After performing an mitm attack I discovered that the Nest mobile application appears to use a cookie as authentication to access data. It receives a response that gives an RTMPS address, but it seems to need an authentication of sorts to access as currently when trying to access it connects but transmits no data via RTMPdump. Can an RTMP stream use a cookie as Authentication, if so how would I send that via RTMPdump?

*Tags are inaccurate because I don't have required reputation to create appropriate tags


Possibly, but it's unlikely that secure information like the RTMP auth key is stored in an insecure cookie.

What is most likely happening is that Nest has a REST API used for authentication. After signing in with your username and password, you get a token back (OAuth2). Some combination of your username and the token is probably used as the RTMP key, unless the server is employing an additional level of security, in which there is probably another endpoint used to generate specific keys for each RTMP stream you have permissions to access to.

I would analyze the RTMP request leaving the application, checking for any auth information in headers or URL query strings.

I encourage you to read through Adobe's RTMP spec for further information.

Sources: The spec linked to above and I have written an entire application (server side and iOS frontend) that centers around RTMP video encoding, ingestion, and playback.

  • Well I see an access token that renews everything month and a session token that renews every session. How would I test which token to use? I have been using rtmpdump but I don't know how I would input the token correctly. I got a wireshark pcap of the stream but I think its encrypted but how would I decrypt it? I have a decrypted version of the Nest mobile app, and the requests sent from the the mobile app in decrypted if that helps at all...? I really appreciate your help!!
    – AppleTechy
    Nov 23 '16 at 3:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.