Scrape android app data

iconnek

Registered Member

Mar 26, 2015

94

19

• Dec 31, 2017

• #1

Does anyone here have experience scraping android app data?
The app communicates with remote servers via HTTP, HTTPS and perhaps it uses Thrift protocol (I'm not sure).

What methods do you normally use?

P.S: If anyone interested I will pm the app name. I didn't post this in Hire the freelancer but if anyone can take care of it, we can make a deal there.

Thanks

 

S

show

Junior Member

Dec 27, 2016

129

22

• Jan 1, 2018

• #2

I'm on the same way ...

 

Lukmat

Elite Member

Executive VIP

Jr. VIP

Jan 22, 2008

5,791

8,181

• Jan 2, 2018

• #3

jsoup library, search in Google and ... I cannot deal it, answer is 1 minute, coding it is time, time cost money, a lot of money

 

DaVinci Tech

Newbie

Jan 6, 2018

13

6

• Jan 9, 2018

• #4

Most of the time just sniffing will do and sometimes you need to reverse engineer the app

 

selfpaidinc

BANNED

Jun 30, 2014

18

8

• Jan 19, 2018

• #5

I used Charles to monitor the HTTP/S requests made on the Sarahah app and from that was able to get direct access to their private API and scrape over 1,000,000 usernames as well as send out millions of spam messages

 

S

shahbaz200

Newbie

Jul 25, 2015

25

1

• Jan 23, 2018

• #6

@selfpaidinc
Could you please tell me whats Charles and how do you use it on android. Some tutorials you can link to that you think are gonna work?

 

BlackHatRhino

Newbie

Jan 24, 2017

28

6

• Jan 26, 2018

• #7

shahbaz200 said:

@selfpaidinc
Could you please tell me whats Charles and how do you use it on android. Some tutorials you can link to that you think are gonna work?

Click to expand...

More info about debugging you can find on charles website
You can also use fiddler
If your app use ssl pinning then you need to use Android-SSL-TrustKiller
Sorry, but I can not add links to post

 

S

shahbaz200

Newbie

Jul 25, 2015

25

1

• Jan 28, 2018

• #8

BlackHatRhino said:

More info about debugging you can find on charles website
You can also use fiddler
If your app use ssl pinning then you need to use Android-SSL-TrustKiller
Sorry, but I can not add links to post

Click to expand...

Thanks. Now I just need to know what to do with information that Charles tell me lol
I used on a app 9Chat, strange info, however I got the URL of pictures that I can open on PC. I tried to get link for WhatsApp Statuses but couldn't get a shit.. It just receives file and Charles shows the size but no URL is given. I am still wondering how did he got API key of Sarahah but hes a goddamn software engineer and I am nothing. heheh.
So Android-SSL-TrustKiller is a android app, but how do I know when to use it, I mean how to know a app is using SSL Pinning, thats new to me.

 

BlackHatRhino

Newbie

Jan 24, 2017

28

6

• Jan 28, 2018

• #9

Sorry, but I can not fully help you without seeing what's happening.
Try to follow for this tutorial http://ticketmastermobilestudio.com/blog/charles-proxy-with-android
If you can not decode https even after the correct installation of charles certificates, then rather it's SSL pinning.
Do you want to see the http requests of 9Chat?