1

I have an iOS app which uses digest HTTP authentication with nonce which expires every 5 minutes.

The client calculates response as following:

HA1=MD5(username:realm:password)
HA2=MD5(method:digestURI)
response=MD5(HA1:nonce:nonceCount:cnonce:top:HA2)

My goal is to figure out the password.

Brute-force attack appears to be unfeasible here. I've also tried to recover the password from the keychain and decrypted app binary/resources. I've also tried to impersonate authentication server to force client to fallback to basic authentication, but it didn't work either. Any other ideas?

1

So finally, I used Cycript and attached to the running app process, and consequently intercepted the private key in runtime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.