I am thinking of taking up ethical hacking as a hobby. So, I installed Burp Suite Community Edition and set it up with Firefox. I opened Instagram and tried to login with these details (just for testing):

Username: admin

Password: 123456

However, when I intercepted the request in Burp, although the username was still admin , the password had been encrypted to something else. How can I find the 'formula' Firefox used for converting 123456 to that string?

  • If you are just starting, you may want to analyze a simpler site than instagram first.
    – john doe
    Jun 5, 2020 at 20:01

1 Answer 1


Passwords are not encrypted inside a POST request.

If any encryption is done it is either at the transport layer (i.e. HTTPS instead of HTTP) and/or there is some application specific client side encryption done. In your case it seems to be the latter and you have to look at the applications code (i.e. the Javascript executed by the client) on how exactly this is done with this specific application.

  • Could you please tell how to find the function being executed. I tried looking at the events executed when "submit" button is clicked, but that didn't help Jun 5, 2020 at 7:29
  • @FitzWatson: Analyzing the source code of third party applications to find out exactly how these work would be too broad and is also usually considered off-topic on this site, i.e. we usually don't do reverse engineering here. Try Reverse Engineering instead for help but don't expect that someone will simply do this for you. Jun 5, 2020 at 8:28
  • I don't want to reverse engineer it. Just want to locate the formula like Firefox does. Like, I just want to be able to provide 123456 and get the string, not reverse of it. Jun 5, 2020 at 8:59
  • 1
    @FitzWatson That is exactly what "reverse engineering" means. You'll have to do some wetwork, learn how to use the JS debugger in your browser, and see what happens between clicking submit and the request being sent.
    – user163495
    Jun 5, 2020 at 9:23
  • Oh ok. Is there a way to move this question to Reverse Engineering Stack Exchange? Jun 5, 2020 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.