httptoolkit VS mitmproxy

HTTP Toolkit, you will need to install one in your PC and another one in the emulator.

Maybe not exactly what you're looking for, but if you could side-load on windows this app should work. https://httptoolkit.com/

use https://httptoolkit.com/ but it's getting a bit off-topic :)

I run HTTP Toolkit (https://httptoolkit.com) which passed $2k a couple of years back. No longer a side project, as it's made enough money for me to work on it full time for a fair while now, but it certainly started that way, and it's still a one-man show (plus many wonderful open-source contributors).

I suspect that'll be a common theme in answers here though: if you have a side project making $2k a month, in most of the world that's enough for you to go full-time and try to take it further. If you can make $2k/month on something working only part-time, you can definitely make a lot more if you focus on it.

On your questions: HTTP Toolkit is a desktop app (plus a mobile app and other components for integrations) but it's an Electron app that effectively functions as a SaaS (with a freemium subscription model) that just happens to have a component that runs on your computer. And actually getting to $2k wasn't overnight at all - it took a couple of years of slow steady slog. A few inflection points that made a notable difference (releasing rewriting support & Android support particularly) but mostly it was a matter of "just keep pushing", trusting the trajectory would keep going, and steadily grinding upwards. It's great where it is now, but it's hard work - a solo business is not for the faint of heart!

you can use tools like https://httptoolkit.com/ to check the requests

This statement gives a false sense of security. You can use a transparent proxy, like mitmproxy, to view HTTPS traffic - https://mitmproxy.org/. https://reedmideke.github.io/networking/2021/01/04/mitmproxy-openwrt.html

You'll need to install mitmproxy and set it up on your computer and iOS. I won't go into too much detail here on how to do this, but there are plenty of guides available. This is a pretty good one: https://nadav.ca/2021/02/26/inspecting-an-iphone-s-https-traffic/

TIL this goes back to 2006, how cool! We nowadays have a much simpler version as a mitmproxy example: https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad.... Although it obviously does not work as well anymore with everything being HTTPS nowadays (unless you trust the cert of course). :)

Perhaps you could have your device use a proxy that can do the HTTPS unwrap for you? https://mitmproxy.org/ maybe?

A great way to test the effectiveness of a pinning implementation is by simulating an MITM attack. Tools like Mitmproxy or Wireshack allow us to create a test environment to monitor, intercept, and proxy network requests for a test host.