0

Sorry for any confusion with this question. I'm not even sure exactly what I'm asking.

So what I'm trying to do is reverse-engineer an android app, and then building a python program on my Windows PC to connect to the server of that app.

I ran into some problems though with some sort of "sign request" that has to be passed through the headers.

On some random website, I was able to find an old post by someone with some coding to do the "sign request", but it's referencing to a "signing server", and I don't what that means exactly.. like whether or not I need to setup my own server and install a certificate, etc. (or if it can be a self signed cert)

Anyways, here is a piece of the code (from the other site) where I am trying to figure out what to do with the signing server.

(there's some other code but I'm sure it's not important.. mostly just curious about this first line with the URL which I'm sure is just an example)

signing_server = "http://20.45.122.164:8888/sign"
payload = "some random data"
resp = session.get(signing_server, data = payload)

(ultimately I need the signature from this like of code)
return json.loads(resp.text)["signature"]

Any idea? I don't know much about this stuff... but I'm hoping it's something easy where I can just throw in some random server online and have it signed for me.

  • If you're asking: "how to connect to https server with requests" then no, you dont have to sign anything. – t.m.adam May 27 '17 at 4:18
  • I need to get a signature though. So that I can throw it into the headers. – user3276588 May 27 '17 at 4:30
  • resp = session.get(signing_server, data = payload, headers={'key':'value'}) . – t.m.adam May 27 '17 at 4:34
  • But any idea what I would use for the URL for the "signing_server" variable? Or would I need to setup my own server to do this? – user3276588 May 27 '17 at 4:40
  • What is the target server you are connecting to? Not that one used for signing. The server providing the final service. Can you also disclose name of the application you are trying to transfer? Its really hard to help you without such information. – Fis May 27 '17 at 4:49
1

You are probably asking about Public Key Infrastructure. Or some similar design.

PKI works in the way you generate a certificate signing request on your device then you sign it with your private key to make sure that you are the person / device who is requesting the certificate. Once you have this CSR generated you send it to the server. In automatic mode, the server validates the CSR, basically, it takes a look to the signing request, what purposes you are requesting certificates for (it can be a server certificate, client certificate, certificate for signing emails, whatever) then it checks if the certificate signing request is signed by somebody who owns the certificate allowing him to send signing requests to server (the csr contains the certificate including public key of the private key used to sign the CSR). If everything is valid the certificate is issued to you and signed by server. In non-autonomous mode there is usually person who takes a look on the CSR and validates that you (requestor) are you (i.e. by mail, phone, by checking your ID card, whatever standard identity checking method). Thats in short. Take a look on www.google.com/search?q=PKI, it includes a lot of standards and formats.

I have no clue what the application you are hacking is trying to achieve. It seems to me it is trying to do exactly what I've described but who knows what it collects for CSR in the device and what is included into payload. From my perspective it should be doable as the private key used to sign the payload must be stored in the device itself if it is used at all. But ofcourse, if it is protected with any kind of password which you don't know you are lost.

Its hard to help you without closer information about the application and the server you are trying to connect to. I wouldn't rather ask what it is.

Furthermore, I would also recommend you to don't ask such hacking questions here as it seems you are trying to achieve something bad, something what was not intention of the software authors.

  • Thanks for the information. I will try looking up PKI like you suggested. At this point though I don't feel like my issue has anything to do with the android app or the server it connects to. The payload just contains all of my cellphones details. So I will be providing that payload to some sort of "signing server", and they return me with a signature. I can take care of the rest from there. This "signing server" doesn't seem to have anything to do with the app. But also not sure where to find it or if I need to setup my own server. But again I will try looking up PKI :) – user3276588 May 27 '17 at 5:01
  • And as for the hacking questions, sorry if that is a big issue. I don't really believe it to be illegal or bad or anything. But I understand how it could be seen as a negative thing to this community, or even possibly the developer, so I apologize if that's the case. Half of it for me is trying to learn, and another part of it is having my own program to communicate with the app's servers for ease of access. – user3276588 May 27 '17 at 5:05
  • I would say the signing server is really related to the application. Where yout ook that IP address you mentioned in your post? – Fis May 27 '17 at 5:14
  • Is the application in your phone working? Check the exact IP it is using to send signing requests to. Btw. You said you are doing reverse engineering. It is usually non-legal ;) – Fis May 27 '17 at 5:18
  • Ok I gotcha :D Anyways, I'll have to look at this further in the morning. But I was pretty sure that the person who made the code and that non-existant IP address meant for it to be changed to our own information (aka server to sign). I could be wrong though :P But he even left the variable 'signing_server' commented out at other parts of the code, like knowing that it would have to be updated. Maybe tomorrow I will have a look through WireShark and the java code to see if I can find anything. – user3276588 May 27 '17 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.