[Request] Need help with reverse engineering and utilizing Candid's API

Bluscream

Retired Staff
Contributor
May 8, 2015
967
934
211
What is Candid?
https://becandid.com/content/faq said:
Candid is a social platform that personalizes your news feed and lets you discuss your favorite topics anonymously with friends and strangers.
The downside of that is that the staff is also being very anonymous and intransparent so think twice before sharing any personal info with the app or their users.
Why are you using it?
Mainly for the fun and to see the social experiment what people are talking about if you make them think they're anonymous
What are you trying to accomplish?
I want to reverse engineer the Candid API (https://becandid.com/api) and utilize it to create bots and more. The main thing i want to do with it is have a repost statistics bot (Idea blatantly stolen from the Imgur equivalent :) in NodeJS.
What were you able to accomplish already?
I decompiled most of the source code of the Android version of the app with Show Java:
I already found most of the API calls and documented them as best as i can here. I used Firefox's Network Inspector and Postman for that.
P.S. Wasn't easy to find the CEO: https://twitter.com/bindureddy
What do you need help with?
Since i'm not good with plain Java i focused on the Website part and found out that the encoding magic happens here.
If you think you can find it easier in the java code take a look at this or that.
It should be some weird byte encoded json which is hashed afterwards. Example string for a join group request:
Code:
YTpRfWtfSW1oXlhAVcKBbsKAVW5ERA==
I would like to know what function is the magic i need and if the needed magic needs to be different for different api calls.

Thanks for any help <3
 
Last edited by a moderator:
Top