Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Help-me generate this successfully #2

Open
pauloswear opened this issue Jun 29, 2023 · 3 comments
Open

Help-me generate this successfully #2

pauloswear opened this issue Jun 29, 2023 · 3 comments

Comments

@pauloswear
Copy link

Hello, i am using your model to try generate encrypted password, i will post my code, hope can you help-me

from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
import base64
import struct
from datetime import datetime

def encrypt_password(password, key_id, public_key, version):
    iv = get_random_bytes(12)
    key = get_random_bytes(32)
    ad = str(int(datetime.now().timestamp())).encode()

    cipher = AES.new(key, AES.MODE_GCM, nonce=iv)
    ciphertext, tag = cipher.encrypt_and_digest(password.encode())

    encrypted_key = base64.b64encode(seal_key(key, public_key)).decode()

    result = bytearray([1, int(key_id)])
    result.extend(struct.pack('<H', len(encrypted_key)))
    result.extend(base64.b64decode(encrypted_key))
    result.extend(tag)
    result.extend(ciphertext)

    payload = base64.b64encode(result).decode()

    return f"#PWD_INSTAGRAM_BROWSER:{version}:{int(datetime.now().timestamp())}:{payload}"

def seal_key(key, public_key):
    return public_key.encode() + key

But when I request login endpoint I can't login, it happens:

{"message":"CSRF token missing or incorrect","status":"fail"}

Non encrypted password with 0 version works fine

@M3ikShizuka
Copy link
Owner

Hello, @pauloswear.
At the moment I cannot check if the method specified in this project works.

The message you received in response indicates a problem with the CSRFToken.
"message":"CSRF token missing or incorrect"

Are you extracting the "X-CSRFToken" value from the header of the first server response to your request and using it in a subsequent login request?

As specified in the first step in the readme file:

"csrf_token":"..." ... // <=== this is csrftoken

@pauloswear
Copy link
Author

Yes, I am extracting this. Is possible to exists another key that's missing on final password encrypted?

@M3ikShizuka
Copy link
Owner

Yes, it is possible. The last time I checked this was before I uploaded it to the repository. That was a long time ago, maybe something has changed since then.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants