+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+----- Forum: Reverse Engineering (https://hackforums.net/forumdisplay.php?fid=229)
+----- Thread: Android app sending binary data in post request, convert to human readable? (/showthread.php?tid=5467148)
Android app sending binary data in post request, convert to human readable? - xpro6000 - Nov 17, 2016
I am sniffing traffic from an Android and iOS app. The app is sending some kind of binary post request instead of JSON. It also receives some kind of binary data in the HTTP response.
I decompiled the Android apk, and it looks like they are using a library named "Robospice" to convert the post requests to binary before sending the request for performance improvements.
Is there anyway I can convert the binary data to something human readable?
* - Zer0Memo0ry - Nov 18, 2016
Depends what the data actually is, and is it encrypted or not. The application might send some kind of binary structure, which wont be readable unless you reverse engineer the whole application. I would say that the data is just encrypted, and needs to be decrypted for human analysis.
* - xpro6000 - Nov 18, 2016
I don't think it has to do with the encryption. When I decompiled the APK and looked at the source, I did see parts of code that were related to converting the request to binary. And in the request headers contains the following header
"Content-Type: application/x-www-form-urlencoded"
* - syphyn - Nov 18, 2016
(Nov 17, 2016 11:22 PM)xpro6000 Wrote: it looks like they are using a library named "Robospice" to convert the post requests to binary before sending the request for performance improvements.
Looking at the GitHub repo for this library, it looks like all it does is manage network requests, not encrypt them itself. Maybe other code in the app is encrypting these requests and passing that onto Robospice?
(Nov 18, 2016 09:29 AM)xpro6000 Wrote: And in the request headers contains the following header
"Content-Type: application/x-www-form-urlencoded"
All this means is that characters like "£" and "%" are converted to characters safe to use in URLs, for instance %20 or + instead of SPACE.