1

I'm using Proxyman to inspect the api requests of an app I use. Most of the data is returned in plain JSON blobs but there is one response which is returning data encoded/encrypted. How can I go about determining the format/encoding of the data?

I'm interested more generally in how I could go about figuring this out on my own in the future because I've had other instances in the past where I gave up decoding apis due to unknown data formatting/encoding, but I'll post the specific data I'm trying to decode in case it's some sort of standard format that someone might quickly recognize.

The only structure I see is that the response is always a json object with indexes "z" and "k", my best guess is that z is some data and perhaps k is a key used to decrypt it? I haven't been able to find anything on google about json objects with z/k keys.

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json; charset=utf-8
Date: Wed, 02 Feb 2022 16:43:32 GMT
Server: Google Frontend
Content-Length: 2143

{ "z": "WNuGTity5EwfHPkeR6vWHzscXr953/mBqvVxKYi99okV/jL64xQUmGcstfMPIkcCHcAHNYlwQ0GiQBc5pCjb3GSe6TrBQ2K0OF3Xl/PXetkgUep3luZl8PFvNUYzPpwBWdiLgRQyKOKnr4yweZLbVcNUE8rXQ4CqWek1RB53xVDxU5YNYgTk1Cl5JDsdOdIwEg9VII5rp/GZhD/2IGK1fMmcHNXT4mIAQ6eNKqcCeTVJP1aUFoFdMYbyhY9gMH4uFOqorUSMYhrcu+bMKq7td1r6cHn+WnM+XBlkIRrQ04qmzezhISbr0n+XKImYuRFUOxxev3nf+YGq9XEpiL32iRX+MvrjFBSYZyy18w8iRwKTUckp2izEk6JAFzmkKNvcNXVCgfGGmPIh79UpZNUFQyBR6neW5mXw8W81RjM+nAFZ2IuBFDIo4qevjLB5kttVw1QTytdDgKpZ6TVEHnfFUPFTlg1iBOTUKXkkOx050jASD1Ugjmun8ZmEP/YgYrV8yZwc1dPiYgBDp40qpwJ5NUk/VpQWgV0xhvKFj2Awfi4U6qitRIxiGqMVDyDoR1htWvpwef5acz7fK4c+gv5EP6bN7OEhJuvSf5coiZi5EVQ7HF6/ed/5gbekTVDREpcTvQ/srh2vbIDJOB3wA55/Ir7djvsiZ/TFmTlSzGyIsfMV3vnJtYQWgYObGRX2nuPIsdZpunTfPGjxbzVGMz6cAV0SLgkwrXqYp6+MsHmS21VwsWylC4AF48KehBzrkh9AX2sPfYiJK2gXyB08hSiDzhcPB2lBSYdncqrPY1jPcdU0YDLcj03IG+S4t0/J8iF5yfwRsEEyfOvlalkndFLW6UzVS5suLd+nnpY7Z5n5pewOfBaV0DXwLoKEzOWF6huof71ELVVAgAKnVMpjvRu+pQBmW1Q8GkVAbX1DieqZc5k9u+NNOl0dDV4sUuymxnjllZ73I4b6mfdKb1dBQoUO22IW+RQ4QB+hE2SvqZdBxrgkFV092c4bJu1kniRWupdtMZLzaPsMZdDw23TKM5kPCNLDyS7IlBaG58GhxTYyLrCvRLiS8vPQR+IR+Xv4NgAV+P8RjxVxxug1wgIDJcaDWHY2A1vNHwZet4/YdgQK0/G5y5CZpnrad3bt8yVIkn1L9H+ev7ahAvhuYXk8laQCh+rXu14VXZ9y8UZiAtXypKVjdNe1szqPU3foJwajQN6gps3s4SEm69IPWQ+EFa6nuBfnE+h7MSaSwBtmPFGqGaA34JhNrjhD5ybw0A1qDS65yPIfOMmo0n26XZUJgMdysFxbHT2dZgYXLuvYokt334q9D+yuHa9sgKiunDrvMF9lHAw7XhTBepwVaalvuyw1VbryndI5vOZ8W+r1Ee/+RaTD+KMzLCC35BkuXEUW4QInIv5LlMgH9oddMFu8P+zxlxql6SgxMFhh4J21Zh4k1XNnDY29nfUDbbryOdHeKLlCUlCC1q6tL8RxbQaUyrEYwUfrZ0GLODdK2E3AyRugj7XYwEXX2h/cNlk/7iTKpIrvLi+2xtqZ9UuXboGjQNaEJaYoZaBvKrrLN4oZ21tUYBSTKsJWHm0imzAomCRG87RtcjA5zFb3GmL6wY9yUZ0eCoaKD9gPHidJk8z8Kc4qUEzw23TKM5kPCMjV53iknjoQ58GhxTYyLrAEUipTCXcxLhfIHTyFKIPOFw8HaUFJh2dyqs9jWM9x1TRgMtyPTcgb5Li3T8nyIXnJ/BGwQTJ86+VqWSd0UtbpA1rN8VRLVweeljtnmfml7PBUru3shHUMgoTM5YXqG6jIiGsYx6sLAKdUymO9G76lAGZbVDwaRUBtfUOJ6plzmTGlWcbE7uRg7/ifpd8qcUJKF8VnkCPU1uA6P4I9VPEDQMeclLmd+vnkZIsdTkAL+gUKKtcfVk9XjFK7ZMMFF3aLiL0SkH6CxMmaH8XRnpjqvQ/srh2vbIA4w9gE74wFe/FTlg1iBOTUKXkkOx050jASD1Ugjmun8ZmEP/YgYrV8yZwc1dPiYgBDp40qpwJ5NUk/VpQWgV0x3d+5hnGMdWgU6qitRIxiGlXw5W2Fp7FwWvpwef5acz6NxGBujXFmLtE+l715kY+t",
  "k": "1bKqsULUyOQ" }
1
  • 2
    I would try CyberChef and it's magic operations block. Just paste the unknown data in the input section and check what it detects.some times the output is nonsense sometimes a good hint. Commented Feb 2, 2022 at 20:17

1 Answer 1

1

Your best bet will probably be to debug the application that sends this API request. It looks like base64, so you could also decode it. I did that and the result was not a proper string, so this is probably binary data. You could store it in a file and run file analysis on it too but I think debugging the app will be most likely the way to succeed.

1
  • Unfortunately this is a 3rd party android app built with Unity. Haven't been able to even get it running properly in an emulator. I started working on decompiling the apk and looking through the source but because it's Unity based that seems to be more time consuming than I was hoping. Commented Feb 3, 2022 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.