01-22-2018, 11:08 PM
(01-22-2018, 06:37 AM)epixoip Wrote: Is the json you posted the request or the response? If it's the request, and that is indeed a hash of the password, then the password is being hashed client-side and you simply need to read the javascript to figure out what it's doing. However, it looks like that hash isn't a password hash, but rather the session id.
Anyway, undeath is correct. The biggest threat to http is mitm, so you need to actually mitm the app to demonstrate that threat.
Thanks!
Maybe is a session id. The application connects to apache tomcat. I'm trying to filter by "http.request.method == POST", but I can't see hash pass :-(