Using Proxyman to Inspect Network Traffic

Enabling SSL Proxying

You can enable SSL proxying for a single or multiple domains. You can even enable it for all your network calls without worrying about a domain. All you have to do is specify a wildcard symbol.

In regular expressions, a wildcard symbol is the *. It matches any number of any characters.

Go to Tools ▸ SSL Proxying List…:

Click + at the bottom-left and then select Add Wildcard:

Type * in the field and click Add:

A new wildcard entry will appear in the list. With this set up, you’re now able to read encrypted responses in plain text from any domain. Clear the list using Clear and then Start Recording again. You’re now able to read all your network calls.

Now that you’ve got HTTPS traffic proxying it’s time to learn how to inspect network calls on your physical device.

Proxying on a Physical Device

Proxyman has an iOS app to capture network traffic that you can install from the App Store. You can install and play with it, but you won’t use it in this tutorial.

Instead, you’ll configure a Wi-Fi Proxy on your iOS device to Proxyman and install a Proxyman CA Certificate. The process requires a few steps to set up. Once you’re done, you’ll be able to inspect your phone’s network calls and see them in Proxyman on your machine.

Go to Certificate ▸ Install Certificate on iOS ▸ Physical Devices…:

On your phone, open Settings then Wi-Fi and select your current Wi-Fi. Scroll down, select Configure Proxy and then turn on Manual configuration:

For the Server field, enter the value of the server from Proxyman. Enter 9090 for the Port and leave the Authentication toggle off. Tap Save.

Now, open Safari on your phone and navigate to the Proxyman local HTTP server: http://proxy.man/ssl.

A prompt will appear asking if you want to allow download of the configuration profile. Tap Allow. If you see a prompt asking you to choose a device on which you’d like to install this profile then choose iPhone.

Then close Safari and open the Settings app.

A new Profile Downloaded option appears right below your name. Select it and a modal screen will appear asking you to Install Profile:

Tap Install and when prompted, enter your passcode. You’ll see a warning saying you need to trust this certificate, which you’ll complete in the next step. Tap Install and then Done.

Next, in the Settings app, go to General ▸ About ▸ Certificate Trust Settings. Turn the toggle on and tap Continue.

That’s it, you’re done! Close Settings and go to Proxyman. You’ll see a new entry in Proxyman under Remote Devices where all your network calls from your phone appear:

Next, you’ll learn how to proxy the iOS Simulator.

Proxying on the Simulator

Proxying on a physical device is great when you’re testing out your app in production. But being able to inspect your app’s network calls from your iOS Simulator is a very convenient way to debug your code as you’re developing it. It’s also very simple to set up!

If you don’t have Xcode running, open Jokester.xcodeproj. Build and run the app:

In Proxyman, go to Certificate ▸ Install Certificate on iOS ▸ Simulators…:

Click Install and Trust. Once the process finishes, it’ll say Installed successfully!

Proxyman installs a certificate only on your booted iOS Simulators. If you need to run your app on a different Simulator, you need to repeat the process.

You can now proxy your network calls from the simulator.

Now, to test this, make sure Proxyman is still recording your network calls. In the simulator, tap the card to make a network call and load a new joke with a random image.

In Proxyman, expand the Apps group. You’ll see your app’s name in the list:

There are two network calls in your app: one to get a random image from picsum.photos and a second to get a random joke from joke.deno.dev. Click each of these rows in the flow list and inspect the response.

For example, on the joke API response you might see something like this:

{
  "id": 15,
  "type": "programming",
  "setup": "What's the best thing about a Boolean?",
  "punchline": "Even if you're wrong, you're only off by a bit."
}

For the image API response, you’ll see the actual image that was downloaded.

Now you’ve seen how to inspect some responses to the requests that your app is making! In the following sections, you’ll learn how to use Proxyman’s toolkit to help you debug your app.

Inspecting Your App’s Network Traffic

First, you’ll learn how to filter and pin a domain you’re inspecting to find it faster in a list.

Filtering and Pinning Domains

When working with Proxyman, or any other proxying tool, it’s proxying all the network calls on your machine. The list can fill up very quickly, and it may be hard to find what you need.

You apply filters using the bar at the top of the UI:

The first section highlighted in red is used to filter by protocol. You can select HTTP, HTTPS or WebSocket. The second section highlighted in blue will filter on a certain response format, e.g. JSON. And the final section highlighted in green will filter on the response status code. By holding down Command, you can select multiple filters.

When you’re using a filter, make sure you’ve selected All Apps or Domains, otherwise you’re only filtering your specific selection:

In addition to filtering, you can pin a domain or an app. In Source List, expand the list of apps and select Jokester. Right-click on Jokester and select Pin:

Your app is now pinned to the top and you won’t need to search for it in the list every time you need it:

Next, you’ll see how to view your network calls in JSON format.