DIAMOND Handling Multi-Step "Challenge-Response" Logins

[TheMekanic]

[ Hidden Content! ]

Sites like Steam and Epic Games use a two-step handshake: first they send a "Salt" or "Nonce," then you hash the password with it.
LoliCode Implementation:

C#


// Step 1: Fetch the Nonce

BLOCK:HttpRequest

  url = "https://auth.site.com/get_salt?user=<USER>"

  method = GET

  => VAR @Salt

ENDBLOCK


// Step 2: Hash Password with Salt

BLOCK:Script

string saltedPass = Clp.Hash(data.PASS + data.GetVariable("SALT"), "SHA256");

data.Variables.Set(new StringVariable(saltedPass, "FINAL_PASS"));

ENDBLOCK


// Step 3: Login with Hashed Pass

BLOCK:HttpRequest

  url = "https://auth.site.com/login"

  method = POST

  content = "user=<USER>&password=<FINAL_PASS>"ENDBLOCK