2

While doing some pentesting on an android app with Burp setup as a proxy (with https) I saw no traffic coming from whatsapp messages that I received or send.

I looked around in Burp, but I cannot find out why those messages don't get intercepted (or maybe not send to the proxy?).

My Setup:

  • Burp listening on 1234 on my computer
  • WiFi on phone with manual proxy settings to my computer port 1234

Does anyone have an idea of why whatsapp message do not show themselves in Burp (not even as encrypted message or something like that)

Improve this question
1
  • As far as I know - no.
    – Lukas
    Mar 15, 2017 at 17:06

1 Answer 1

Reset to default
3

WhatsApp doesn't appear to use HTTP(S) - on their website they state "On Windows Phone, iPhone, and Android, those end-to-end encryption capable clients use Noise Pipes with Curve25519, AES-GCM, and SHA256 from the Noise Protocol Framework for long running interactive connections." which doesn't really fit with typical HTTP traffic.

Burp only looks at HTTP(S) traffic (and websockets). Therefore, it wouldn't see anything else that was being sent - just like it doesn't see the DNS requests when visiting web pages, or SSH connections, even if they're to the same server as being viewed over HTTP.

You might be able to check this by using a tool like WireShark, which can monitor all packets passing through a suitable device, although the default configuration on most wifi routers is to segregate traffic from different devices.

Improve this answer
5
  • Ah I think I'm understanding it. In wireshark I see "tls" traffic and indeed Burp just doesn't pick up on non HTTP(S). So it is a Burp "issue", does anyone have a suggestion on what could be used for this that is similar to Burp?
    – Wealot
    Mar 16, 2017 at 12:02
  • I'd kind of hope that there wasn't a way to intercept the raw data - if there was, it's really bad end-to-end encryption. What are you trying to do? For just viewing the data, WireShark should work fine, although it'll just show you the encrypted packets.
    – Matthew
    Mar 16, 2017 at 12:06
  • I am just being a curious tester/breaker :P, so not really important to find it. But I was wondering if it is possible to "trick" end to end encryption on your own device. Like with the installing of the Burp CA certificate, so not for hacking others, just to satisfy curiosity.
    – Wealot
    Mar 16, 2017 at 12:09
  • Kind of. In theory, you'd have to replace the client code though, since that's performing the encryption, rather than the OS networking stack, which is a lot harder than just dropping in a replacement certificate.
    – Matthew
    Mar 16, 2017 at 12:13
  • Yeah I kind of figured that would be your answer :S. A well at least I learned some more about end-end encryption, Burp and protocols so thanks for that!
    – Wealot
    Mar 16, 2017 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .