I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS.

I have set up a proxy and am able to intercept the traffic, however the POST method appears to be encrypted and "url-encoded" .

What i want to know is .. is there a common encryption standard followed in such a scenario something like the Base64 or would it be so that the application uses a signature encryption mechanism internally which encrypts the data before it is sent through the POST method.

Any guidance would be really appreciated. Thanks in advance !

  • 3
    I'm a little confused about your question. If you are sending the data via HTTPS, then it should be encrypted. Jan 27, 2012 at 13:41

3 Answers 3


The only way to get what you're looking to do to work would be to use sslstrip in your proxy process. You're basically just doing a MITM attack.

And yes, SSL/TLS does encrypt the HTTP headers as well as the entire packet payload. The wikipedia article on TLS breaks down how the protocol works in good detail.


This sounds like a job for dynamic analysis with a custom Android ROM. You could customize your own version of AOSP to hook calls to OpenSSL at both the framework and/or kernel levels and dump out unencrypted data to a log file somewhere.


Generally, proxies provide the capability to generate self-signed certificates. You could choose to import these certificates at the client side and intercept the HTTPS communication at the proxy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.