1

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to communicate, I am wondering, how can I encode my Json string as well. so that, I can avoid, Session Hijacking and XSS.

  • I'm a bit confused by your question. The title talks about interception, but your question is about encoding. Are you concerned about encryption during transmission? XSS attacks? Other? – Neil Smithline Mar 13 '16 at 16:54
  • @NeilSmithline, I want to encrypt all my data during its transmission so that even if user, intercepts the requests, he/she is still not able to get anything out of it. – M.S.P Mar 14 '16 at 1:23
  • Can't you use SSL? That is what is typically used for on the wire encryption – Neil Smithline Mar 14 '16 at 1:30
  • @NeilSmithline, please guide me. – M.S.P Mar 14 '16 at 1:32
1

I suggest you to take a look at the next moments and pick something that will fit your requirements for a particular task :

  • a PKI to do the job of Key distribution. Pre-seed your app with your CA public key and with a client key to connect to your HTTPS. Make sure to maintain an app package integrity as hard as possible, i.e. checksums... In Microsoft Store agreement I've seen a part that allows MS to remove all digital signatures and sign a result themselves. Keys can be tampered in such a step, so beware.
  • Tor or I2P for routing pattern detection avoiding. Not just where your app connects, but also how the connection behaves, i.e. network connection flow, address list, e.t.c. can be ised to cherrypick your app's traffic and divert it through malicious filters.
  • FreeNet and ZeroNet for publishing read-only static for your app : if your content is signed and the signature can be verified - it is also distributed in a non-centralized way, so it's useless to "ban" or divert a traffic to "mothership node(s)"

Layering-up theese levels of protection will actually let you just pass-through your JSON communication through this secure pipe. Feel free to ask further questions - I'll be glad to help

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.