Can a RTMPS stream be authenticated by a cookie?

Question

After performing an mitm attack I discovered that the Nest mobile application appears to use a cookie as authentication to access data. It receives a response that gives an RTMPS address, but it seems to need an authentication of sorts to access as currently when trying to access it connects but transmits no data via RTMPdump. Can an RTMP stream use a cookie as Authentication, if so how would I send that via RTMPdump?

*Tags are inaccurate because I don't have required reputation to create appropriate tags

Answer 1

Possibly, but it's unlikely that secure information like the RTMP auth key is stored in an insecure cookie.

What is most likely happening is that Nest has a REST API used for authentication. After signing in with your username and password, you get a token back (OAuth2). Some combination of your username and the token is probably used as the RTMP key, unless the server is employing an additional level of security, in which there is probably another endpoint used to generate specific keys for each RTMP stream you have permissions to access to.

I would analyze the RTMP request leaving the application, checking for any auth information in headers or URL query strings.

I encourage you to read through Adobe's RTMP spec for further information.

Sources: The spec linked to above and I have written an entire application (server side and iOS frontend) that centers around RTMP video encoding, ingestion, and playback.