Why do I still see data passing by when the traffic is encrypted? I use packet capture to intercept the traffic of mobile application within my phone. Sometimes I do see garbage values and sometimes API destination along with garbage values.
Its because the API destination cannot be hidden by SSL. Whats hidden by SSL, is the data, eg the request and response, including the path part of URL.
So out of this url: https://www.example.org/search.php?sdata=somedata
the following will be encrypted:
the first part, https://www.example.org, will NOT be encrypted (read more why not).
Whats not hidden, is the destination IP and destination port. Furthermore, the DNS request immediately preceding this, is sent in the clear.
A sniffer, can detect the caonical name of the destination in 2 ways:
Either, it can remember previous sniffed DNS responses, so if you previously did a DNS lookup for lets say api.example.org and got a IP of "22.214.171.124", the sniffer can then replace all occurences of 126.96.36.199 later with api.example.org
Or, it can do a so called rDNS or reverse DNS lookup. This means you do a lookup for a PTR record for the IP in reverse, so the rDNS of 188.8.131.52 can be found at a PTR for 184.108.40.206.in-addr.arpa which results in google-public-dns-b.google.com, thus the sniffer can replace all occurences of 220.127.116.11 with google-public-dns-b.google.com
Since you only can see the API destionation for some of the traffic, I suspect its the first case that is valid here, because if you did the DNS lookup prior to running the sniffer, this lookup is then cached for a period in your phone, which means that if the server in question lacks a rDNS value, the sniffer will normally display a IP instead of caonical name, which can give the apperance that some destinations are "encrypted" when they really are not.
If you want to hide the API destination from sniffing, you have to use some sort of proxy or VPN, where the traffic between the client and proxy/VPN is encrypted.