDID in Terminal type:
system_profiler SPUSBDataType | sed -n -e '/iPad/,/Serial/p' -e '/iPhone/,/Serial/p' | grep "Serial Number:" | awk -F ": " '{print $2}'
src ), or if you have Xcode installed src:
instruments -s devices
example UDID string would be: 1e3b5cbfb5
Use the found UDID to create a new virtual network interface based on you iDevice:
rvictl -s 1e3b5cbfb5614ab31731a7afeade0e6a1f18d021
To see the new interface:
ifconfig -l
It will be listed as 'rvi0'
From Wireshark 1.12 and up one can directly listen to the rvi0 interface. Alternatively, just record a bunch:
Record/sniff/dump the packets send to and from your iDevice with tcpdump (...) into file .output.pcap
sudo tcpdump -i rvi0 -w ./output.pcap
Stop the capturing with CTRL+C
Stop and remove the virtual interface with:
rvictl -x 1e3b5cbfb5614ab31731a7afeade0e6a1f18d021
Open the output.pcap in Wireshark on the operating system of choice for your listening pleasure.
https://osqa-ask.wireshark.org/questions/17559/packet-capturing-application-for-the-iphone