0

I am thinking of taking up ethical hacking as a hobby. So, I installed Burp Suite Community Edition and set it up with Firefox. I opened Instagram and tried to login with these details (just for testing):

Username: admin

Password: 123456

However, when I intercepted the request in Burp, although the username was still admin , the password had been encrypted to something else. How can I find the 'formula' Firefox used for converting 123456 to that string?

  • If you are just starting, you may want to analyze a simpler site than instagram first. – john doe Jun 5 at 20:01
1

Passwords are not encrypted inside a POST request.

If any encryption is done it is either at the transport layer (i.e. HTTPS instead of HTTP) and/or there is some application specific client side encryption done. In your case it seems to be the latter and you have to look at the applications code (i.e. the Javascript executed by the client) on how exactly this is done with this specific application.

| improve this answer | |
  • Could you please tell how to find the function being executed. I tried looking at the events executed when "submit" button is clicked, but that didn't help – Fitz Watson Jun 5 at 7:29
  • @FitzWatson: Analyzing the source code of third party applications to find out exactly how these work would be too broad and is also usually considered off-topic on this site, i.e. we usually don't do reverse engineering here. Try Reverse Engineering instead for help but don't expect that someone will simply do this for you. – Steffen Ullrich Jun 5 at 8:28
  • I don't want to reverse engineer it. Just want to locate the formula like Firefox does. Like, I just want to be able to provide 123456 and get the string, not reverse of it. – Fitz Watson Jun 5 at 8:59
  • 1
    @FitzWatson That is exactly what "reverse engineering" means. You'll have to do some wetwork, learn how to use the JS debugger in your browser, and see what happens between clicking submit and the request being sent. – MechMK1 Jun 5 at 9:23
  • Oh ok. Is there a way to move this question to Reverse Engineering Stack Exchange? – Fitz Watson Jun 5 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.