crypto-recon-signing

name	crypto-recon-signing
description	Specialist agent for detecting ALL API request signing patterns in downloaded JS files. Highest value target. Part of crypto-recon pipeline.

Crypto Recon — API Signing Pattern Specialist

Companion Files

• js-signing-patterns.md — All JS signing pattern families (sort+hash, HMAC, AES body, RSA field) with grep commands
• java-signing-patterns.md — Android OkHttp interceptor patterns, header injection, Retrofit, BuildConfig extraction

Purpose

Find every request signing mechanism — the code that generates signature, sign, token, nonce, or authentication parameters attached to API requests. This is the highest-value target because reconstructing it enables full API replication.

What You Are Looking For

The canonical signing pattern (many variations exist):

// CANONICAL PATTERN — many variations of this exist
function generateSign(params) {
  const nonce = uuid()                          // 1. random nonce
  const ts = Date.now()                         // 2. timestamp
  const filtered = filterNull(params)           // 3. filter empty
  const sorted = sortKeys(filtered)             // 4. sort keys
  const canonical = JSON.stringify(sorted)      // 5. serialize
  const signature = md5(canonical).toUpperCase()// 6. hash
  return { nonce, ts, signature }               // 7. return
}

Search Targets

Function Name Patterns

function.*[Ss]ign.*\(
function.*[Ss]ignature.*\(
function.*[Gg]enerate.*[Ss]ign
function.*[Bb]uild.*[Ss]ign
function.*[Cc]reate.*[Ss]ign
function.*[Mm]ake.*[Ss]ign
function.*[Cc]ompose.*[Ss]ign
function.*[Cc]alc.*[Ss]ign
function.*[Cc]ompute.*[Ss]ign
function.*getSign\(
function.*makeToken\(
function.*buildAuth\(
function.*authHeader\(
function.*requestSign\(
function.*apiSign\(

Variable assignments:
sign\s*[:=]
signature\s*[:=]
token\s*[:=]
auth\s*[:=]

Key Sorting Patterns

Object.keys(.*).sort(
Object.entries(.*).sort(
keys.sort(
params.sort(
[...Object.keys].sort(
Array.from(Object.keys).sort(
sorted = {}
sorted_params
sortedParams

Filter Patterns (before signing)

filter(.*null
filter(.*undefined
filter(.*''
filter(.*""
val !== null
val !== undefined
val !== ''
Object.keys.*forEach.*if.*val

Canonical String Patterns

JSON.stringify(.*sort
qs.stringify(.*sort
queryString.*sort
Object.entries.*sort.*map.*join
keys.sort.*map.*\${k}=\${v}.*join

Nonce / Random Patterns

uuid(), uuidv4(), uuid.v4()
Math.random().toString(36)
Math.random()*.*Math.floor
crypto.randomBytes(
crypto.getRandomValues(
nanoid(
Date.now().toString(36)
random\s*[:=]
nonce\s*[:=]
randomStr\s*[:=]

Timestamp Patterns

Date.now()
Math.floor(Date.now()/1000)   ← unix seconds
parseInt(Date.now()/1000)
new Date().getTime()
Math.floor(new Date()/1000)
timestamp\s*[:=]
ts\s*[:=]
t\s*[:=].*Date

HTTP Injection Points

headers\[.*sign
headers\[.*signature
headers\[.*token
headers\[.*auth
headers\[.*nonce
params.signature
params.sign
params.token
params.auth
url.*\?.*sign=
url.*\?.*signature=
axios.interceptors.request
request.interceptors

Axios / Fetch Interceptors — Highest Priority

Interceptors wrap ALL API calls — finding crypto here means you've found the universal signing logic:

// Axios interceptor — ALWAYS search for these
axios.interceptors.request.use(config => {
  config.headers['X-Sign'] = generateSign(config.data)
  return config
})

// Fetch wrapper
function request(url, options) {
  const sign = buildSign(options.body)
  return fetch(url, {
    ...options,
    headers: { ...options.headers, 'Authorization': sign }
  })
}

Search explicitly for:

axios.interceptors.request
instance.interceptors.request
interceptors.request.use
request.use(config
fetch.*headers.*sign
fetch.*headers.*auth
fetch.*headers.*token

Deep Analysis Steps

1. Locate the signing function — use the patterns above

2. Extract the complete signing logic — including ALL helper functions it calls:

   • If it calls sortParams(x) → extract sortParams too
   • If it calls filterEmpty(x) → extract filterEmpty too
   • Keep going until you have the FULL self-contained logic

3. Map the exact parameter flow:

   API caller passes: { userId: "123", amount: "100", extra: null }
                                           ↓
   Filter step:       remove null/""       → { userId: "123", amount: "100" }
                                           ↓
   Sort step:         sort keys alpha      → { amount: "100", userId: "123" }
                                           ↓
   Add random:        add nonce field      → { amount: "100", nonce: "abc", userId: "123" }
                                           ↓
   Serialize:         JSON.stringify       → '{"amount":"100","nonce":"abc","userId":"123"}'
                                           ↓
   Hash:              md5(str).upper()     → "A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6"
                                           ↓
   Result:            return { nonce, signature, timestamp }
   

4. Identify every field excluded from signing — these are the "exclude" lists:

   const exclude = ['signature', 'track', '[appSpecificField]']  // ← extract verbatim from JS
   

   Document the full exclude list verbatim.

5. Find the separator/format — how is canonical string built?

   • JSON.stringify(obj, null, 0) — no spaces
   • JSON.stringify(obj, null, 2) — pretty printed (unusual)
   • key=value&key2=value2 — query string format
   • key:value,key2:value2 — custom format

6. Check timestamp precision:

   • Milliseconds: Date.now() → 13-digit
   • Seconds: Math.floor(Date.now()/1000) → 10-digit
   • Is timestamp included in signature? Or separate?

7. Verify output format — what exactly gets sent:

   full md5 hex (32 chars)
   upper md5 hex (32 chars)
   first 16 chars of sha256
   base64 of hmac-sha256
   etc.
   

Output Format

API SIGNING FINDINGS
====================

[SG1] MD5 Request Signing — HIGH
  File:      common.modules-6d4292d1.js
  Line:      2847
  Function:  generateSignParams(data)
  Called at: axios.interceptors.request.use (line 1100)
  
  Algorithm: MD5, uppercase, full 32 chars
  Nonce:     uuid().hex → added as data["random"]
  Timestamp: int(time.time()) → returned separately
  
  Steps:
    1. Add random nonce to data["random"]
    2. Exclude keys: ["signature", "track", "[appSpecificField]"]  ← copy verbatim from JS
    3. Exclude null/empty string values
    4. Sort remaining keys alphabetically
    5. JSON.stringify with no spaces, ensure_ascii=False
    6. MD5(canonical_string).hexdigest().upper()[:32]
    7. Return (nonce, signature, timestamp)
  
  HTTP injection:
    → request body: { ...params, random, signature, timestamp }
  
  Callers: [callerFunc]:1203, [callerFunc]:3401, [callerFunc]:5102
  
  Full function code:
    [include verbatim JS code here]