4 ms·
Might be possible to use DNS to point api.petkt.com to a local webserver and rewrite the API? I can't imagine it has that many endpoints or that much logic. I
by Brybry 4y ago
Might be possible to use DNS to point api.petkt.com to a local webserver and rewrite the API?
I can't imagine it has that many endpoints or that much logic. I would think the main issue would be potential encryption/authentication but if they're using plaintext HTTP for the phone app then maybe the feeders are using plaintext HTTP too...
- Nextgrid 4y agoIf the device is using HTTPS, you'd need a valid certificate for that hostname - that's exactly the attack HTTPS is designed to defend against. And if they're using certificate pinning, it can't even be any certificate from a trusted authority, it has to be one particular authority or even that specific certificate that they use (they could very well be using an internal CA for this, as they control the other end of the connection).
- KMnO4 4y agoFrom the article: > You'll see that the data for these products is sent in plaintext to and from their servers... No HTTPS... That's just sketchy.