I've seen many Android apps which send encrypted post data, tools like Fiddler and Burp can't decode that data, is there any other tool or method that can decrypt this obfuscated post data?
For example look at this:
POST /auth.asmx/create HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 Host: site.com Connection: Keep-Alive Content-Length: 109 FF 52 FF 67 FF 0A 09 6B FF FF 70 FF 17 FF 5F FF | R g k p _ 6C FF FF FF FF FF 2A 2F FF FF FF 6A FF 73 FF 72 | l */ j s r FF 42 08 FF FF 77 FF FF 6A FF 22 26 3B 7E 05 FF | B w j "&;~ FF FF 13 FF FF 57 FF 57 27 5C FF FF 34 2B 1D 49 | W W'\ 4+ I FF 54 47 73 FF 5F FF 29 FF 1B 6A FF 27 FF 22 FF | TGs _ ) j ' " FF 15 FF 78 FF 0C 7A FF FF FF 41 FF 14 FF 5B 4B | x z A [K 26 FF 53 10 FF 4D FF 67 FF 61 36 FF FF | & S M g a6
These are the full headers, I've just taken out the user-agent because it will give away the app as it's a custom.
I've tried decoding the hex but the output is unreadable:
Can somebody help me with this?
Note: SSL decryption is enabled and working fine.