Last piece of the puzzle is to know how to talk to anyone on this website, rather than just to that person. It is a high-walled castle with an open gate and no guards inside it.There does not seem to be any identifier to the person I am chatting with except in the message websocket frame. Your membership could easily be replaced by a Chrome extension that replaces URLs for photos, replaces HTML of the inbox to match what you get in the requests, and send out messages using your websocket.” or “If you had one last day in your life, what would you do? If they did reply, you wouldn’t know what they replied or be able to send a personal message unless if you pay.This dating website charges more than £50 per month to be able to see photos and to message people.
Reader Interceptor Executor$Un Closeable Input [email protected]; line: 1, column: 2] (through reference chain: api.message. Let’s have a look at the list of pre-defined messages.
Seems that they did a good job here in knowing that I am not using the proper SSL certificates and that I am performing a man in the middle attack.
I said, well if the i OS application is a bit hard to hack, let’s try the web application. I could almost see the same interface, same blurred faces, same inbox which I cannot read.
Client Message Wrapper["message"])Hmm, interesting. I opened the list to send more messages and I inspected the HTML and it turns out that that message has the ID 62. The reverse engineering I just did is 99% done on Chrome without the need of any other tools.
Ah okay I see where I went wrong, message Id is some other ID, while the value is 62 for the pre-defined message. I remembered that while looking through the GET requests, I saw such a thing. Refresh the inbox page, and voila we have a message written. I won’t waste more time on this, my point’s proven. Gaining full membership features to a service that charges so highly was so easy as most of the security was done at the frontend, not the backend.