0

I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint like http://bob.com/alice/param1/param2 and also passing the HTTP parameters.

Is wireshark capable to capture the network requests like this and is the url visible?

Also is it possible for someone to track the HTTP parameters I am passing it?

Is it plaintext if I am not using HTTPS? What if it's just a HTTP call?

If not using wireshark, is there any other way to capture network calls made by the app (android / iOS / PhoneGap / Ionic)?

1

Can an attacker on the network see plain HTTP requests?

Yes, they can. They can also modify the request as they want.

Can an attacker on the network see HTTPS requests?

Depends. If the attacker is the one using your app, then they can. If the attacker is trying to spy on others, it becomes more difficult, but it is not impossible.

  • can someone capture the payload ? can you guide me how it looks like to capture them? i mean how will be the process. – Talk is Cheap Show me Code Jun 14 at 9:51
  • @HungryforChallange I believe that the Wireshark FAQ will answer these questions for you. – MechMK1 Jun 14 at 9:55
0

Is wireshark capable to capture the network requests like this and is the url visible?

Assuming that Wireshark captures somewhere where the packet goes by, yes.

Also is it possible for someone to track the HTTP parameters I am passing it?

Because you're not encrypting, everything is visible and readable. Also, the parameters you are passing are clearly visible, both variable name and value. This is because they follow the HTTP-protocol.

Is it plaintext if I am not using HTTPS? What if it's just a HTTP call?

That is exactly the difference between HTTP and HTTPS. HTTP is plaintext, HTTPS is encrypted.

If not using wireshark, is there any other way to capture network calls made by the app (android / iOS / PhoneGap / Ionic)?

Yes, especially if someone has total control over the network. This varies from etherdump on the device (Android etc.) to putting a span-port on a switch. You can even buy protocol analyzers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.