0

I'm working on a college project to understand how the IOS application sends the password in the REQUEST already encrypted in AES128, what is its key, and send a REQUEST with our string transformed into a password encrypted with AES128 in the same way. We were not given any specific method to accomplish this, we are free to use whatever is useful.

No response from the application's requests returns the password encryption key.

We have performed traffic capture and SSL Pinning in IOS.

What method would you use to discover this key?

Other teams have already succeeded, but the information cannot be shared, the purpose of the task is precisely for the teams to use the methods they have chosen to send a request with encryption encoded in its string.

Improve this question

1 Answer 1

Reset to default
0

Here are three ways do do it:

  1. Submit your string as a password in the IOS application and capture the request
  2. Reverse engineer the IOS application and find the key, then encrypt the string using the same method as the IOS app
  3. If the password for the initially captured REQUEST is known attempt to bruteforce the key and then encrypt your string using the key

You're only limited by your imagination/time, your lecturer is probably willing to give you some hints if you ask.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .