[Dupheadss]

Hello guys a mate of mine challenged me to crack a login system he has thrown together.


It's a simple exe login interface that sends username,password & Unique ID via HTTP Post to a web server (I can see this all in plan text using wireshark)

The post method sends that data to a Api.php script that then returns a json string :

{"IsError":true,"ErrorMessage":"Invalid Request","ResponseData":"","Active":false,"Clients":0,"ID":0,"Init":"","Final":""}

This is a fairly simply json object and my logic was then to simply dns spoof (using the Host file in windows 10) the web-server to my localhost, write a server that will always return the json object but with edited data such as :


{"IsError":false,"ErrorMessage":"","ResponseData":"","Active":true,"Clients":100,"ID":1,"Init":"","Final":""}

However the program refuses to play along and spits out this :

Screenshot of Error


The server I am running on my local PC returns this when trying the login :

Code

[System-Packet]: POST /api.php HTTP/1.1
[System-Packet]: Content-Type: application/x-www-form-urlencoded
[System-Packet]: Host: ---REMOVED FOR SAFETY----
[System-Packet]: Content-Length: 196
[System-Packet]: Expect: 100-continue
[System-Packet]: Connection: Keep-Alive
[System-Packet]:
[System-Packet]:

Any advice would be greatly appreciated 😖