Question

I have an iOS client app which connects to a server using HTTPS.
I’ve added code in the client to verify the identify of the server.

How can a tester testing this feature test that it is now secure, how can they for example create a MITM situation and check that the client rejects connects etc.?

I’ve tried googling for how to do this but haven’t had much luck.

Can it be done using tools like Charles and proxies etc. or is messing around with a wireless router and having detailed knowledge necessary?

Answer 1

This might be over simplification for your solution, but concepts might help.

A web browsers extracts the name of hosts from embedded certificate and do a comparison of host name that we’re trying to connect with. If validation fails, we usually see a security warning. For ex: we can connect with facebook by either typing https://www.facebook.com or by typing https://173.252.100.16/. When we choose second option, we get a security warning.

Your program must be using SSL client socket to connect with HTTPS server. The socket must be having capability to extract the hostname from the embedded certificate. Once you get that, compare that with valid HOST NAME that your program is trying to connect with. If it matches, let request proceed, If not, abandon that session.

To re-create MITM, your web server can use a self signed certificate that can be issue to whatever host name you want, but the IP of server could be 127.0.0.1 (for example). Since there is a mismatch between the host name and actual IP, we can probably simulate the MITM situation.

I’m assuming that digital certificate can’t be forged in this case.