1

First of all sorry for my English.

I need to capture packets going from my android application to webservice to if it is really encrypted .

To do this, I turned on my wifi hotspot of my mobile.

After, I connected my pc to that wifi to be able to observe that network using wireshark.

Then I ran the Wireshark program and start to observe that wifi network.

I am expecting to see HTTP protocol packets when I sent HTTPS POST requets from my android app.

But I cannot see that. Instead I see some TCP and QUIC protocol packets. Actually QUIC packets has field that says "Encrypted" which is I want to see but as I know it is UDP packet and I don't know why there is lots of UDP packets also and I think they are not what I need (but not sure).

Actually Sometimes I got HTTP packets but host is ssw.live.com. But my target host is actually different. So that is not what I want to capture.

Following is my HTTP request

HttpsURLConnection urlConnection = setUpHttpsConnection(url.toString());

    try {
        urlConnection.setRequestMethod("POST");
    } catch (ProtocolException e) {
        e.printStackTrace();
    }
    urlConnection.setRequestProperty("Content-Type", "text/plain; charset=utf-8");

    urlConnection.setHostnameVerifier(new HostnameVerifier() {

        @Override
        public boolean verify(String s, SSLSession sslSession) {
            HostnameVerifier hv =
                    HttpsURLConnection.getDefaultHostnameVerifier();
            return hv.verify("my.hostname.com.tr", sslSession);
        }

    });

Following is screenshot after I send http post request. There is only one HTTP packet and it is not related.

enter image description here

Inside that HTTP packet;

enter image description here

Host name is different.

I also tried to open some websites on my PC to see if I can capture my PC's packets but it sometimes does not send HTTP protocol packets while I expecting by opening some websites.

I want to know is there any unreasonable thing from those I wrote.

Is it possible to capture packets going from my mobile using this way?

If so why can't I see them?

Any idea would be appreciated. Thanks in advance.

Hilal
  • 902
  • 2
  • 22
  • 47

1 Answers1

0

I assume the webservice is hosted on some webserver on the internet. The application on your phone will access the webservice through the mobile data network of you phone. Your pc does not see this traffic. It only sees traffic that is sent over the WiFi hotspot network. And so Wireshark cannot capture it.

You can try to run the application on the Android simulator on your pc. The Android simulator will use your pc's network connection to communicate to the webservice. Then you should be able to capture this network traffic.

Or install tcpdump on your phone.

rveerd
  • 3,620
  • 1
  • 14
  • 30
  • Actually I have noticed that there are also TLS packets. Every time I sent HTTPS POST request, I got those TLS packets. Aren't they what I want? They are also encrypted. – Hilal Sep 30 '16 at 06:23