0

I am working on Android application security project where Android application sends all data in encryption from client side only. I assume that there must be a file at client side which might be encrypting/encoding data from my end. No matter how many input fields are there in any single form, only two parameters pass through my end to the server those are as follows:

  1. json_secure

    Sample value of this parameter is as follows:

    json_secure=5VuZ6sZ1GJac4IJYSiPqQo8y2mJvymHJcpJXIrN9x8pgwrGXUdKQzFfAVJzeTooBlXrQp9F2BqehKaTDHHL7%2BIdkE%2BBhCSUL67fBKAxFERb15Ptk0UNkNOhP2PkGbfKr%2FT%2BQ8hypg1x3AmA5zdESUiX6KQ1pwTt7D5qD%2Be3ONtfhdktmlT%2Bb21hvJBRLJcmqtVOc6soE2I2urIyvrRW8Bk7pzz6IMFx7J52baOyKwbnKRB6FI2m3M260jbtKptSQZuqVf34PPLKdCZpKRQH33rqhpjyCQm5lT3DUpmj1yvAbhBiifeu1DdiaLzEq%2BgIiLQAe9l2pQHhh6ru86H8Y7ULWU%2FWAjDW%2Bbw88Hc%2F4FFNTn9G3Q8wBTMowTJFdU2ZfFg%3D%3D
    
  2. json_id

    Sample value of this parameter is as follows:

    json_id=568d72bbf4c022db488a3a7e087c8dca9a4d3f350230a44b762427f2a067f628
    

Kindly suggest me how to bypass this mechanism in order to tamper data through the Burp Suite.

  • 2
    From what I can read in your question, a blackbox approach will be unlikely to succeed. Decompile the App and analyze what it is doing - then you might (or not) find a way to break it. – Lukas May 7 '16 at 14:39
  • Source code is obfuscated – FrOgY May 7 '16 at 15:02
  • Well, then I can't help you any further (except the obvious that the json_secure parameter is base64 encoded and then urlencoded. Burp suite can help you with the encoding and decoding stuff) – Lukas May 7 '16 at 15:09
1

I assume that there must be a file at client side which might be encrypting/encoding data from my end: Yes if an extra layer of encryption is used apart from Transport Layer Protections(TLS/SSL) then encryption is done at client side.

No matter how many input fields are there in any single form, only two parameters pass through my end to the server those are as follows: Maybe all the parameters are sent in Cipher Text as key value pairs seperated by some delimitters.

Kindly suggest me how to bypass this mechanism in order to tamper data through the Burp Suite: You can reverse engineer the application and get the application source code(JADx, dex2jar&JD-GUI). Then through source code analysis, you can identify the classes that may be used for encryption. For Ex: You can search manually for the instantiations of javax.crypto.Cipher class that can be used for encryption. You can even use automated tools like MobSF that will make the task much easier for you.

Source code is obfuscated: Obfuscated source code only created a hurdle for analyst/attacker it can still be read and understood.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.