Well that was a fail, I sent it to the same girl that I tested on. Shouldn’t have added the name, it’ll look super weird now… I was thinking, maybe if I have a paid account, then I can see how can I map the blurred images to the original images. In fact I did:curl 'https://com/publicapi/v2/matchprofile/12303942525/profile? ' -H 'authorization: Bearer 12339f23-2302-4e6f-b9ae-1f9c99a6e123' -H ' Accept-Encoding: gzip, deflate, br' -H ' Accept-Language: en-US,en;q=0.9,ar;q=0.8' -H ' User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) Apple Web Kit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36' -H 'x-xyz-gdid: ' -H 'accept: application/json' -H ' Connection: keep-alive' -H 'content-type: application/json' -H 'x-xyz-platform: desktop' --compressed Alright, let’s change one number of the match ID, and see if we can get data.404 Not Found. Your privacy policy states that you have extensive security measures including the use of SSL, that you’ll exercise reasonable care in providing secure transmission of information, but you also state that you accept no liability of any unintentional disclosure of information.
I thought, first thing I can do is to see the network traffic coming in and out of the app. So I installed a proxy on my Mac, Charles, and ran the i Phone’s Wi Fi through that proxy. But wait, did they just send the girl’s full profile over non-secure HTTP?
Hmm…There is a list of blurry photos, but I couldn’t get access to the non-blurred photos easily. All important requests seem to be happening on SSL.
In addition, you will find them in the message confirming the subscription to the newsletter.
I am not a fan of online dating, nor do I have any online dating apps installed on my devices.
Reader Interceptor Executor$Un Closeable Input [email protected]; line: 1, column: 2] (through reference chain: api.message. Let’s have a look at the list of pre-defined messages.
Client Message Wrapper["message"])Hmm, interesting. I opened the list to send more messages and I inspected the HTML and it turns out that that message has the ID 62. The reverse engineering I just did is 99% done on Chrome without the need of any other tools.Without paying for full membership, you’ll only be able to look at how compatible you are, smile at people, and send pre-defined ice-breaking messages such as “If you are famous, who would you be?” or “If you had one last day in your life, what would you do? If they did reply, you wouldn’t know what they replied or be able to send a personal message unless if you pay.The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801.Detailed information on the processing of personal data can be found in the privacy policy.Oh Damn, the chat is happening over websockets (I should’ve expected that). Moving over to websocket filtering in Chrome Network tab, gladly there was only one websocket to monitor.