对 Javascript 聊天进行逆向工程

Question

This is the case.

I'm reverse-engineering a chat. The client runs in a browser, in Javascript. Nothing is documented, but by checking the HTTP requests/responses (using Burp Suite), I've been able to figure out everything.

For simplicity, let's say that "everything" means loading the last messages and also sending a message.

However, the chat client detects "events". Eg, when a new message arrives. And I'm pretty sure the program is not polling any endpoint for this.

So, there should be an existing active connection receiving these events.

I am sure it's not WebSockets. So I need to look elsewhere, and checking the Javascript code (which is fragmented, obfuscated and minified) seems to be a HUGE task without knowing what to look for.

I've used Wireshark / mitmproxy for clues but could not get anything more useful that what I get with Burp.

What's the cheapest route to find out where is this program connecting to? I'm not much versed in Javascript so I don't know what are the ways of connecting to a given host and receiving events.

Any hints?

Thank you very much!

Answer 1

As weird as it may sound, the events were hidden behind a default filter. They come as text/event-stream , which is strangely recognized as CSS by Burp.