ansaurus

Question

Answer 1

+6 A:

Nonce, cnonce and so on are related to HTTP Digest Authentication, which is an authentication mechanism that enables authentication without sending a password in plain text. So if you want to cheat in your PS3 game, you'll first have to hack that password out of the MD5 hash, I guess.

And it's not called HTTP packets, on layer 7 you would usually say request/response or similar.

AndiDog 2010-02-26 19:31:47

i guess i didnt make it clear lol, im not trying to cheat. i just want to get the leaderboards of the game in xml format in a browser. those requests/responses ( :) ) only ask for the leaderboards. no scores are sent to the sony servers

Ozzy 2010-02-26 19:37:33

You can try bruteforcing the digest password - it'll require you to do two MD5 operations per tested password (HA2 can be precalculated), which should mean you can test in the tens of millions of passwords per second. If the password wasn't too long, you could conceivably find it this way.

caf 2010-02-27 07:51:05

Answer 2

+3 A:

The nonce an nonce and cnonce look like hash codes.

One possible defense mechanism against cheaters could be this:

def ps3client_send_score():
    score = "bazillion points"
    nonce = md5(score + "something you don't know about")
    send_to_server(score, nonce)

On the server side:

def get_client_score(score, nonce):
    if md5(score+"something you don't know about")==nonce:
        accept_score(score)
    else:
        reject_score_and_ban_the_fool_if_he_continues_this()

So unless you want to spend weeks trying to find the salt deep in your game, forget it.

Otto Allmendinger 2010-02-26 19:32:15

that would make alot of sence except those packets only recieve leaderboard data. so i dont see why theere would be alot of authentication. i mean the second motorstorm game doesnt even auth the leaderboards. i just want a way to scrape the leaderboards as there is no online one for the first motorstorm ><

Ozzy 2010-02-26 19:36:15

+1 if only for the else in get_client_score, lmao

Brabster 2010-02-26 19:45:49

ansaurus

tags:

views:

answers:

HTTP Packets, Whats Happening?

related questions