1

I've seen many Android apps which send encrypted post data, tools like Fiddler and Burp can't decode that data, is there any other tool or method that can decrypt this obfuscated post data?

For example look at this:

POST /auth.asmx/create HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Host: site.com
Connection: Keep-Alive
Content-Length: 109

FF 52 FF 67 FF 0A 09 6B FF FF 70 FF 17 FF 5F FF |  R g   k  p   _ 
6C FF FF FF FF FF 2A 2F FF FF FF 6A FF 73 FF 72 | l     */   j s r
FF 42 08 FF FF 77 FF FF 6A FF 22 26 3B 7E 05 FF |  B   w  j "&;~  
FF FF 13 FF FF 57 FF 57 27 5C FF FF 34 2B 1D 49 |      W W'\  4+ I
FF 54 47 73 FF 5F FF 29 FF 1B 6A FF 27 FF 22 FF |  TGs _ )  j ' " 
FF 15 FF 78 FF 0C 7A FF FF FF 41 FF 14 FF 5B 4B |    x  z   A   [K
26 FF 53 10 FF 4D FF 67 FF 61 36 FF FF          | & S  M g a6     

These are the full headers, I've just taken out the user-agent because it will give away the app as it's a custom.

I've tried decoding the hex but the output is unreadable:

ÿRÿgÿ
kÿÿpÿÿ_ÿlÿÿÿÿÿ*/ÿÿÿjÿsÿrÿBÿÿwÿÿjÿ"&;~ÿÿÿÿÿWÿW'\ÿÿ4+IÿTGsÿ_ÿ)ÿjÿ'ÿ"ÿÿÿxÿzÿÿÿAÿÿ[K&ÿSÿMÿgÿa6ÿÿ

Can somebody help me with this?

Note: SSL decryption is enabled and working fine.

closed as too broad by Steffen Ullrich, ISMSDEV, Xiong Chiamiov, Benoit Esnard, Tobi Nary Mar 16 '18 at 10:20

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I'd have a look at the source page that generate this request but, given the number of identical characters in there, it might just be a simple substitution cipher. Have a look at the cleartext you're placing inside the app as well – Stephane Mar 12 '18 at 10:59
  • 4
    There is no encryption standard for POST data. It is not even clear if this is encryption in the first place or if these are just binary application specific data. But it is definitely no application/x-www-form-urlencoded; charset=utf-8 as claimed in the header. What exactly is done here is probably specific to the application. I propose the question as too broad since it is impossible to help based on this. Apart from that it might also be closed because you are trying to break the security of a system which is in most cases considered off-topic here. – Steffen Ullrich Mar 12 '18 at 11:08
  • 1
    Yes, it's absolutely not urlencoded. If breaking the security of an app is considered off-topic here, where should I ask then? – John Doe Mar 12 '18 at 14:41
  • 1
    @SteffenUllrich It is absolutely not off-topic (though it may be too broad). Help with breaking security is allowed as long as the asker has demonstrated an understanding of the problem, which he clearly has (i.e. he explained his problem, explained what he tried, and asked for further help). If the OP simply said "here is something encrypted, break it for me" then yes, that would apply. – forest Mar 13 '18 at 5:43
  • 3
    @forest: the OP has not shown that this is encrypted in the first place instead of being just binary application specific data. Instead the OP just posts a blob of data and asks how to decrypt this. All the OP has tried was hex-decoding it it, i.e. essentially display binary data on the console which of course results in a messed up output - and hex-decoding has obviously also nothing to do with the claimed encryption. In summary: this does not show an understanding of the problem for me and it does not highlight a specific (narrow) problem. Thus I still think that this is off-topic. – Steffen Ullrich Mar 13 '18 at 6:03