So my idea was.. There is a program that require login to be able to use(the program should work offline aswell not requiring any online data), so i want to make that program to be able to run offline aswell, so what i did is i captured the packets (with wireshark) that moved to the program while logging in, next i tried to replay (with bittwist and colasoft packet player) those packets in offline while trying to log in in the program with that i tried to fake log in, but it not seems to work, the program doesn't receive or accept those packets. What's wrong with my idea or method or how should i do this?

  • it want packets i guess, when i am in offline and i try to log in, it sends packets to the server(sure it won't arriva and won't get answer aswell since offline), and awaits for answer, at that time i send the packets but the program doesn't receive or accept those packets.
    – deserius
    Nov 7 '14 at 12:21
  • This should be on reverse engineering. But it might have a challenge response in there, still check for internet connections, have checksums etc.
    – Stolas
    Nov 7 '14 at 12:39

You are trying a replay attack. Those who design protocols know about replay attacks and try, usually successfully, to defeat them. Often that's done by using a timestamp or a random number (called a "nonce" by cryptographers) in a hash that's attached to a message.

You can find some detail here: http://en.wikipedia.org/wiki/Replay_attack

  • This is considering that the software uses some kind of replay protection. Which most dont
    – drpexe
    Nov 7 '14 at 14:51
  • 3
    @drpexe: Citation needed.
    – Bob Brown
    Nov 7 '14 at 15:50
  • Ok, saying that most of application don't use replay protection without justifying was not the best argument. Thanks for pointing that out! What I mean is that applications have 2 categories: those that use a secure protocol (such as HTTPS) with replay protection and those that don't. If the application don't use a secure protocol,, it's VERY LIKELY that the application doesn't have any replay protection. Yes, the developer could have built his own nounce or MAC algorithm, but it would be way easier if he just implemented a secure protocol.
    – drpexe
    Nov 7 '14 at 18:17

Is the connection encrypted? If it is, then probably they also use some kind of replay protection. This means that there's not much you can do. Maybe if it's HTTPS you could forge a certificate and add to the root certificates on your PC. I saw this being done to defeat need-to-stay-online games.

If not, you could look at the information on the packets and write a simple authentication server with python (or something similar). Just look at the patterns and reply something meaningful. This is more guaranteed to work than simply replaying packets and it's not really difficult.

Forgot to mention: To make the application send packages to your local server and not the online server, you could edit the HOSTS filename in Windows.

  • drpexe can i talk to you directly? like skype or something.. here is mine dezyje (skype)
    – deserius
    Nov 7 '14 at 17:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.