Sniffing traffic of Outlook android app

Question

I have been trying to get the traffic of the Outlook email app for Android to show up in my Fiddler for months with no success. Although some traffic from the app does show in Fiddler, but not all. For example when I send a message I see the following POST request

POST https://mobile.pipe.aria.microsoft.com/Collector/3.0/ HTTP/1.1
x-apikey: MYAPIKEY
Content-Type: application/bond-compact-binary
Client-Id: JavaLibrary
sdk-version: ACT-Android-Java-no-2.0.7.0-ECS
User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; Nexus 4 Build/LMY48T)
Host: mobile.pipe.aria.microsoft.com
Connection: Keep-Alive
Accept-Encoding: gzip
Content-Length: 1943

K  f ՝ 2 w  2h  EP^      ^K+
Iact_default_source $4f9c4caf-b12c-46b6-8d69-160f4ed5ea7d   ۿ U   
)$3c249ec9-dc4e-4c1a-8a94-0828b6d0d9deq  ۿ U custom send_message 
        EventInfo.Sourceact_default_sourceDeviceInfo.OsName AndroidCustom.first_launch_date
2016-09-14Custom.correlation_id43c97824f9e48f50EventInfo.Sequence138AppInfo.Languageen-USDeviceInfo.OsBuild 2237560DeviceInfo.NetworkCost UnknownUserInfo.Languageen-USUserInfo.TimeZone-04:00Custom.OutlookOAuth1Custom.MsDrive1EventInfo.Time2016-09-15T03:54:41.704ZAppInfo.Version2.1.65    Custom.ci
1x0RPaHRLoDeviceInfo.MakeLGEDeviceInfo.Model Nexus 4
DeviceInfo.Id43c97824f9e48f50
Session.Id$3722b64a-0582-4709-9e14-230036b55856DeviceInfo.SDKUid$60a51498-07e5-4d46-92b4-574023226050
eventpriorityNormalEventInfo.InitId$79f1ffb3-fa19-4f5d-b88b-714b862e0cadEventInfo.SdkVersionACT-Android-Java-no-2.0.7.0-ECSEventInfo.Namesend_messageDeviceInfo.OsVersion5.1.1DeviceInfo.NetworkTypeWifiCustom.has_attachment0   
  )$79e9da80-8d9c-4a35-85c9-e0baec49e4a5q  ۿ U custom feature_flags_test 
        EventInfo.Sourceact_default_sourceDeviceInfo.OsName AndroidCustom.first_launch_date
2016-09-14Custom.correlation_id43c97824f9e48f50EventInfo.Sequence139AppInfo.Languageen-USDeviceInfo.OsBuild 2237560DeviceInfo.NetworkCost UnknownUserInfo.Languageen-USCustom.feature_enabledyesUserInfo.TimeZone-04:00Custom.OutlookOAuth1Custom.MsDrive1EventInfo.Time2016-09-15T03:54:41.761ZAppInfo.Version2.1.65 Custom.ci
1x0RPaHRLoDeviceInfo.MakeLGEDeviceInfo.Model Nexus 4
DeviceInfo.Id43c97824f9e48f50
Session.Id$3722b64a-0582-4709-9e14-230036b55856DeviceInfo.SDKUid$60a51498-07e5-4d46-92b4-574023226050
eventpriorityNormalEventInfo.InitId$79f1ffb3-fa19-4f5d-b88b-714b862e0cadEventInfo.SdkVersionACT-Android-Java-no-2.0.7.0-ECSEventInfo.Namefeature_flags_testDeviceInfo.OsVersion5.1.1DeviceInfo.NetworkTypeWifi     

But I do not see the text of the email in Fiddler. I don't think they are using SSL Pinning. From what I have seen apps that use SSL Pinning any attempt for man-in-the-middle attack would cause errors on the app. I am not getting any errors on the app and the email does get delivered. But I can not capture any traffic related to the email sent.

Any ideas how I can capture all the traffic for the Outlook Android app?

Answer 1

I believe the key here is "Content-Type: application/bond-compact-binary"

Have a look at https://microsoft.github.io/bond/manual/bond_cpp.html#protocols, maybe that might help. A plugin for Fiddler or ZAP Proxy would be great!

Protocols

Bond protocols are pluggable, allowing application to choose the most appropriate encoding format. Bond supports three kinds of protocols:

Tagged protocols

Tagged protocols interleave schema metadata within the payload. This makes the payload self-describing, allowing consumers to interpret it even without knowing the schema used by the producer.

Untagged protocols

Untagged protocols serialize only data and thus require that consumers know the payload schema via some out-of-band mechanism. Untagged protocols are often used in storage scenarios because they allow storing a schema once (e.g. in a system table in a database) and thus eliminating metadata overhead from many records using the same schema.

DOM-based protocols

DOM-based protocol parse whole payload into an in-memory Data Object Model which then is queried during deserialization. Typically this kind of protocol is used to implement text based encoding such as JSON or XML.

Compact Binary

A binary, tagged protocol using variable integer encoding and compact field header. A good choice, along with Fast Binary, for RPC scenarios.

Implemented in CompactBinaryReader and CompactBinaryWriter classes.

Version 2 of Compact Binary adds length prefix for structs. This enables deserialization of bonded and skipping of unknown struct fields in constant time. The trade-off is double pass encoding, resulting in up to 30% slower serialization performance.

See also Compact Binary encoding reference.

Answer 2

You could use mitmproxy.

• Use a local wifi
• Install mitmproxy on a laptop which connects to that wifi doc
• On your smartphone, install the CA certificate provided by mitmproxy. Then, connect the smartphone to your wifi, and specify your laptop as proxy. The default proxy port for mitmproxy is 8080.
• Launch your Outlook Android app, and view the HTTP(S) requests in the mitmproxy console on the laptop.