CODEWITHSUNDEEP
androidsecurityhttppost
Swas_99
Swas_99

Reputation: 2390

Get url & parameters of a POST request made from an android app. (Hack an application)

1> Is it possible to fetch the end-point of a http post request made from an android app?

2> Is it possible to fetch the parameters (key & value) of that request ?

If it is not possible to fetch the exact end-point & the parameter list for a post request made from an android device, can we assume that it is very hard to hack that particular end-point?

Edit 1 :

Say, in my android app, I am using an end-point like - http://abc.xyz.com/buyItem with 2 parameters : itemCode=value1, price=value2

(how)Can the url, parameter list & values be fetched by a hacker?

Upvotes: 0

Views: 1151

Answers (2)

oldbam
oldbam

Reputation: 2487

I would recommend using Fiddler for this purpose, it is a tool that has a nice UI and you would not need to write any complicated command line commands. Here is a documentation article on how to configure Fiddler to capture traffic on Nexus device.

Upvotes: 0

Tigger
Tigger

Reputation: 9130

Yes it is possible to monitor network traffic and get those values.

It is pretty easy to set-up with something like a basic (cheap) network hub (not a switch) and a PC attached and a few network tools like tcpdump or ngrep.

A tcpdump example would be:

tcpdump -A -i eth3 > t.dump

Change eth3 to your network interface. You can look over the file t.dump in a text editor or use less or more.

NOTE: SSL / HTTPS connections are encrypted, so tcpdump will only give you parameters over HTTP.

There are other ways as well.

You could get lucky and simply unpack the apk and grep for something like ://. For example

grep -R '://' ./unpacked-apk/*

Update: Added a tcpdump example.

Upvotes: 1

Related Questions