Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS.

I have set up a proxy and am able to intercept the traffic, however the POST method appears to be encrypted and "url-encoded" .

What i want to know is .. is there a common encryption standard followed in such a scenario something like the Base64 or would it be so that the application uses a signature encryption mechanism internally which encrypts the data before it is sent through the POST method.

Any guidance would be really appreciated. Thanks in advance !

share|improve this question
3  
I'm a little confused about your question. If you are sending the data via HTTPS, then it should be encrypted. –  logicalscope Jan 27 '12 at 13:41

3 Answers 3

The only way to get what you're looking to do to work would be to use sslstrip in your proxy process. You're basically just doing a MITM attack.

And yes, SSL/TLS does encrypt the HTTP headers as well as the entire packet payload. The wikipedia article on TLS breaks down how the protocol works in good detail.

share|improve this answer

Generally, proxies provide the capability to generate self-signed certificates. You could choose to import these certificates at the client side and intercept the HTTPS communication at the proxy.

share|improve this answer

This sounds like a job for dynamic analysis with a custom Android ROM. You could customize your own version of AOSP to hook calls to OpenSSL at both the framework and/or kernel levels and dump out unencrypted data to a log file somewhere.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.