[blockdude]

There's a website (debank.com) that employs authorization headers to access their public api, i need to figure out how the signature is calculated. Without the correct header(s) the api is heavily rate limited.

The headers in question are

Code

x-api-sign
x-api-ts
x-api-ver
x-api-nonce

You can find these headers being sent with each api call by browsing around on the website.

It's the x-api-sign that's the most difficult to reverse.

I would like somebody to reverse engineer how these headers are being generated and write a python library with source code that i can use.

Start Contract

[loadman]

To reverse engineer the x-api-sign header,

Analyze the website's API calls: Use browser developer tools or network sniffing tools to capture the API requests and responses. Look for any patterns or clues in the headers or payloads.


Inspect the website's JavaScript code: Look for any JavaScript files that handle API calls or generate the headers. Analyze the code to understand how the signature is calculated.


Look for publicly available documentation or SDKs: Check if the website provides any documentation or software development kits (SDKs). Sometimes, the documentation might include information on how to generate the required headers.


Analyze the function or method that generates the headers: Once you have identified the relevant code, analyze the function or method responsible for generating the headers. Look for any cryptographic algorithms, hashing functions, or encryption methods used in the process.

Code

import requests
import hashlib
import hmac
import time
import random

def generate_headers(api_key, api_secret):
    timestamp = str(int(time.time()))
    nonce = str(random.randint(10000, 99999))

    # Generate the signature using the API secret and other parameters
    signature = calculate_signature(api_secret, timestamp, nonce)

    headers = {
        "x-api-sign": signature,
        "x-api-ts": timestamp,
        "x-api-ver": "1.0",
        "x-api-nonce": nonce,
    }

    return headers

def calculate_signature(api_secret, timestamp, nonce):
    # Implement the logic to calculate the signature using the API secret, timestamp, and nonce
    # You may need to use cryptographic functions like HMAC or hashing algorithms

    return signature

# Example usage
api_key = "your_api_key"
api_secret = "your_api_secret"

headers = generate_headers(api_key, api_secret)
response = requests.get("https://api.example.com/endpoint", headers=headers)
print(response.json())

this is just a basic template and im not that good in python but yes....

[blockdude]

Thanks but i need a real person to look at this not a chat gpt effort