1

I'm using Proxyman to inspect the api requests of an app I use. Most of the data is returned in plain JSON blobs but there is one response which is returning data encoded/encrypted. How can I go about determining the format/encoding of the data?

I'm interested more generally in how I could go about figuring this out on my own in the future because I've had other instances in the past where I gave up decoding apis due to unknown data formatting/encoding, but I'll post the specific data I'm trying to decode in case it's some sort of standard format that someone might quickly recognize.

The only structure I see is that the response is always a json object with indexes "z" and "k", my best guess is that z is some data and perhaps k is a key used to decrypt it? I haven't been able to find anything on google about json objects with z/k keys.

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: application/json; charset=utf-8
Date: Wed, 02 Feb 2022 16:43:32 GMT
Server: Google Frontend
Content-Length: 2143

{ "z": "WNuGTity5EwfHPkeR6vWHzscXr953/mBqvVxKYi99okV/jL64xQUmGcstfMPIkcCHcAHNYlwQ0GiQBc5pCjb3GSe6TrBQ2K0OF3Xl/PXetkgUep3luZl8PFvNUYzPpwBWdiLgRQyKOKnr4yweZLbVcNUE8rXQ4CqWek1RB53xVDxU5YNYgTk1Cl5JDsdOdIwEg9VII5rp/GZhD/2IGK1fMmcHNXT4mIAQ6eNKqcCeTVJP1aUFoFdMYbyhY9gMH4uFOqorUSMYhrcu+bMKq7td1r6cHn+WnM+XBlkIRrQ04qmzezhISbr0n+XKImYuRFUOxxev3nf+YGq9XEpiL32iRX+MvrjFBSYZyy18w8iRwKTUckp2izEk6JAFzmkKNvcNXVCgfGGmPIh79UpZNUFQyBR6neW5mXw8W81RjM+nAFZ2IuBFDIo4qevjLB5kttVw1QTytdDgKpZ6TVEHnfFUPFTlg1iBOTUKXkkOx050jASD1Ugjmun8ZmEP/YgYrV8yZwc1dPiYgBDp40qpwJ5NUk/VpQWgV0xhvKFj2Awfi4U6qitRIxiGqMVDyDoR1htWvpwef5acz7fK4c+gv5EP6bN7OEhJuvSf5coiZi5EVQ7HF6/ed/5gbekTVDREpcTvQ/srh2vbIDJOB3wA55/Ir7djvsiZ/TFmTlSzGyIsfMV3vnJtYQWgYObGRX2nuPIsdZpunTfPGjxbzVGMz6cAV0SLgkwrXqYp6+MsHmS21VwsWylC4AF48KehBzrkh9AX2sPfYiJK2gXyB08hSiDzhcPB2lBSYdncqrPY1jPcdU0YDLcj03IG+S4t0/J8iF5yfwRsEEyfOvlalkndFLW6UzVS5suLd+nnpY7Z5n5pewOfBaV0DXwLoKEzOWF6huof71ELVVAgAKnVMpjvRu+pQBmW1Q8GkVAbX1DieqZc5k9u+NNOl0dDV4sUuymxnjllZ73I4b6mfdKb1dBQoUO22IW+RQ4QB+hE2SvqZdBxrgkFV092c4bJu1kniRWupdtMZLzaPsMZdDw23TKM5kPCNLDyS7IlBaG58GhxTYyLrCvRLiS8vPQR+IR+Xv4NgAV+P8RjxVxxug1wgIDJcaDWHY2A1vNHwZet4/YdgQK0/G5y5CZpnrad3bt8yVIkn1L9H+ev7ahAvhuYXk8laQCh+rXu14VXZ9y8UZiAtXypKVjdNe1szqPU3foJwajQN6gps3s4SEm69IPWQ+EFa6nuBfnE+h7MSaSwBtmPFGqGaA34JhNrjhD5ybw0A1qDS65yPIfOMmo0n26XZUJgMdysFxbHT2dZgYXLuvYokt334q9D+yuHa9sgKiunDrvMF9lHAw7XhTBepwVaalvuyw1VbryndI5vOZ8W+r1Ee/+RaTD+KMzLCC35BkuXEUW4QInIv5LlMgH9oddMFu8P+zxlxql6SgxMFhh4J21Zh4k1XNnDY29nfUDbbryOdHeKLlCUlCC1q6tL8RxbQaUyrEYwUfrZ0GLODdK2E3AyRugj7XYwEXX2h/cNlk/7iTKpIrvLi+2xtqZ9UuXboGjQNaEJaYoZaBvKrrLN4oZ21tUYBSTKsJWHm0imzAomCRG87RtcjA5zFb3GmL6wY9yUZ0eCoaKD9gPHidJk8z8Kc4qUEzw23TKM5kPCMjV53iknjoQ58GhxTYyLrAEUipTCXcxLhfIHTyFKIPOFw8HaUFJh2dyqs9jWM9x1TRgMtyPTcgb5Li3T8nyIXnJ/BGwQTJ86+VqWSd0UtbpA1rN8VRLVweeljtnmfml7PBUru3shHUMgoTM5YXqG6jIiGsYx6sLAKdUymO9G76lAGZbVDwaRUBtfUOJ6plzmTGlWcbE7uRg7/ifpd8qcUJKF8VnkCPU1uA6P4I9VPEDQMeclLmd+vnkZIsdTkAL+gUKKtcfVk9XjFK7ZMMFF3aLiL0SkH6CxMmaH8XRnpjqvQ/srh2vbIA4w9gE74wFe/FTlg1iBOTUKXkkOx050jASD1Ugjmun8ZmEP/YgYrV8yZwc1dPiYgBDp40qpwJ5NUk/VpQWgV0x3d+5hnGMdWgU6qitRIxiGlXw5W2Fp7FwWvpwef5acz6NxGBujXFmLtE+l715kY+t",
  "k": "1bKqsULUyOQ" }
1

1 Answer 1

1

Your best bet will probably be to debug the application that sends this API request. It looks like base64, so you could also decode it. I did that and the result was not a proper string, so this is probably binary data. You could store it in a file and run file analysis on it too but I think debugging the app will be most likely the way to succeed.

1
  • Unfortunately this is a 3rd party android app built with Unity. Haven't been able to even get it running properly in an emulator. I started working on decompiling the apk and looking through the source but because it's Unity based that seems to be more time consuming than I was hoping.
    – Nerdsie
    Feb 3 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.