0

I'm experimenting with my Samsung wireless speaker. I've been using Wireshark to examine and reverse engineer its API. One of the API calls I make causes strange behaviour where it seems one HTTP request returns two HTTP responses.

curl -v http://192.168.1.165:55001/UIC\?cmd\=%3Cname%3EGetMainInfo%3C/name%3E

Wireshark capture for the above command

What's frustrating, is that it's the second response that has the payload I'm after. How can I get to it?

Curl output

*   Trying 192.168.1.165...
* TCP_NODELAY set
* Connected to 192.168.1.165 (192.168.1.165) port 55001 (#0)
> GET /UIC?cmd=%3Cname%3EGetMainInfo%3C/name%3E HTTP/1.1
> Host: 192.168.1.165:55001
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Fri, 02 Jan 1970 09:31:25 GMT
< Server: Samsung/1.0
< Content-Type: text/html
< Content-Length: 215
< Connection: close
< Last-Modified: Fri, 02 Jan 1970 09:31:25 GMT
< 
* Closing connection 0
<?xml version="1.0" encoding="UTF-8"?><UIC><method>RequestDeviceInfo</method><version>1.0</version><speakerip>192.168.1.165</speakerip><user_identifier>public</user_identifier><response result="ok"></response></UIC>

Wireshark HTTP response 1/2

<?xml version="1.0" encoding="UTF-8"?><UIC><method>RequestDeviceInfo</method><version>1.0</version><speakerip>192.168.1.165</speakerip><user_identifier>public</user_identifier><response result="ok"></response></UIC>

Wireshark HTTP response 2/2

<?xml version="1.0" encoding="UTF-8"?><UIC><method>MainInfo</method><version>1.0</version><speakerip>192.168.1.165</speakerip><user_identifier></user_identifier><response result="ok"><party>off</party><partymain></partymain><grouptype>N</grouptype><groupmainip>0.0.0.0</groupmainip><groupmainmacaddr>00:00:00:00:00:00</groupmainmacaddr><spkmacaddr>xx:xx:xx:xx:xx:xx</spkmacaddr><spkmodelname>SPK-WAM3500</spkmodelname><groupmode>none</groupmode><channeltype>invalid</channeltype><channelvolume>0</channelvolume><multichinfo>on</multichinfo><groupspknum>1</groupspknum><dfsstatus>dfsoff</dfsstatus><protocolver>2.3</protocolver><btmacaddr>xx:xx:xx:xx:xx:xx</btmacaddr></response></UIC>

netcat

Netcat did the job it seems:

$ nc 192.168.1.165 55001
GET /UIC?cmd=%3Cname%3EGetMainInfo%3C/name%3E HTTP/1.1
Host: 192.168.1.165

HTTP/1.1 200 OK
Date: Fri, 02 Jan 1970 10:53:13 GMT
Server: Samsung/1.0
Content-Type: text/html
Content-Length: 215
Connection: close
Last-Modified: Fri, 02 Jan 1970 10:53:13 GMT

<?xml version="1.0" encoding="UTF-8"?><UIC><method>RequestDeviceInfo</method><version>1.0</version><speakerip>192.168.1.165</speakerip><user_identifier>public</user_identifier><response result="ok"></response></UIC>HTTP/1.1 200 OK
Date: Fri, 02 Jan 1970 10:53:13 GMT
Server: Samsung/1.0
Content-Type: text/html
Content-Length: 684
Connection: close
Last-Modified: Fri, 02 Jan 1970 10:53:13 GMT

<?xml version="1.0" encoding="UTF-8"?><UIC><method>MainInfo</method><version>1.0</version><speakerip>192.168.1.165</speakerip><user_identifier></user_identifier><response result="ok"><party>off</party><partymain></partymain><grouptype>N</grouptype><groupmainip>0.0.0.0</groupmainip><groupmainmacaddr>00:00:00:00:00:00</groupmainmacaddr><spkmacaddr>xx:xx:xx:xx:xx:xx</spkmacaddr><spkmodelname>SPK-WAM3500</spkmodelname><groupmode>none</groupmode><channeltype>invalid</channeltype><channelvolume>0</channelvolume><multichinfo>on</multichinfo><groupspknum>1</groupspknum><dfsstatus>dfsoff</dfsstatus><protocolver>2.3</protocolver><btmacaddr>xx:xx:xx:xx:xx:xx</btmacaddr></response></UIC>
  • You can get an HTTP response in multiple packets. What is the output of your curl request? – slhck Jan 9 at 11:09
  • @slhck added curl output, thanks for looking – beklip Jan 9 at 14:51
  • @Biswapriyo added both payloads, thanks for looking – beklip Jan 9 at 14:51
  • What happens if you echo 'GET /UIC?cmd=%3Cname%3EGetMainInfo%3C/name%3E HTTP/1.1' | socat - TCP:192.168.1.165:55001 (or variants with more headers, or telnet if you don't have socat)? The point is to avoid curl reacting on the wrong length in the first response together with Connection: close. – dirkt Jan 9 at 15:23
  • @dirkt I used netcat, which seemed to do the job – beklip Jan 9 at 15:53

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.