4 ms·
The strings command is pretty old can do it if you're naive enough to embed a username and password into the game client. The main thing is that its privileged
by hobs 2y ago
The strings command is pretty old can do it if you're naive enough to embed a username and password into the game client.
The main thing is that its privileged - having a token shouldn't let you do anything besides say, report your game stats to a central server or enumerate the server lists, things like that.
- NikkiA 2y agoTBF strings might not trivially show up the password if you took the most basic of provisions (a non-ascii password, not stored right next to the username separated by a \0), but most programmers likely wouldn't even bother with that.
- nijave 2y agoEven then you can MITM if you have elevated access to the platform and can tinker with the certificate store. Games like Pokemon Go use a highly obfuscated algorithm to sign requests which makes it much harder to actually use the key if you can retrieve it