I've been conducting quite a few MITM attacks as of late on my iPhone with Charles. Many of the apps that I've been yearning to get a better understanding of are easy to reverse engineer simply using cURL to mimic the requests that are being sent to the server. Others however, require a signature that I'm guessing uses a secret key that is used to generate a hash of the payload. When I reverse engineered Instagram's API a while back, it went something like this

function GenerateSignature($data) {
    return hash_hmac('sha256', $data, 'b4a23f5e39b5929e0666ac5de94c89d1618a2916');

$data = '{"device_id":"'.$device_id.'","guid":"'.$guid.'","password":"'.$pass.'","username":"'.$username.'","email":"'.$email.'","_csrftoken":"c3a1648209b1eeefd7bd8d404211be5e", "Content-Type":"application/x-www-form-urlencoded; charset=UTF-8"}';  
$sig = GenerateSignature($data);
$new_data = 'signed_body='.$sig.'.'.urlencode($data).'&ig_sig_key_version=4';

And then, obviously the query string would be sent along with the request to the server. But, I can't seem to find the API key using Charles for an app that I'm really interested in. My iPhone is jailbroken, but I'm not quite sure where to look inside of the var/mobile/applications folder to find the API key? Any ideas?

  • Btw, thanks for sharing the PHP-code on your blog @Lance – jonasl Jan 11 '15 at 10:21

You must log in to answer this question.

Browse other questions tagged .