yeah it's not base64 decoded, as it has to be sent in a header. As I said, it remains to figure out what decryption algorithm is used, either by stepping through the JS in a debugger or reversing it. From a quick read of the JS it looks like some variant of AES with a 16 byte "iv". I tried a few of the more obvious ones like AES-256-CTR but no luck.
|