Charles Proxy is helpful in finding security bugs loopholes. During API reviews this tool can help provide such insights: Verifying if API is working properly. This means that when we do an API call, what headers are sent and is the response correct with correct headers as
expected.

Identify The Api Calls Behind The Scenarios You Have Listed To identify API calls behind the scenarios, we need to record the application requests. To do this, we need to do the following: Set up a proxy Connect device to proxy Identify API calls behind the scenarios Identify API calls for HTTPS requests Below is a detailed outline of each step in identifying API calls. Set up a proxy Make your workstation act as a proxy server. To do this, install Charles which is an HTTP proxy/HTTP monitor/Reverse proxy that enables a developer to view all of the HTTP and SSL/HTTPS traffic between their machine and the internet. This includes requests, responses, and the HTTP headers (which contain the cookies and caching information).

●         Launch the proxy tool

Connect your Device to the Proxy tool

Enable your device to use your workstation as a proxy by going back to your mobile device’s wifi connection settings and entering your workstation’s network IP address (in Charles: Help > Local IP Address) in the proxy server field, including the port number that you saw in Charles (Proxy > Proxy Settings > Port under HTTP Proxy field).

Port number in Charles

Identify API calls behind the scenarios

●         Start the recording in Charles: Proxy > Start Recording

●         Launch the mobile application. Now all traffic from your device to the internet will be relayed through your workstation, allowing Charles to record all of the end-points of scenarios. For example, once you launch your mobile application, the corresponding API call will be recorded in Charles. In the snapshot below, we have captured the API call. You can see the API call in the Request tab. In the Response tab, we can see the response corresponding to every request.

Recording transaction of app and identifying API calls behind the transaction

Recording all the transactions of a mobile app and identifying API calls behind those transactions