Hack my app find api key

Koded Apps
#1

So iv have created the app and i want to test it’s security can you please find api key
https://drive.google.com/drive/folders/12dT5bVvaSN3sxdhgK1VH0_0o45oiZBEe
Note thare is two api key two firebase url
One is fake for fool hackers
so lets find out and let me know

#2

Something like this

image

3 Likes
#4

@nikzdevz Can you store values in database please

#5

No, sorry i’m not gonna do that.

#6

Your token may be something like this
AIzaSyCxfHY******************

I can’t paste complete token…

#7

@nikzdevz i think you cant find api key i said find api key and store values

#8

no that is fake token find real token please

#9

Okay now i’m leaving the topic.
Also a feedback app is not secure use obfuscate block to make your key and url little bit secure.

And I am not going to store any value as don’t want to much into this topic.

#10

ok you won but can tell \me how to secure it more

#11

Thanks

Already told here

#12

@nikzdevz it mean i have to use url in obfuscate block how can i secure api more better which extension is best

#13

If you can create own encryption it will be best else use kodular’s obfuscation or any encryption extensio

#14

@nikzdevz can you find airtable api key also?
Please tell me

1 Like
#15

@All_In_Hindi it is possible to find airtable key

#16

@HritikR What will happen if example my api is dogcattiger128 and i store value in airtable is dogcattigeur128 after i got value i will erase u and use it as api key ?

#17

If you will erase the value from airtable. How will other users get that API key stored in airtable?

#18

@HritikR for example my firebase api key is “lokiee” and i stored “lokfiee” and when got value i will erase “f” after that i will use it is this good?

1 Like
#19

@nikzdevz NOW i am getting api key cfrom airtable and i am making somechanges is this secure

blocks (1)
blocks (1)858×474 41.2 KB

blocks

1 Like
#20 
 https://www.youtube.com/channel/UC1O_ZmA-pbhOwsoibHSH7vg
 https://yudhbhoomi-da952-default-rtdb.firebaseio.com
 https://yudhbhoomi-da952-default-rtdb.firebaseio.com/
 https://yudhbhoomi-da952-default-rtdb.firebaseio.com/Appdetails
 https://yudhbhoomi-da952-default-rtdb.firebaseio.com/Join
 https://yudhbhoomi-da952-default-rtdb.firebaseio.com/Numbers
 https://yudhbhoomioffical.blogspot.com/2022/01/yudhbhoomi-home-page.html
 https://drive.google.com/drive/folders/1fwWMDx6YK8B3nGcZcsrMVasNM7MqpTOc?usp=sharing
 https://drive.google.com/file/d/1LeqhLTxNefQJUF3yeK4clDoufptCXxSQ/view?usp=drivesdk

I got onesignal and firebase API key and i was able to bypass the screen and able to edit tiny db values on rooted device and i changed the app package name by modifying the Dex files and app still works without checking package name and i got some obfuscated strings and these obfuscated strings values was readable at run time by reading memory and traffic capture

3 Likes
#21

which software did you use