What is the best way to analyze requests sent by a mobile application
over SSL? The communication protocol is not necessarily HTTP/S so
intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy will
not necessarily work, but - How do I get the traffic to even reach the
For classic HTTPS you should use Burp/Zap/mitmproxy as there're no better alternatives I know of. I haven't really seen any other protocols using SSL/TLS suites in apps, but I would either try to reverse engineer the app to get to the protocol or try to get the encryption keys and decrypt the traffic. But it would take a lot of time.
Are you sure it's really other protocol than HTTPS on non-standard port?
Does the device on which the application is installed need to be
rooted for me to perform this task?
You don't need rooted device for HTTPS sniffing, all you have to do is set up proxy and a trusted certificate. For other protocols - well, that depends...
You can redirect all the trafic to gateway of your choosing, but as long as the protocol is encrypted I believe that will be not much of the use to you.
If the application uses certificate pinning, is there still a way to
Yes, certificate pinning can be bypassed on both major platforms. Both require root , thought.
For Android there's a Cydia Substrate extenstion called SSL Trust Killer which works by intercepting certain calls and modifiyng them to return true during validation. Unless there's a own implementation of ceritificate check, this is going to work. Otherwise, there's most likely implementation bug in certificate checking ;)
iOS has several mechanisms, the one I use is through Snoop-it framework. If that doesn't work, you can always revert to method swizzling.
I am specifically interested in understanding how the Whatsapp
security model works - i.e. what mechanism do they have in place to
prevent a malicious user to fetch the chat history of a legitimate
user (seeing as there is no actual login - Is there a cookie/another
mechanism sent from the device identifying the user in front of the
My organization is considering implementing a messaging application
that works in a similar way and we are trying to make sure that a
malicious user cannot steal the identity of a legitimate user. (we are
not intending to implement a login mechanism)
Well, your best bet is to hire a capable penetration testers for the application security assessment. I believe the security of WhatsApp should be very high, since they had few nasty security incidents and they are kinda high-profile organization with a large user base and they take security in a serious way... But you never can be too sure.
Hope this post helps a little.