Reverse engineer android app based on xmpp

Status
Not open for further replies.
mnunes532

mnunes532

Elite Member
Joined
Jan 21, 2014
Messages
2,131
Reaction score
826
I'm looking for someone who has experience with the xmpp protocol to reverse engineer an android app.

That person should also have some experience with python or other language in order to connect to servers, send messages, etc using python for instance.

I already managed to get some messages sent to the xmpp server but I don't know how I can send them myself and get the answers from the server.

Send me a private message if you can do this.
 
Advertise on BHW
Bump, still looking for someone.
 
Bump, still looking for someone.
 
are you trying to reverse engineer the app or just the XMPP communication between the app and ther XMPP server?
 
biggreyhat said:
are you trying to reverse engineer the app or just the XMPP communication between the app and ther XMPP server?
Click to expand...

Good question. The second, the XMPP communication between the app and their XMPP server.
 
So is the server a standard XMPP? If so the xmpp/jabber protocol is an open protocol with publicly available specs/rfcs, what needs to be reverse engineered? Or the server using some non standar extension?
 
biggreyhat said:
So is the server a standard XMPP? If so the xmpp/jabber protocol is an open protocol with publicly available specs/rfcs, what needs to be reverse engineered? Or the server using some non standar extension?
Click to expand...

Well, data is being sent on tls/ssl, that's the issue. I can sniff the traffic but it is encrypted.
 
If it's a standard xmpp with no proprietary extensions, you can just use any XMPP open source client connected to it, and modify the code so it will spew out the messages. If the server uses proprietary extensions then you can preform MITM attack and maybe change the app to ignore CA checks.
 
biggreyhat said:
If it's a standard xmpp with no proprietary extensions, you can just use any XMPP open source client connected to it, and modify the code so it will spew out the messages. If the server uses proprietary extensions then you can preform MITM attack and maybe change the app to ignore CA checks.
Click to expand...

First of all, I know almost nothing about the xmpp protocol. What I know I've learned from trying to reverse engineer this app.

Plus I don't know if they use an open source xmpp client or their own.

I've been trying to ignore CA checks or even putting my own certificate but without success.
 
biggreyhat said:
I meant you could try to use an open source client to connect.

If you don't mind at least you can share the name of the app.
Click to expand...

I could, but I'm not certain about the server ip neither the username/password. They have several server ips and I only know the username, not the password.

I can share it via a private message ;)
 
If you want you can either PM me or post here the app name and where I can download it, no need for IPs/user/pass.
 
PM received, username is your email, password can be reset through their site (sorry I can't PM so please search with $name_of_ the_app + "request_password_change"). The server IPs can be obtained with DNS query.

Once you have all that you can try to connect using an alternative client.
 
biggreyhat said:
PM received, username is your email, password can be reset through their site (sorry I can't PM so please search with $name_of_ the_app + "request_password_change"). The server IPs can be obtained with DNS query.

Once you have all that you can try to connect using an alternative client.
Click to expand...

Wow awesome, thanks for the help :)
 
mnunes532 said:
Wow awesome, thanks for the help :)
Click to expand...
If you need further assistance, you know where to find me :D And if you like please thumb me up XD
clear.png


cheers
 
@https://www.blackhatworld.com/members/biggreyhat.1024665/, you know how to reverse engineer apps on the market and create bots from them?
 
Real
clear.png
reverse engineer is very hard topic which requires a lot of knowledge and dedication, but if the app is using somewhat using standard protocols and the app is not written against reverse engineering that it becomes in the realm of doable for the mortals.

Take e.g. poke* go, it was easy to write bots and now it's almost impossible.
 
Still looking for someone who can do this. I'm now able to see the messages sent/received to/from the xmpp server but I don't know why the server doesn't reply anything.

One of the xmpp server's ips is 198.24.161.102 and port is 5222.

The first message to be sent is:

<?xml version='1.0'?><stream:stream xmlns="jabber:client" xmlns:stream="http://etherx.jabber.org/streams" version="1.0">

And the server should reply:

<connection state="ready" jid="null"/>
 
Still looking for someone.
 
Advertise on BHW
Status
Not open for further replies.
This thread has been auto closed due to the forum's thread age policy. Read more.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top