Android Pen Testing

Question

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS.

I have set up a proxy and am able to intercept the traffic, however the POST method appears to be encrypted and "url-encoded" .

What i want to know is .. is there a common encryption standard followed in such a scenario something like the Base64 or would it be so that the application uses a signature encryption mechanism internally which encrypts the data before it is sent through the POST method.

Any guidance would be really appreciated. Thanks in advance !

Answer 1

The only way to get what you're looking to do to work would be to use sslstrip in your proxy process. You're basically just doing a MITM attack.

And yes, SSL/TLS does encrypt the HTTP headers as well as the entire packet payload. The wikipedia article on TLS breaks down how the protocol works in good detail.

Answer 2

This sounds like a job for dynamic analysis with a custom Android ROM. You could customize your own version of AOSP to hook calls to OpenSSL at both the framework and/or kernel levels and dump out unencrypted data to a log file somewhere.

Answer 3

Generally, proxies provide the capability to generate self-signed certificates. You could choose to import these certificates at the client side and intercept the HTTPS communication at the proxy.