“没有互联网连接” iOS应用程序通过OWASP ZAP代理
有点像OWASP ZAP/代理应用程序，因此我在这篇文章中对Owasp进行了标记，但是希望有人知道如何在此处绕过这个问题。
在Windows 10，OWASP ZAP 2.11.1，我生成了一个新证书，并将其安装/信任到我的iPhone 13 Pro Max。我已经设置了代理，可以在OWASP中的端口8081上运行，并打开电话的路由。我看到OWASP中的流量很酷，但是应用程序实际上并没有“工作”。例如，如果我加载了Instagram应用程序，我会看到左窗格中出现的流量/站点用于Instagram，但是在电话上，它不会刷新提要，并说没有互联网连接。即使我看到OWASP中的流量，其他一些应用程序也只挂在该应用程序的第一个加载屏幕上。
我在这里的理论是，流量没有被返回电话，而只是在发送之前被拦截。我在假设这个方面做得正确吗？或者，我希望应用程序在ZAP代理时可以正常工作时，这里还会发生什么。
谢谢！
更新
经过一番挖掘，我认为这可能是“固定”的结果，我认为（相对容易）Frida对Android Apps进行了规避，但对于iOS应用程序也不那么多。对此的任何见解将不胜感激！
Sort of a newb to OWASP ZAP/proxying apps through it, so I'm tagging OWASP in this post, but hoping someone knows how to circumvent this issue here.
On Windows 10, OWASP ZAP 2.11.1, I've generated a new certificate and installed/trusted it to my iPhone 13 Pro Max. I've setup the proxy to run over port 8081 in OWASP, and turned on the routing on the phone. I'm seeing the traffic in OWASP which is cool, however the apps aren't actually "working". For example, if I load the Instagram app, I see the traffic/sites showing up in the left pane for Instagram, but on the phone, it doesn't refresh the feed and says there's no internet connection. Some other apps just hang on the first loading screen of the app, even though I'm seeing the traffic in OWASP.
My theory here is that the traffic isn't being routed BACK to the phone, but merely being intercepted before sending it out. Am I correct in assuming this? Or what else could be happening here as I'd like the apps to work properly while I'm proxying through ZAP.
Thanks!
UPDATE
After some digging, I'm thinking this is likely a result of "pinning", which I think can be (relatively easily) circumvented with Frida for Android apps, but maybe not so much with iOS apps. Any insights into that would be greatly appreciated!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在遵循Simon Bennets发布的上述步骤之后，我收到了“无互联网”消息（ https://www.zaproxy.org/faq/faq/can-zap-be-be-be-be-to-te-te--test-mobile-apps/ ）。必须采取额外的步骤来信任手动安装的证书配置文件，如下所示： https://support.apple .com/en-us/ht204477 。
I was getting the "no internet" message after following the steps above posted by Simon Bennets (https://www.zaproxy.org/faq/can-zap-be-used-to-test-mobile-apps/). Had to do extra step to trust manually installed certificate profiles as shown here: https://support.apple.com/en-us/HT204477.