Proxy Tools: Charles and Proxyman

A banking app shows the wrong balance for some users. The developers say “the app just displays what the server sends”. The backend team says “the server sends the right number”. Who’s right?

A tester with a proxy tool settles it in two minutes: she opens the request, looks at the response, and sees the server sends "balance": 1250.5 while the app shows $125.05. It’s an app bug, and she has the evidence. No guessing, no meetings.

That’s the superpower of a proxy toolProxy toolA program that sits between the app and the server so you can watch and change network traffic.Open in glossary →: it lets you see and change the conversation between the app and its server.

What a proxy does

Normally the app on your phone talks straight to the server. With a proxy, you tell the phone to send its traffic through a program on your computer first. The proxy sits in the middle: it records every request and response, and can pause, edit, slow down or replace them.

This is a man-in-the-middle setup, the same thing an attacker would try to do, except you do it on purpose, on your own test device, with your team’s permission. For HTTPSHTTPSThe secure version of HTTP; traffic between the browser or app and the server is encrypted.Open in glossary → traffic, the phone must trust the proxy’s own certificateSSL certificateThe certificate that lets a browser or app verify a server's identity and encrypt traffic (HTTPS).Open in glossary →, otherwise the encryption prevents the proxy from reading anything.

Why testers use proxies

Try it: the proxy playground

Play with a proxy before setting up a real one. This grocery app is well built: it handles errors, empty lists and slow responses correctly. Use the tools and watch how it reacts.

Setting up a real proxy

The steps are similar for every tool. Here’s the big picture, then the details for Charles and Proxyman.

Charles and Proxyman specifics

Trusting the certificate on the phone

<!-- res/xml/network_security_config.xml (debug builds only) -->
<network-security-config>
  <debug-overrides>
    <trust-anchors>
      <certificates src="user" />
    </trust-anchors>
  </debug-overrides>
</network-security-config>

Other tools

• Fiddler (Fiddler Everywhere for macOS, Windows and Linux; Fiddler Classic for Windows) does the same job and is popular in Windows teams.
• mitmproxy is free and open source: a command-line tool with a web interface (mitmweb) and Python scripting, great for automation.
• Browser DevTools show web traffic without any proxy setup, and a HAR fileHAR fileA file that records every network request and response a web page made.Open in glossary → lets you share a recording with developers.

Safety and ethics

What to look for

Data and privacy

• Passwords, tokens or personal data in URLs (query parametersQuery parameterData in a URL after the ?, like ?q=mug&sort=price, often used to keep search and filter state.Open in glossary → end up in server logs and analytics).
• Responses that contain more data than the screen shows (full card numbers, other users’ data, internal IDs, password hashes).
• Any traffic over plain http:// instead of https://.
• Tokens that don’t change after logout, or that keep working after logout.

Analytics

• Each event fires exactly once, at the right moment, with the right properties (product ID, price, currency).
• No events fire before the user gives consent, if the app asks for it.

Error handling

• Use breakpoints or rules to return 500, 503, 401, 404, an empty list, null values, huge values and broken JSON. The app should show a helpful message, an empty stateEmpty stateThe screen a user sees when there is no content yet, like an empty cart or no search results.Open in glossary → or a login prompt, never a crash or blank screen.
• Slow responses (throttling or a paused breakpoint) show a loading state.

Server-side checks

• Edit a request before it reaches the server: change the price, quantity, coupon, user ID or role. The server must validate everything and never trust values that only the app controls. This is classic security testingSecurity testingChecking that data and features are protected from unauthorized access and attacks.Open in glossary →.
• Repeat a request (place order, apply coupon, transfer money). It shouldn’t apply twice. See idempotencyIdempotencyAn action that gives the same result no matter how many times it is repeated.Open in glossary →.

Common bugs found with a proxy

Find the bug

Time for a real investigation. This grocery app has six bugs that you can only find by looking at (or changing) its traffic. Log in, add items, pay, and use Breakpoint (with Requests and/or Responses), Map Local and the request details. Don’t forget to read the response bodies.

Example test cases

Checklist

Check your understanding