romanzaikin / BurpExtension-WhatsApp-Decryption-CheckPoint

This tool was created during our research at Checkpoint Software Technologies on Whatsapp Protocol (This repository will be updated after BlackHat 2019)
637 stars 173 forks source link

Encrypting decrypted message result in different message from original #17

Closed johntiror closed 6 years ago

johntiror commented 6 years ago

Hi,

I'm having trouble changing the message content. I'm able to intercept the message and deprypt it. Once I modify the message (as in the video) I then press "Encrypt", I copy in the proxy, base64 decode it, but then the message does not appear in my web.whatsapp

I noticed that if I intercept a message, then decrypt and immediately encrypt (without any modification) if I compare the original message and the decrypted/encrypted one they are different. I expect them to be the same. Maybe there is a problem in the encryption?

Thanks

romanzaikin commented 6 years ago

@johntiror the message you write is in English?

Try to decrypt/encrypt same message and check if it works. Try to change 1 character, add characters or remove characters.

johntiror commented 6 years ago

Thanks for your feedback. The test I did were with random chars, but I guess it shouldn't be a problem, is it?

Here my test:

Message intercepted:

schermata 2018-08-13 alle 10 16 01

Message encoded in base64:

schermata 2018-08-13 alle 10 16 21

message copied to the whatsapp decoder:

schermata 2018-08-13 alle 10 16 36

message decrypted (it works!):

schermata 2018-08-13 alle 10 16 53

message encrypted without any modification: as you can see it's different than before the decryption

schermata 2018-08-13 alle 10 17 11

error message if I try to decrypt it again:

schermata 2018-08-13 alle 10 17 19

what can be the issue?

c0d3x27 commented 6 years ago

@johntiror bro how did you get to decrypt it? i have the keys and the right ref but i keep getting error mine doesnt get decrypt.

max194 commented 6 years ago

@Banginpadr before copying it you need to press ctrl + b, after pasting it you need to press ctrl + shift+ b (encoding and decoding as base64)

c0d3x27 commented 6 years ago

@max194 max you are a good thank you so much. i just fix this problem to just find another one.. after i edit the messagge and crypt it again and past it to be send the message dont get send. the edit only happen in my cell not the person cell too

romanzaikin commented 6 years ago

@Banginpadr you can't send the message on behalf of someone else, you can just reply to it and everyone will see it or you can do other stuff as we wrote in our blog post.

johntiror commented 6 years ago

Why did you close it? My issue is still there as shown in the pictures

c0d3x27 commented 6 years ago

@romanzaikin this is what im talking about. this is what i did. but in the replay the message is still the original

romanzaikin commented 6 years ago

@johntiror can you check now? I have fixed it in the new parser file

ertza commented 6 years ago

@romanzaikin Hi there, I'm still facing the exact same problem as faced by @johntiror. I have the latest code pulled and even without doing any modifications the encryption after decryption comes out to be different; and when this message is forwarded in burp suite proxy, nothing shows up in the Web WhatsApp. The encryption cannot be decrypted using the tool too so may be it is not encrypting the way it should?