There is a website that gives you a token and the unixtime to access a resource on another domain.
I can use those 2 values to access it like that:
Example: example.com/test.txt?st=[HASH]&e=[UNIXTIME]
I build a small script that generates those values and displays them in the format
[UNIXTIME] : [HASH]
http://46.101.150.244/m/serve.php (You can refresh to see new combinations.)
Observations:
When I request a token and get "st" and "e" by using my remote server, I can't access the resource. -> it is bound to a specific IP, no other parameters.
Also when generating 2 tokens at the same unix time from different ips, they are different -> confirmation of 1.
When generating a token multiple times within a second from the same IP, the token is always the same until the unix second passes. -> Pretty sure the only dynamic factors are the IP and the time.
When looking at the last character of the hash, it is always either A, Q, g or w. Their hexvalues are (same order) 41, 51, 67, 77. A,Q and g,w are exactly 0x10 apart.
I assume it is base64, but it has - and _ instead of + and /. Do you think thats possible? It also has 22 characters.
I tried many different things, trying to decode base64 (often padding error), trying substrings to maybe find something useful, the IP in binary representation for example, but since the whole string completely changes every time the unix time changes, I really dont know if there is anything I can do.
Its totally possible that it is salted and I have zero chances of finding a solution, however the fact that the last letter is always one of four possibilities gave me hope.
I had a lot of fun approaching this challenge, if someone could give a hint how to approach this situation, what I should try out etc, that would be great!
