I start doing a research about what's actually delivered from some android applications (such as telegram or whatsapp) outside to the world. I do it in the following mediums:

1. Wifi

2. GSM

It would have been great if I could just install wireshark or tcpdump in android and check it all, but the problem is that in order to know what's going on I need to get the decrypt packets, and that's problematic because these application use end-to-end encryption.

Is there a way,even commercial,to view packets in each of the mediums above ?

I know about burp suite, and that might help, but it is only used with wifi medium, but I have no idea yet how to view packets with GSM.

Thanks for any idea.

  • 1
    if you send a message, then you know what the cleartext message is. – schroeder Dec 19 '18 at 17:38
  • There are many tutorials on how to use wireshark and get the decrypted wifi traffic. – schroeder Dec 19 '18 at 17:39
  • @schroeder I believe OP wants to know what sort of metadata is included with the message, and verify nothing unnecessary is sent. – AndrolGenhald Dec 19 '18 at 17:39
  • I've edited the question. I need to see unencrypted packets, not just text message. – ransh Dec 19 '18 at 17:41
  • Wifi and GSM encryption are a separate layer, the Signal protocol (used by WhatsApp and Signal) is encrypted on top of the existing transport layer encryption. Same with the weird home grown encryption used by Telegram. – AndrolGenhald Dec 19 '18 at 17:48

Is there a way,even commercial,to get the unencrypted packets in each of the 3 mediums above (Wifi, GSM, Roaming)?

The answer is yes, there is. If you install wireshark on your phone, you will see the packets you send "pre modem." You can think of "roaming" and "GSM" as being like ethernet over cable lines... it's converted to a whole different signal but it's still using TCP/IP on either side of the transmission.

As far as un-encrypted, you have to work out what encryption you have. If you just want to see the packets, go to an unencrypted website. bbc.com is still http on it's homepage. There are many more. If you want to unpack encryption, you can still do that with wireshark for most common (TLS/SSL). https://support.citrix.com/article/CTX116557

Here are a list of tools for PCAP on mobile, many of which have all the decryption and MITM features you're looking for. https://techwiser.com/wireshark-alternatives-for-android/

  • thx, but I think it only partly answers the question: telegram and whatsup application (which I mentioned in the question) use end-to-end encryption, are you familiar with a way to decrypt the packets of latest whatsup ? – ransh Dec 19 '18 at 19:00
  • I found the following github.com/davidgfnet/wireshark-whatsapp, but it says that it is up to whatup protocol "1.6" , and can't descrupt the latest – ransh Dec 19 '18 at 19:33
  • I mentioned in my response decryption will be specific to whatever communication and decryption type you are using. This was an answer to the question highlighted above. Feel free to re-structure your question with highlighted quotes so you can specify what you are asking. – bashCypher Dec 19 '18 at 21:59
  • You're right, I've edited the question. Is there a solution for whatsapp packet dump which can work with wifi and gsm ? – ransh Dec 19 '18 at 22:24

I think there is a better way to do it, without getting into the troubles of decryption/encryption.

It's possible to decompile and re-compile whatsapp code.

So, all that is required is to identify in code where the encryption is done, and then add - just before that - a save or display of data contents.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.