Native apps on mobile devices account for an increasing amount of web traffic. Facebook being the most popular “in app browser”.
Sometimes these apps provide some interesting information in the user-agent. Facebook does it, and Instagram does it.
Here are some examples of how a user agent string may look like for Instagram:
Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_2 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13F69 Instagram 8.4.0 (iPhone7,2; iPhone OS 9_3_2; nb_NO; nb-NO; scale=2.00; 750x1334
Mozilla/5.0 (Linux; Android 6.0.1; SM-G935T Build/MMB29M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/51.0.2704.81 Mobile Safari/537.36 Instagram 8.4.0 Android (23/6.0.1; 560dpi; 1440x2560; samsung; SM-G935T; hero2qltetmo; qcom; en_US
The interesting parts are appended to the end of the “regular” user-agent (which is the proper way to do it, btw.).
iPhone first identify the app name and version:
Then, the ipsw version which identify the exact type of iDevice (in this case iPhone 6):
The operating system we already new, so don’t know why that is included, but anyway, it’s there:
iPhone OS 9_3_2
After the language and locale information, two interesting bits of info: Pixel ratio and resolution:
For Android it is more or less the same, with three exceptions (aside from the order)
Screen resolution is there, but no pixel ratio. Instead there is dpi. Using “density-independent pixels” (dp) you can calculate how many physical pixels one dp is.
Android also insert the manufacturer in addition to the model id:
samsung; SM-G935T; Further another device identificator is appended:
hero2qltetmo, which among other things tells us that it is a Hero 2 model. The last part may change because this is the “OEM id” and will also contain carrier specific info. In this case it’s T-Mobile.
The last bit is interesting. It usually identifies the chipset/cpu. (I’ve seen weird values which I couldn’t make sense of, though). In our case its some Qualcomm hardware:
qcom. Other values may be