Things are heating up in The Human Connection Challenge! Can you test your skills with this Thick-Client Applications episode?
Updated 4 months ago
Version 2.0Stuck on Q4. What tool to use to analyse the Application.
If you're clueless like I am (I would have preferred ghidra and a x64-dbg, which - I'm 100% convinced - are just enough to solve the challenge. Functions like write_token, getToken etc. are there. Or try to extract all GIF and PNG images, but that road leads nowhere, too.), then you'll write a reverse proxy in python, and let the traffic flow via that reverse proxy. Or just use netcat to read the packets from the client, and then send them to the API, and then answer back. Since it's all http with text/ascii it can be done.
Pretty sure the official solution will be much simpler.
Burpsuite is king here and all you need.
Oh yeah, burp is used in the official solution.