You're close, but that first endpoint is just to retrieve the auth URL, no need to post anything to it. It then passes the seed and password to the returned URL, so:
"http://35.246.158.51:8070/auth/v2" gets '{"Seed": "xxx", "Password": "xxx"}' of some kind
I haven't yet figured out what those are though...
See:
Future<Token> login(String seed, String password) {
var headers = new Map<String,String>();
return _netUtil.get(LOGIN_URL, headers:headers).then((dynamic authUrl) {
try {
if (authUrl == null) {
return Future<Token>.sync(() => new Token("", false, 0));
}
var loginUrl = BASE_URL + AuthURL.map(json.decode(authUrl.body)).url;
So reading about flutter, there's quick reload information in debug mode[0]
This leads me to believe that the seed and password entered in development / in the cookie jar from a previous attempt are somewhere in the `isolate_snapshot_data` file
replacing the original url with http://35.246.158.51:8070/auth/v2 and then sending a json like '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "d7c6bdcfcb184bf587ceee7c7c28e72e"}' with "Content-Type: application/json" returns {"IsValid":false,"LockURL":"","Time":136764}
the Time here (as per my understanding in the code) is the request duration, which somehow contradicts postman's request duration field
now one weird thing I've noticed about this app is this, if i install it on a regular device, and connect that to a proxy, then type gibberish into the fields then click Login, the following code gets invoked
void _submit() async {
final form = formKey.currentState;
if (form.validate()) {
setState(() => _isLoading = true);
form.save();
_networkActions.login(_seed, _password)
.then((result) => _loginCompleted(result))
.catchError((e) {
_loginCompleted(new Token("", false, 0));
});
}
if a loading icon appears then I assume that the code passed the condition and passed this line of code "setState(() => _isLoading = true);" now the weird part is that, I don't see any outgoing connections from the app... (I use charles to capture requests)
It's normal that you don't see any traffic using Charles, since Charles can only intercept traffic made by HttpUrlConnection or OkHttp, since flutter is not using any of those two..you can't see anything in Charles.
THIS IS LEGITIMATE.
The Israeli Mossad had a ad today, https://www.algemeiner.com/2019/05/09/mossad-marks-israeli-i...
with a picture.
The picture has 4 rows of trophies, which should be converted to 4 numbers using binary --> decimal.
Those four numbers are 35, 246, 158, 51.
As an ip address, 35.246.158.51 leads to the site OP posted.
The challenges usually involve static analysis / disassembly, breaking improperly configured crypto, etc. The best part (for me at least) is that competitors must submit a write-up of how they cracked the challenge, and the best write-ups are published. It makes for fascinating reading even if you’re not really into that scene.
on page 397 there is entry in index:
iWalk, v2 71
on the same page there are interesting terms like
islamic terrorism, jihad via internet, judism...
also page number 71 which stands next to iWalk term is interesting coincidence since this riddle is celebrating 71 years of Israel independence...
If I need to read the source code of a fucking website for it to be useful, then it's either a really special edge-case or the designer is a moron. Guess which case this is.
Why not upload a plain text file in the first place?
Readit News
Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl. (Grep for the IP to find it.)
So, using the web site name as the seed and the 'client id' as the password, we get:
$ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "d7c6bdcfcb184bf587ceee7c7c28e72e"}' http://35.246.158.51:8070/auth/getUrl
The response is an HTTP 200 and: {"AuthURL":"/auth/v2"}
http://35.246.158.51:8070/auth/v2 is I guess the next step.
edit: The /auth/getUrl endpoint responds to any request with the same response, so that may not be the right Seed/Password combination.
I haven't yet figured out what those are though...
See:
This leads me to believe that the seed and password entered in development / in the cookie jar from a previous attempt are somewhere in the `isolate_snapshot_data` file
[0] https://github.com/flutter/flutter/wiki/Flutter-engine-opera...
first of all, as per the code, the User-Agent must be setup to "iWalk-v2"
then doing a simple get request to http://35.246.158.51:8070 will return {"AuthURL":"/auth/v2"}
replacing the original url with http://35.246.158.51:8070/auth/v2 and then sending a json like '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "d7c6bdcfcb184bf587ceee7c7c28e72e"}' with "Content-Type: application/json" returns {"IsValid":false,"LockURL":"","Time":136764}
the Time here (as per my understanding in the code) is the request duration, which somehow contradicts postman's request duration field
now one weird thing I've noticed about this app is this, if i install it on a regular device, and connect that to a proxy, then type gibberish into the fields then click Login, the following code gets invoked
if a loading icon appears then I assume that the code passed the condition and passed this line of code "setState(() => _isLoading = true);" now the weird part is that, I don't see any outgoing connections from the app... (I use charles to capture requests)"Welcome Agent.
A team of field operatives is currently on-site in enemy territory, working to retrieve intel on an imminent terrorist attack.
The intel is contained in a safe, the plans for which are available to authorized clients via an app [0].
Our client ID is d09ff4ec651c48f89f7f7aa19160bd55
Your mission is to retrieve those plans, and allow our team to break into the safe.
Good luck!,
[0]: http://3d375032374147a7865753e4bbc92682.xyz/static/app.apkYou could always install it on a virtual phone in a sandboxed VM.
Deleted Comment
As an ip address, 35.246.158.51 leads to the site OP posted.
The challenges usually involve static analysis / disassembly, breaking improperly configured crypto, etc. The best part (for me at least) is that competitors must submit a write-up of how they cracked the challenge, and the best write-ups are published. It makes for fascinating reading even if you’re not really into that scene.
https://books.google.rs/books?id=1nfhpqvLSM4C&pg=PA397&lpg=P...
on page 397 there is entry in index: iWalk, v2 71 on the same page there are interesting terms like islamic terrorism, jihad via internet, judism... also page number 71 which stands next to iWalk term is interesting coincidence since this riddle is celebrating 71 years of Israel independence...
1. Access $("#text1")[0].innerHTML
2. $( document ).ready() { typeWriter (); }
facepalm
Why not upload a plain text file in the first place?