1

Lets suppose my program makes a http request and uses it response to update some values. Is it possible to somehow mimic the response in order to modify it so the program believes the server responded when in fact it was a hardcoded response? I'm not using HTTPS.

12
  • 1
    Yes, e.g. with Fiddler Dec 16, 2014 at 15:46
  • Why do you ask that question? Dec 16, 2014 at 15:47
  • I'm developing a program which makes an http request to retrieve 'credits' that the user is able to use. Despite the clients using it are very few and the chances of being hacked is close to zero, I wanted to take some security measures. Thanks
    – Vallo
    Dec 16, 2014 at 15:50
  • 1
    You want to implement some kind of licensing or DRM scheme? Dec 16, 2014 at 15:53
  • 2
    @Vallo Keep in mind that it is not possible to make it not possible to bypass your client-side check. (Worst case scenario: someone rewrites your client program from scratch, but without the part that makes it require credits.)
    – user253751
    Dec 17, 2014 at 2:28

1 Answer 1

2

Yes, it's possible and it's trivially easy.

You can make it a bit harder by using HTTPS and a pinned certificate but that will not stop anyone with a bit of time on their hand (they will then need to modify your executable, or, at least, the container where you placed your pinned certificate) and it will make it harder to manage your server (because if you need to change your certificate, you'll need to update your clients as well).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.