4

I have been learning about security testing on Android apps, and to intercept traffic I was using Burp Suite. I know it works perfectly for HTTP/HTTPS traffic, but most of the messenger apps are using the XMPP protocol for their communication.

I did a little research on how XMPP works, the relationship with Jabber and all. What I lack is a tool to intercept the XMPP traffic. Burp Suite is unable to intercept the XMPP traffic. I heard about xmpppeak and IMSpector but I didn't try them. I would like to know what tools can intercept XMPP traffic.

I understand tool recommendation is not entertained on Stack Exchange, but still I believe it's a common requirement as attacks on Android apps are rising high these days.

3
  • 2
    This might be on-topic on Software Recommendations. I'm not active there, so I can't be certain, but it sounds specific enough. Jan 30, 2015 at 10:06
  • @S.L.Barth Thanks for the recommendation. I posted it here because I feel its a security related application. Jan 30, 2015 at 10:08
  • @AnanduMDas did you find any way of doing this?
    – Arya
    Oct 16, 2016 at 18:42

1 Answer 1

0

I guess set up a VPN-server of your own, connect your phone to it and intercept everything with wireshark could work given that you have the neccesairy certificates or are able to MITM yourself with a fake TLS certificate.

Alternatively one of the many tcpdump-alternatives for android for use with wireshark?

4
  • Wireshark is not that user friendly for a security tester. I am looking for something like Burp or Webscarab. :) Jan 30, 2015 at 10:05
  • I am not sure XMPP is supported by burp as it is not an HTTP-protocol ( forum.portswigger.net/thread/587/… )
    – vidar
    Feb 2, 2015 at 9:48
  • I know that and thats the problem I mentioned in question :P Feb 2, 2015 at 10:34
  • yeah, hehe remember, that's why I said wireshark.. Moday hitting me hard. Did you check out this wireshark plugin:code.google.com/p/xmpp-dissector ? Have not tried it out myself.
    – vidar
    Feb 2, 2015 at 10:44

Not the answer you're looking for? Browse other questions tagged .