0

I managed to overcome certificate pinning in an android application and I am now able to view all the HTTPS request in plain text. However, I came across this request that I still do not understand:

enter image description here

We can see that it is a POST request with some 'junk' data at the bottom. At first, I thought this 'junk' is some form of encrypted data. However, after looking at the decompiled source code, it does not seem to use any form of encryption as shown below.

@Override
public List<byte[]> sendBatch(String serializable, List<byte[]> list) throws AmazonClientException {
    void var2_7;
    void var1_3;
    if (var2_7 == null || var2_7.isEmpty()) {
        List list2 = Collections.emptyList();
        return var1_3;
    } else {
        PutRecordBatchRequest putRecordBatchRequest = new PutRecordBatchRequest();
        putRecordBatchRequest.setDeliveryStreamName((String)((Object)serializable));
        ArrayList<Record> arrayList = new ArrayList<Record>(var2_7.size());
        for (byte[] arrby : var2_7) {
            Record record = new Record();
            record.setData(ByteBuffer.wrap(arrby));
            arrayList.add(record);
        }
        putRecordBatchRequest.setRecords(arrayList);
        putRecordBatchRequest.getRequestClientOptions().appendUserAgent(this.userAgent);
        PutRecordBatchResult putRecordBatchResult = this.client.putRecordBatch(putRecordBatchRequest);
        int n2 = putRecordBatchResult.getRequestResponses().size();
        ArrayList arrayList2 = new ArrayList(putRecordBatchResult.getFailedPutCount());
        int n3 = 0;
        do {
            ArrayList arrayList3 = arrayList2;
            if (n3 >= n2) return var1_3;
            if (putRecordBatchResult.getRequestResponses().get(n3).getErrorCode() != null) {
                arrayList2.add(var2_7.get(n3));
            }
            ++n3;
        } while (true);
    }
}

I searched for the method putRecordBatch and came across the docs: http://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecordBatch.html and realise that the syntax is of the form:

{
   "DeliveryStreamName": "string",
   "Records": [ 
      { 
         "Data": blob
      }
   ]
}

where I believe the 'junk' data is simply just another form of the json object above. Is there any way I can convert this junk data to a more readable form?

  • The problem is that your https request is full of squiggly red lines :) – JesusFreke Aug 9 '17 at 17:53
2

The content is encoded with gzip per the Content-encoding header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance gunzip in the Linux command line.

  • Hi I tried Decoding as gzip using Burp decoder but the output still doesn't make sense. Maybe I'm supposed to copy the output to a file? Is there any way I can copy the hex values from burp decoder? When I try to copy the values raw and paste it in any editor, the whole output gets shrunk to just 2 bytes – Lew Wei Hao Aug 10 '17 at 3:26
  • ah nevermind i got it to decode properly using smart decode instead of gzip decode – Lew Wei Hao Aug 10 '17 at 3:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.