commit 254df3b7b9732045c686d8cc050130674391ef86 · dunkirk.sh/zera

+912

content/blog/2024-10-13_hilton_tomfoolery.md

···

       1
       +
       +++

     

       2
       +
       title = "Hilton Tomfoolery"

     

       3
       +
       date = 2024-10-13

     

       4
       +
       slug = "hilton-tomfoolery"

     

       5
       +
       description = "Playing around with mitmproxy and the hilton app as well as a flipper zero"

     

       6
       +
       

     

       7
       +
       [taxonomies]

     

       8
       +
       tags = ["meta"]

     

       9
       +
       

     

       10
       +
       [extra]

     

       11
       +
       has_toc = true

     

       12
       +
       +++

     

       13
       +
       

     

       14
       +
       I'm at a Hilton at the time of writing this and I'm decently bored. Currently I'm downloading the latest version of RogueMaster (0.420.0) to my flipper as its currently crashing every time I open the NFC app. My dad tried out the app unlock feature for the first time today and based on playing with it it seems to take a proximity reading to detect if you are by your door but for a period of time (~20 sec) after getting that signal it allows you to unlock the door from across the room which I'm guessing means that its via a central server. The current plan is to install the root cert on my iphone and then try and intercept those api calls and see if we can manipulate them in any interesting ways. I'm also planning on liveblogging this which i've never tried before.

     

       15
       +
       

     

       16
       +
       ## Connecting to Mitmproxy

     

       17
       +
       

     

       18
       +
       I'm connecting over wireguard so i'm firing up mitmproxy with `mitmweb --mode wireguard` on my laptop. Connecting via wireguard theoreticaly is pretty simple; all i need to do is to scan a qr code and connect. Unfortunetaly the hotel wifi seems to be oddly segemented and i can't access the wireguard server or ping my laptop from my phone. I'm going to try firing up a hot spot on my dad's phone and see if that allows me to talk to my phone.

     

       19
       +
       

     

       20
       +
       I messed with getting my laptop to connect to my dad's phone but it kept refusing for some reason. My next idea is to ngrok the wireguard tunnel which ended up failing because ngrok dosn't support udp. Finally after an embaressingly long time i realized that I could simply use ngrok tcp and the http proxy server instead. After installing the root certificate and trusting it in the iphone settings we were good to go!

     

       21
       +
       

     

       22
       +
       ## Digging around in the Hilton Honors app

     

       23
       +
       

     

       24
       +
       First I had to download the app which required disabling the proxy as iOS seems to ignore certificate trust settings for the app store. Enrollment happened via the `https://m.hilton.io/graphql/customer?operationName=createGuest&type=enroll` endpoint and was as follows:

     

       25
       +
       

     

       26
       +
       ```json

     

       27
       +
       {

     

       28
       +
         "query": "...",

     

       29
       +
         "variables": {

     

       30
       +
           "input": {

     

       31
       +
             "email": {

     

       32
       +
               "emailAddress": "xxxx-xxxx-xxxx@duck.com"

     

       33
       +
             },

     

       34
       +
             "preferredLanguage": "EN",

     

       35
       +
             "enrollSourceCode": "IOSEW",

     

       36
       +
             "phone": {

     

       37
       +
               "phoneNumber": "xxxxxxxxxx",

     

       38
       +
               "phoneType": "home"

     

       39
       +
             },

     

       40
       +
             "subscriptions": {

     

       41
       +
               "hhonorsSubscriptions": [],

     

       42
       +
               "optOuts": {

     

       43
       +
                 "survey": false,

     

       44
       +
                 "marketing": false

     

       45
       +
               }

     

       46
       +
             },

     

       47
       +
             "name": {

     

       48
       +
               "firstName": "Kieran",

     

       49
       +
               "lastName": "Klukas"

     

       50
       +
             },

     

       51
       +
             "address": {

     

       52
       +
               "city": "Washington",

     

       53
       +
               "addressType": "home",

     

       54
       +
               "addressLine2": null,

     

       55
       +
               "postalCode": "20003",

     

       56
       +
               "state": "DC",

     

       57
       +
               "addressLine1": "1600 Pennsylvania Ave SE Apartments",

     

       58
       +
               "country": "US"

     

       59
       +
             },

     

       60
       +
             "privacyRequested": false,

     

       61
       +
             "password": "xxxxxxxxxxxxxxxxxxxxxxxxxxx"

     

       62
       +
           },

     

       63
       +
           "language": "en_US"

     

       64
       +
         },

     

       65
       +
         "operationName": "createGuest"

     

       66
       +
       }

     

       67
       +
       ---

     

       68
       +
       mutation createGuest($input: EnrollInput!, $language: String!) {

     

       69
       +
           createGuest(language: $language, input: $input) {

     

       70
       +
               data {

     

       71
       +
                   guestId

     

       72
       +
                   hhonorsNumber

     

       73
       +
               }

     

       74
       +
               error {

     

       75
       +
                   code

     

       76
       +
                   context

     

       77
       +
                   message

     

       78
       +
                   notifications {

     

       79
       +
                       code

     

       80
       +
                       fields

     

       81
       +
                       message

     

       82
       +
                   }

     

       83
       +
               }

     

       84
       +
           }

     

       85
       +
       }

     

       86
       +
       ```

     

       87
       +
       

     

       88
       +
       getting the response:

     

       89
       +
       

     

       90
       +
       ```json

     

       91
       +
       {

     

       92
       +
           "data": {

     

       93
       +
               "createGuest": {

     

       94
       +
                   "data": {

     

       95
       +
                       "guestId": 172624xxxx,

     

       96
       +
                       "hhonorsNumber": "225782xxxx"

     

       97
       +
                   },

     

       98
       +
                   "error": null

     

       99
       +
               }

     

       100
       +
           },

     

       101
       +
           "extensions": {

     

       102
       +
               "logSearch": "mdc.client_message_id=51da35305bde9b71e7faa2993ebc2a619e50c598-iap71t195vk6jur6eyd83hy9g21w4bzam"

     

       103
       +
           }

     

       104
       +
       }

     

       105
       +
       ```

     

       106
       +
       

     

       107
       +
       with the headers:

     

       108
       +
       

     

       109
       +
       ```json

     

       110
       +
       {

     

       111
       +
           "access_token": "DX.eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00iLCJwaWQiOiJtb2JpbGUiLCJraWQiOiJWTktOaU9WLTZ4c2cyOXQ2dEJUMmR5Nnl1TEJPUG8tb2FycDFpZzZnVWdZIn0.Yfxkp8Jnrwttmrp_QcMTp6HwW2yBzEIROsAjheNVd3LgIWBQVfw5UDstAd7qA3MKZffoKSf7SbkopJhWIr-vreOYQ2BZEf2a9DYm4p-tD9jXEMsuVY9offYqjRzyeWwcjLyWq9ubnUBpQuCHMNUO1025BZkNV3NYG3_LZfJlNc77aMawrfS52zi5I5hSL0zAs3K7kxYuReJEC-RzASt-coPHEmdkmDp1TLqujqe8Opy6z4DC8xFDFkO09J-tN6RwolJ6jtssr0vnFyCv9zw_lbAQppB0jbWZqxiEmNk_krC4laOsChe3bUJc8ECeKltvqgVnSAKAhz-zBfy9EbFeew.Wki3N1rclvnjMfA4.dtWVnkpMJZixW86Q9hiiBY30_Oa1NHPLM_SuuAjtTrY-QZilp5tgu7COJtiVYI51_j6nIOHdX2oI0EoiHaPhzC4YizFxNbZsUfpR0W6wPVWj3LpdTr23GMhoOga5UTFCbaehb5XCsWr9PLfnLc2tSGyi4wZOSGrSidQUCDQ6UssUTxt6vvlp5y623EbvkMEi-ok6IXqUnYgsztcz_i14GKRHdRmJZFACJj3X0zQLarN4b19KEwvqIXfIrpPWpr1f74ozamM6CUEQhqoF61cucKCxKf0hU7kAyMduo4l3OfEkghQUfrlfA1D7eoInyPcOb8a3_LjQhGXwh1XVoElXUriuP7yEOfyksv59_pKCWajzJuyWdEl164OZXAFmMkdQ89flDO3_nRZUliMXapnWkU3WDBGD_gQ49sYbxlAh95l0HiJeKZwf2g4DTlEb6ccauRAbUzD2Fopoe2ldMXL-wBkVg2Grx8SfaCnOCiyfGq2HloJMf-8YRz-tWQoTXFEM30KdJCWY70sUTY9LeWVQrz4dnpZlRk29KyNi20YsdQRK3y9_ZFL0qs4IJwhddtrhzQVKz6oaxDPgQxy2vK1DErers-8-oJ3WgDho9l9D7Z7U9C1spjf1IIBG5hvdtCiExqh78fFsizcvkG9oeHB09Z1oGU3jL_cUFKrrUp9ZXnOKlwU1BjFPrOjVVZi97-rVN3IjvlRjJCBfFCf2CxlbZcib_CWSiD0vtFsloClkmSho2ynnbLQG341SibvaO4TKygttS-NsluDjBtpuJydlNjDAXO6ZvWRiFWcHDrDqiBeo897yUM40kHYFXBpjhbiIDcCnAJu6GDozbacnGsEGOJlauASm3t8TFn1lPd_kQgd3Uy2fDtTCKxxSaXA4RvHwUbBgYWU4SMA7UPYn_RygkxUZ0UL4ZHfN1-bDpkQ16DLm0Q.hh53MImM9BA7Ujib61RUOg",

     

       112
       +
           "exp": 1728879203,

     

       113
       +
           "expires_in": 3600,

     

       114
       +
           "iat": 1728875603,

     

       115
       +
           "scope": "am_application_scope default",

     

       116
       +
           "token_type": "Bearer"

     

       117
       +
       }

     

       118
       +
       ```

     

       119
       +
       

     

       120
       +
       At this point I went to bed as it was about 23:30 but I set my alarm for 5:30 (if you know me I never get up before 8:00 so this is rare) and actualy managed to wakeup on time. It's always quite curious how excitement and a new place can cause you to wake-up earlier. Unfortunetaly while I was sleeping my laptop died which caused me to loose the rest of the signup data. I'm going to invite myself to get the room key and see what api requests that triggers and then try actualy unlocking the door.

     

       121
       +
       

     

       122
       +
       # Invitation

     

       123
       +
       

     

       124
       +
       I shared the key which asked for a name and then opened the iOS share sheet and I choose to send by text. I went back to my phone clicked the link and low and behold we got a hit! `https://hms.hiltonapi.com/hms/v1/digitalkey/invitation/accept`

     

       125
       +
       

     

       126
       +
       ```json

     

       127
       +
       {

     

       128
       +
           "shareId": "b4d6140d311e4c4c935dd653ca00af65"

     

       129
       +
       }

     

       130
       +
       ```

     

       131
       +
       

     

       132
       +
       our response was as follows:

     

       133
       +
       

     

       134
       +
       ```json

     

       135
       +
       {

     

       136
       +
           "arrivalDateTime": "2024-10-13T15:00-04:00",

     

       137
       +
           "confirmationNumber": "5448xxxx",

     

       138
       +
           "ctyhocn": "GCYPAHX",

     

       139
       +
           "departureDateTime": "2024-10-14T11:00-04:00",

     

       140
       +
           "hotelName": "Hampton Inn & Suites Grove City",

     

       141
       +
           "stayId": "296088xxxx"

     

       142
       +
       }

     

       143
       +
       ```

     

       144
       +
       

     

       145
       +
       Another interesting request was to `https://m.hilton.io/graphql/customer?operationName=hotel_brand&type=hotelDetails_GCYPAHX` 

     

       146
       +
       

     

       147
       +
       ```json

     

       148
       +
       {

     

       149
       +
         "variables": {

     

       150
       +
           "ctyhocn": "GCYPAHX",

     

       151
       +
           "language": "en-US"

     

       152
       +
         },

     

       153
       +
         "operationName": "hotel_brand",

     

       154
       +
         "query": "..."

     

       155
       +
       }

     

       156
       +
       ---

     

       157
       +
       query hotel_brand($language: String!, $ctyhocn: String!) {

     

       158
       +
         hotel(language: $language, ctyhocn: $ctyhocn) {

     

       159
       +
           address {

     

       160
       +
             addressFmt

     

       161
       +
             addressLine1

     

       162
       +
             addressLine2

     

       163
       +
             city

     

       164
       +
             country

     

       165
       +
             countryName

     

       166
       +
             postalCode

     

       167
       +
             state

     

       168
       +
           }

     

       169
       +
           alerts {

     

       170
       +
             description

     

       171
       +
             type

     

       172
       +
           }

     

       173
       +
           amenities {

     

       174
       +
             id

     

       175
       +
             name

     

       176
       +
           }

     

       177
       +
           attributes {

     

       178
       +
             numberOfRestaurants

     

       179
       +
           }

     

       180
       +
           brand {

     

       181
       +
             isPartnerBrand

     

       182
       +
           }

     

       183
       +
           brandCode

     

       184
       +
           campus {

     

       185
       +
             type

     

       186
       +
           }

     

       187
       +
           chainCode

     

       188
       +
           checkin {

     

       189
       +
             checkinTimeFmt

     

       190
       +
             checkinTime

     

       191
       +
             checkoutTimeFmt

     

       192
       +
             checkoutTime

     

       193
       +
             digitalKey

     

       194
       +
           }

     

       195
       +
           config {

     

       196
       +
             checkout {

     

       197
       +
               allowDCO

     

       198
       +
             }

     

       199
       +
             connectedRoom {

     

       200
       +
               crEnabled

     

       201
       +
               crFullyEnabled

     

       202
       +
               emsEnabled

     

       203
       +
             }

     

       204
       +
             messaging {

     

       205
       +
               kipsuEnabled

     

       206
       +
               messagingTileEnabled

     

       207
       +
               gatewayRoutingEnabled

     

       208
       +
             }

     

       209
       +
             adjoiningRooms {

     

       210
       +
               active

     

       211
       +
             }

     

       212
       +
           }

     

       213
       +
           coordinate {

     

       214
       +
             latitude

     

       215
       +
             longitude

     

       216
       +
           }

     

       217
       +
           crsData {

     

       218
       +
             adultAge

     

       219
       +
             ageBasedPricing

     

       220
       +
             acceptedCreditCards

     

       221
       +
           }

     

       222
       +
           ctyhocn

     

       223
       +
           currencyCode

     

       224
       +
           display {

     

       225
       +
             treatments

     

       226
       +
           }

     

       227
       +
           gmtHours

     

       228
       +
           internetAddress

     

       229
       +
           name

     

       230
       +
           phoneNumber

     

       231
       +
           policyOptions {

     

       232
       +
             label

     

       233
       +
             value

     

       234
       +
             options {

     

       235
       +
               label

     

       236
       +
               value

     

       237
       +
             }

     

       238
       +
           }

     

       239
       +
           facilityOverview {

     

       240
       +
             shortDesc

     

       241
       +
           }

     

       242
       +
           images {

     

       243
       +
             master {

     

       244
       +
               altText

     

       245
       +
               url(height: 430, width: 612)

     

       246
       +
             }

     

       247
       +
             gallery {

     

       248
       +
               image(variant: searchPropertyImageThumbnail) {

     

       249
       +
                 altText

     

       250
       +
                 url(height: 430, width: 612)

     

       251
       +
               }

     

       252
       +
               masterImage

     

       253
       +
             }

     

       254
       +
             carousel {

     

       255
       +
               altText

     

       256
       +
               url(height: 430, width: 612)

     

       257
       +
             }

     

       258
       +
           }

     

       259
       +
         }

     

       260
       +
       }

     

       261
       +
       ```

     

       262
       +
       

     

       263
       +
       with a response of:

     

       264
       +
       

     

       265
       +
       ```json

     

       266
       +
       {

     

       267
       +
           "data": {

     

       268
       +
               "hotel": {

     

       269
       +
                   "address": {

     

       270
       +
                       "addressFmt": "4 Holiday Blvd., Mercer, Pennsylvania, 16137, USA",

     

       271
       +
                       "addressLine1": "4 Holiday Blvd.",

     

       272
       +
                       "addressLine2": null,

     

       273
       +
                       "city": "Mercer",

     

       274
       +
                       "country": "US",

     

       275
       +
                       "countryName": "USA",

     

       276
       +
                       "postalCode": "16137",

     

       277
       +
                       "state": "PA"

     

       278
       +
                   },

     

       279
       +
                   "alerts": [

     

       280
       +
                       {

     

       281
       +
                           "description": "The hotel will be undergoing exterior renovations September 03, 2024 - December 31, 2024. The interior and guestrooms will be unaffected. Thank you for your patience and understanding.",

     

       282
       +
                           "type": "alert"

     

       283
       +
                       }

     

       284
       +
                   ],

     

       285
       +
                   "amenities": [

     

       286
       +
                       {

     

       287
       +
                           "id": "adjoiningRooms",

     

       288
       +
                           "name": "Connecting Rooms"

     

       289
       +
                       },

     

       290
       +
                       {

     

       291
       +
                           "id": "freeBreakfast",

     

       292
       +
                           "name": "Free hot breakfast"

     

       293
       +
                       },

     

       294
       +
                       {

     

       295
       +
                           "id": "freeParking",

     

       296
       +
                           "name": "Free parking"

     

       297
       +
                       },

     

       298
       +
                       {

     

       299
       +
                           "id": "freeWifi",

     

       300
       +
                           "name": "Free WiFi"

     

       301
       +
                       },

     

       302
       +
                       {

     

       303
       +
                           "id": "nonSmoking",

     

       304
       +
                           "name": "Non-smoking rooms"

     

       305
       +
                       },

     

       306
       +
                       {

     

       307
       +
                           "id": "digitalKey",

     

       308
       +
                           "name": "Digital Key"

     

       309
       +
                       },

     

       310
       +
                       {

     

       311
       +
                           "id": "evCharging",

     

       312
       +
                           "name": "EV charging"

     

       313
       +
                       },

     

       314
       +
                       {

     

       315
       +
                           "id": "indoorPool",

     

       316
       +
                           "name": "Indoor pool"

     

       317
       +
                       },

     

       318
       +
                       {

     

       319
       +
                           "id": "fitnessCenter",

     

       320
       +
                           "name": "Fitness center"

     

       321
       +
                       },

     

       322
       +
                       {

     

       323
       +
                           "id": "petsAllowed",

     

       324
       +
                           "name": "Pet-friendly rooms"

     

       325
       +
                       },

     

       326
       +
                       {

     

       327
       +
                           "id": "meetingRooms",

     

       328
       +
                           "name": "Meeting rooms"

     

       329
       +
                       }

     

       330
       +
                   ],

     

       331
       +
                   "attributes": {

     

       332
       +
                       "numberOfRestaurants": 0

     

       333
       +
                   },

     

       334
       +
                   "brand": {

     

       335
       +
                       "isPartnerBrand": false

     

       336
       +
                   },

     

       337
       +
                   "brandCode": "HP",

     

       338
       +
                   "campus": {

     

       339
       +
                       "type": "enhanced"

     

       340
       +
                   },

     

       341
       +
                   "chainCode": "HH",

     

       342
       +
                   "checkin": {

     

       343
       +
                       "checkinTime": "15:00",

     

       344
       +
                       "checkinTimeFmt": "3:00 PM",

     

       345
       +
                       "checkoutTime": "11:00",

     

       346
       +
                       "checkoutTimeFmt": "11:00 AM",

     

       347
       +
                       "digitalKey": true

     

       348
       +
                   },

     

       349
       +
                   "config": {

     

       350
       +
                       "adjoiningRooms": {

     

       351
       +
                           "active": true

     

       352
       +
                       },

     

       353
       +
                       "checkout": {

     

       354
       +
                           "allowDCO": true

     

       355
       +
                       },

     

       356
       +
                       "connectedRoom": null,

     

       357
       +
                       "messaging": {

     

       358
       +
                           "gatewayRoutingEnabled": true,

     

       359
       +
                           "kipsuEnabled": true,

     

       360
       +
                           "messagingTileEnabled": true

     

       361
       +
                       }

     

       362
       +
                   },

     

       363
       +
                   "coordinate": {

     

       364
       +
                       "latitude": 41.142354,

     

       365
       +
                       "longitude": -80.164956

     

       366
       +
                   },

     

       367
       +
                   "crsData": {

     

       368
       +
                       "acceptedCreditCards": [

     

       369
       +
                           "CU",

     

       370
       +
                           "VI",

     

       371
       +
                           "MC",

     

       372
       +
                           "AX",

     

       373
       +
                           "DS",

     

       374
       +
                           "DC",

     

       375
       +
                           "CB"

     

       376
       +
                       ],

     

       377
       +
                       "adultAge": null,

     

       378
       +
                       "ageBasedPricing": null

     

       379
       +
                   },

     

       380
       +
                   "ctyhocn": "GCYPAHX",

     

       381
       +
                   "currencyCode": "USD",

     

       382
       +
                   "display": {

     

       383
       +
                       "treatments": []

     

       384
       +
                   },

     

       385
       +
                   "facilityOverview": {

     

       386
       +
                       "shortDesc": "We're off I-79, 10 minutes from Grove City. Grove City Premium Outlets and Wendell August Forge, America's oldest and largest working forge, are less than a mile away. Both Grove City College and Slippery Rock University are within 20 minutes of us. Enjoy free hot breakfast, free WiFi, and our indoor pool and hot tub."

     

       387
       +
                   },

     

       388
       +
                   "gmtHours": -4,

     

       389
       +
                   "images": {

     

       390
       +
                       "carousel": [

     

       391
       +
                           {

     

       392
       +
                               "altText": "Outdoor Patio",

     

       393
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/2888809/gcypahx-patio.jpg?impolicy=resize&rh=430&rw=612"

     

       394
       +
                           },

     

       395
       +
                           {

     

       396
       +
                               "altText": "Double Queen",

     

       397
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/4248848/hampton-grove-city-standard-queen-1-preview.jpg?impolicy=resize&rh=430&rw=612"

     

       398
       +
                           },

     

       399
       +
                           {

     

       400
       +
                               "altText": "King Standard",

     

       401
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/4248016/hampton-grove-city-king-standard-1.jpg?impolicy=resize&rh=430&rw=612"

     

       402
       +
                           },

     

       403
       +
                           {

     

       404
       +
                               "altText": "Lobby and Dining Area",

     

       405
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/2887422/lobby-1.jpg?impolicy=resize&rh=430&rw=612"

     

       406
       +
                           },

     

       407
       +
                           {

     

       408
       +
                               "altText": "Lobby",

     

       409
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/2887224/lobby-2.jpg?impolicy=resize&rh=430&rw=612"

     

       410
       +
                           },

     

       411
       +
                           {

     

       412
       +
                               "altText": "Breakfast Buffet",

     

       413
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/2880542/breakfast-1.jpg?impolicy=resize&rh=430&rw=612"

     

       414
       +
                           },

     

       415
       +
                           {

     

       416
       +
                               "altText": "Indoor Pool",

     

       417
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/4258295/hampton-new-pics-2008-035.jpg?impolicy=resize&rh=430&rw=612"

     

       418
       +
                           },

     

       419
       +
                           {

     

       420
       +
                               "altText": "Fitness Center",

     

       421
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/2883297/fitness.jpg?impolicy=resize&rh=430&rw=612"

     

       422
       +
                           },

     

       423
       +
                           {

     

       424
       +
                               "altText": "Boardroom",

     

       425
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/2879933/board-room.jpg?impolicy=resize&rh=430&rw=612"

     

       426
       +
                           },

     

       427
       +
                           {

     

       428
       +
                               "altText": "Meeting Room",

     

       429
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/2888194/meeting.jpg?impolicy=resize&rh=430&rw=612"

     

       430
       +
                           },

     

       431
       +
                           {

     

       432
       +
                               "altText": "Hotel Exterior at Night",

     

       433
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/4251655/exterior-night.jpg?impolicy=resize&rh=430&rw=612"

     

       434
       +
                           },

     

       435
       +
                           {

     

       436
       +
                               "altText": "Business Center",

     

       437
       +
                               "url": "https://www.hilton.com/im/en/GCYPAHX/2881016/business-center.jpg?impolicy=resize&rh=430&rw=612"

     

       438
       +
                           }

     

       439
       +
                       ],

     

       440
       +
                       "gallery": [

     

       441
       +
                           {

     

       442
       +
                               "image": {

     

       443
       +
                                   "altText": "Outdoor Patio",

     

       444
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2888809/gcypahx-patio.jpg?impolicy=resize&rh=430&rw=612"

     

       445
       +
                               },

     

       446
       +
                               "masterImage": true

     

       447
       +
                           },

     

       448
       +
                           {

     

       449
       +
                               "image": {

     

       450
       +
                                   "altText": "Double Queen",

     

       451
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/4248848/hampton-grove-city-standard-queen-1-preview.jpg?impolicy=resize&rh=430&rw=612"

     

       452
       +
                               },

     

       453
       +
                               "masterImage": false

     

       454
       +
                           },

     

       455
       +
                           {

     

       456
       +
                               "image": {

     

       457
       +
                                   "altText": "King Standard",

     

       458
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/4248016/hampton-grove-city-king-standard-1.jpg?impolicy=resize&rh=430&rw=612"

     

       459
       +
                               },

     

       460
       +
                               "masterImage": false

     

       461
       +
                           },

     

       462
       +
                           {

     

       463
       +
                               "image": {

     

       464
       +
                                   "altText": "Lobby and Dining Area",

     

       465
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2887422/lobby-1.jpg?impolicy=resize&rh=430&rw=612"

     

       466
       +
                               },

     

       467
       +
                               "masterImage": false

     

       468
       +
                           },

     

       469
       +
                           {

     

       470
       +
                               "image": {

     

       471
       +
                                   "altText": "Lobby",

     

       472
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2887224/lobby-2.jpg?impolicy=resize&rh=430&rw=612"

     

       473
       +
                               },

     

       474
       +
                               "masterImage": false

     

       475
       +
                           },

     

       476
       +
                           {

     

       477
       +
                               "image": {

     

       478
       +
                                   "altText": "Breakfast Buffet",

     

       479
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2880542/breakfast-1.jpg?impolicy=resize&rh=430&rw=612"

     

       480
       +
                               },

     

       481
       +
                               "masterImage": false

     

       482
       +
                           },

     

       483
       +
                           {

     

       484
       +
                               "image": {

     

       485
       +
                                   "altText": "Indoor Pool",

     

       486
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/4258295/hampton-new-pics-2008-035.jpg?impolicy=resize&rh=430&rw=612"

     

       487
       +
                               },

     

       488
       +
                               "masterImage": false

     

       489
       +
                           },

     

       490
       +
                           {

     

       491
       +
                               "image": {

     

       492
       +
                                   "altText": "Fitness Center",

     

       493
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2883297/fitness.jpg?impolicy=resize&rh=430&rw=612"

     

       494
       +
                               },

     

       495
       +
                               "masterImage": false

     

       496
       +
                           },

     

       497
       +
                           {

     

       498
       +
                               "image": {

     

       499
       +
                                   "altText": "Boardroom",

     

       500
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2879933/board-room.jpg?impolicy=resize&rh=430&rw=612"

     

       501
       +
                               },

     

       502
       +
                               "masterImage": false

     

       503
       +
                           },

     

       504
       +
                           {

     

       505
       +
                               "image": {

     

       506
       +
                                   "altText": "Meeting Room",

     

       507
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2888194/meeting.jpg?impolicy=resize&rh=430&rw=612"

     

       508
       +
                               },

     

       509
       +
                               "masterImage": false

     

       510
       +
                           },

     

       511
       +
                           {

     

       512
       +
                               "image": {

     

       513
       +
                                   "altText": "Hotel Exterior at Night",

     

       514
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/4251655/exterior-night.jpg?impolicy=resize&rh=430&rw=612"

     

       515
       +
                               },

     

       516
       +
                               "masterImage": false

     

       517
       +
                           },

     

       518
       +
                           {

     

       519
       +
                               "image": {

     

       520
       +
                                   "altText": "Business Center",

     

       521
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2881016/business-center.jpg?impolicy=resize&rh=430&rw=612"

     

       522
       +
                               },

     

       523
       +
                               "masterImage": false

     

       524
       +
                           },

     

       525
       +
                           {

     

       526
       +
                               "image": {

     

       527
       +
                                   "altText": "Indoor Pool / Whirlpool",

     

       528
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2885342/pool.jpg?impolicy=resize&rh=430&rw=612"

     

       529
       +
                               },

     

       530
       +
                               "masterImage": false

     

       531
       +
                           },

     

       532
       +
                           {

     

       533
       +
                               "image": {

     

       534
       +
                                   "altText": "Double Queen Studio",

     

       535
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/4250170/hampton-new-pics-2008-020.jpg?impolicy=resize&rh=430&rw=612"

     

       536
       +
                               },

     

       537
       +
                               "masterImage": false

     

       538
       +
                           },

     

       539
       +
                           {

     

       540
       +
                               "image": {

     

       541
       +
                                   "altText": "Whirlpool Suite",

     

       542
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/4251204/whirlpool-king-suite-one-2-2-.jpg?impolicy=resize&rh=430&rw=612"

     

       543
       +
                               },

     

       544
       +
                               "masterImage": false

     

       545
       +
                           },

     

       546
       +
                           {

     

       547
       +
                               "image": {

     

       548
       +
                                   "altText": "Breakfast Area",

     

       549
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2880342/breakfast-2.tif?impolicy=resize&rh=430&rw=612"

     

       550
       +
                               },

     

       551
       +
                               "masterImage": false

     

       552
       +
                           },

     

       553
       +
                           {

     

       554
       +
                               "image": {

     

       555
       +
                                   "altText": "Suite Shop",

     

       556
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/2890823/gift-shop.jpg?impolicy=resize&rh=430&rw=612"

     

       557
       +
                               },

     

       558
       +
                               "masterImage": false

     

       559
       +
                           },

     

       560
       +
                           {

     

       561
       +
                               "image": {

     

       562
       +
                                   "altText": "Hotel Exterior",

     

       563
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/390670/gcypahx-hampton-exterior-night-1.jpg?impolicy=resize&rh=430&rw=612"

     

       564
       +
                               },

     

       565
       +
                               "masterImage": false

     

       566
       +
                           },

     

       567
       +
                           {

     

       568
       +
                               "image": {

     

       569
       +
                                   "altText": "Hotel Exterior",

     

       570
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/4255766/hampton-new-pics-2008-012.jpg?impolicy=resize&rh=430&rw=612"

     

       571
       +
                               },

     

       572
       +
                               "masterImage": false

     

       573
       +
                           },

     

       574
       +
                           {

     

       575
       +
                               "image": {

     

       576
       +
                                   "altText": "Double Queen Suite",

     

       577
       +
                                   "url": "https://www.hilton.com/im/en/GCYPAHX/4251117/double-queen-standard-2-.jpg?impolicy=resize&rh=430&rw=612"

     

       578
       +
                               },

     

       579
       +
                               "masterImage": false

     

       580
       +
                           }

     

       581
       +
                       ],

     

       582
       +
                       "master": {

     

       583
       +
                           "altText": "Outdoor Patio",

     

       584
       +
                           "url": "https://www.hilton.com/im/en/GCYPAHX/2888809/gcypahx-patio.jpg?impolicy=resize&rh=430&rw=612"

     

       585
       +
                       }

     

       586
       +
                   },

     

       587
       +
                   "internetAddress": "https://www.hilton.com/en/hotels/gcypahx-hampton-suites-grove-city/",

     

       588
       +
                   "name": "Hampton Inn & Suites Grove City",

     

       589
       +
                   "phoneNumber": "+1 724-748-5744",

     

       590
       +
                   "policyOptions": [

     

       591
       +
                       {

     

       592
       +
                           "label": "Cancellation",

     

       593
       +
                           "options": [

     

       594
       +
                               {

     

       595
       +
                                   "label": "Description",

     

       596
       +
                                   "value": "Cancellation policies may vary depending on the rate or dates of your reservation. Please refer to your reservation confirmation to verify your cancellation policy. If you need further assistance, call the hotel directly or contact <a href=https://help.hilton.com/s/>customer service</a>. Alternatively, you can <a href=https://www.hilton.com/en/book/reservation/find/>cancel your reservation online</a>."

     

       597
       +
                               }

     

       598
       +
                           ],

     

       599
       +
                           "value": null

     

       600
       +
                       },

     

       601
       +
                       {

     

       602
       +
                           "label": "Check-in/Check-out",

     

       603
       +
                           "options": [

     

       604
       +
                               {

     

       605
       +
                                   "label": "Checkin Time",

     

       606
       +
                                   "value": "3:00 PM"

     

       607
       +
                               },

     

       608
       +
                               {

     

       609
       +
                                   "label": "Checkout Time",

     

       610
       +
                                   "value": "11:00 AM"

     

       611
       +
                               },

     

       612
       +
                               {

     

       613
       +
                                   "label": "Early Departure Fee",

     

       614
       +
                                   "value": null

     

       615
       +
                               },

     

       616
       +
                               {

     

       617
       +
                                   "label": "Late Checkout Fee",

     

       618
       +
                                   "value": null

     

       619
       +
                               },

     

       620
       +
                               {

     

       621
       +
                                   "label": "Minimum Age To Register",

     

       622
       +
                                   "value": "21"

     

       623
       +
                               }

     

       624
       +
                           ],

     

       625
       +
                           "value": null

     

       626
       +
                       },

     

       627
       +
                       {

     

       628
       +
                           "label": "Wi-Fi",

     

       629
       +
                           "options": [

     

       630
       +
                               {

     

       631
       +
                                   "label": "Description",

     

       632
       +
                                   "value": "Standard In-Room and Lobby Wi-Fi - All guests get free standard Wi-Fi in-room and in the lobby."

     

       633
       +
                               }

     

       634
       +
                           ],

     

       635
       +
                           "value": null

     

       636
       +
                       },

     

       637
       +
                       {

     

       638
       +
                           "label": "Parking",

     

       639
       +
                           "options": [

     

       640
       +
                               {

     

       641
       +
                                   "label": "Covered",

     

       642
       +
                                   "value": "Not Available"

     

       643
       +
                               },

     

       644
       +
                               {

     

       645
       +
                                   "label": "In Out Privileges",

     

       646
       +
                                   "value": "Not Available"

     

       647
       +
                               },

     

       648
       +
                               {

     

       649
       +
                                   "label": "Other Parking Information",

     

       650
       +
                                   "value": "Parking Lot"

     

       651
       +
                               },

     

       652
       +
                               {

     

       653
       +
                                   "label": "Secured",

     

       654
       +
                                   "value": "Not Available"

     

       655
       +
                               },

     

       656
       +
                               {

     

       657
       +
                                   "label": "Self Parking",

     

       658
       +
                                   "value": "$0.00 Complimentary"

     

       659
       +
                               },

     

       660
       +
                               {

     

       661
       +
                                   "label": "Valet Parking",

     

       662
       +
                                   "value": "Not Available"

     

       663
       +
                               }

     

       664
       +
                           ],

     

       665
       +
                           "value": null

     

       666
       +
                       },

     

       667
       +
                       {

     

       668
       +
                           "label": "Payment",

     

       669
       +
                           "options": [

     

       670
       +
                               {

     

       671
       +
                                   "label": "Hotel Currency",

     

       672
       +
                                   "value": "US Dollar"

     

       673
       +
                               },

     

       674
       +
                               {

     

       675
       +
                                   "label": "Accepted Payment Options",

     

       676
       +
                                   "value": "American Express, Carte Blanche, China Union Pay, Diner's Club, Discover, MasterCard, Visa"

     

       677
       +
                               }

     

       678
       +
                           ],

     

       679
       +
                           "value": null

     

       680
       +
                       },

     

       681
       +
                       {

     

       682
       +
                           "label": "Pets",

     

       683
       +
                           "options": [

     

       684
       +
                               {

     

       685
       +
                                   "label": "Deposit",

     

       686
       +
                                   "value": "$50.00 Non-Refundable"

     

       687
       +
                               },

     

       688
       +
                               {

     

       689
       +
                                   "label": "Kennel Message",

     

       690
       +
                                   "value": null

     

       691
       +
                               },

     

       692
       +
                               {

     

       693
       +
                                   "label": "Maximum Size",

     

       694
       +
                                   "value": null

     

       695
       +
                               },

     

       696
       +
                               {

     

       697
       +
                                   "label": "Maximum Weight",

     

       698
       +
                                   "value": null

     

       699
       +
                               },

     

       700
       +
                               {

     

       701
       +
                                   "label": "Other Pet Services",

     

       702
       +
                                   "value": "$50(1-4n),$75(5+n) 2petsMax,dog/cat only"

     

       703
       +
                               },

     

       704
       +
                               {

     

       705
       +
                                   "label": "Pets Allowed",

     

       706
       +
                                   "value": "Yes"

     

       707
       +
                               },

     

       708
       +
                               {

     

       709
       +
                                   "label": "Service Animals Allowed",

     

       710
       +
                                   "value": "Yes"

     

       711
       +
                               }

     

       712
       +
                           ],

     

       713
       +
                           "value": null

     

       714
       +
                       },

     

       715
       +
                       {

     

       716
       +
                           "label": "Smoking",

     

       717
       +
                           "options": [

     

       718
       +
                               {

     

       719
       +
                                   "label": "Indicator",

     

       720
       +
                                   "value": "Non-Smoking"

     

       721
       +
                               },

     

       722
       +
                               {

     

       723
       +
                                   "label": "Description",

     

       724
       +
                                   "value": null

     

       725
       +
                               }

     

       726
       +
                           ],

     

       727
       +
                           "value": null

     

       728
       +
                       }

     

       729
       +
                   ]

     

       730
       +
               }

     

       731
       +
           },

     

       732
       +
           "extensions": {

     

       733
       +
               "logSearch": "mdc.client_message_id=51da35305bde9b71e7faa2993ebc2a619e50c598-uauhdwbaydoqbvy3uvuzai20c4takt22"

     

       734
       +
           }

     

       735
       +
       }

     

       736
       +
       ```

     

       737
       +
       

     

       738
       +
       It appears that hilton relies very heavily on graphql which is interesting. I would be interested in playing with those apis more. For now though, onto unlocking stuff!

     

       739
       +
       

     

       740
       +
       ## Locks

     

       741
       +
       

     

       742
       +
       When using the unlock button it made a request to this url: `https://smetric.hilton.com/b/ss/hiltonglobalprod/10/IOSN030200030900/s65425920` with a payload of a url encoded form.

     

       743
       +
       

     

       744
       +
       ```text

     

       745
       +
       ndh:              1

     

       746
       +
       cid.:             

     

       747
       +
       card_no.:         

     

       748
       +
       as:               0

     

       749
       +
       id:               2257829743

     

       750
       +
       .card_no:         

     

       751
       +
       hhid.:            

     

       752
       +
       as:               1

     

       753
       +
       id:               2257829743

     

       754
       +
       .hhid:            

     

       755
       +
       .cid:             

     

       756
       +
       aamb:             j8Odv6LonN4r3an7LhD3WZrU1bUpAkFkkiY1ncBR96t2PTI

     

       757
       +
       aamlh:            7

     

       758
       +
       c.:               

     

       759
       +
       a.:               

     

       760
       +
       AppID:            HHonors 2024.10.1 (1)

     

       761
       +
       CarrierName:      --

     

       762
       +
       DeviceName:       iPhone14,4

     

       763
       +
       OSVersion:        iOS 18.1

     

       764
       +
       Resolution:       1125x2436

     

       765
       +
       RunMode:          Application

     

       766
       +
       TimeSinceLaunch:  24560

     

       767
       +
       action:           digital key:key:unlock_btn

     

       768
       +
       .a:               

     

       769
       +
       hm.:              

     

       770
       +
       app.:             

     

       771
       +
       name:             HHonors iOS Mobile

     

       772
       +
       .app:             

     

       773
       +
       digitalkeyflag:   Yes

     

       774
       +
       event.:           

     

       775
       +
       element.:         

     

       776
       +
       click:            digital key:key:unlock_btn

     

       777
       +
       .element:         

     

       778
       +
       key.:             

     

       779
       +
       unlock.:          

     

       780
       +
       initiate:         1

     

       781
       +
       .unlock:          

     

       782
       +
       .key:             

     

       783
       +
       .event:           

     

       784
       +
       flag.:            

     

       785
       +
       appsettings:      N|N|NA|N|Y|Y|Y|Y|Y|NA|UsingApp|N|

     

       786
       +
       orientation:      L

     

       787
       +
       stay.:            

     

       788
       +
       level.:           

     

       789
       +
       status:           In-Stay

     

       790
       +
       .level:           

     

       791
       +
       .stay:            

     

       792
       +
       timeCaptureAEP:   2024-10-14T09:59:44.676Z

     

       793
       +
       timeCaptureEpoch: 1728899984

     

       794
       +
       timeCaptureISO:   2024-10-14T05:59:44-0400

     

       795
       +
       .flag:            

     

       796
       +
       hotel.:           

     

       797
       +
       brand:            HP

     

       798
       +
       propertycode:     GCYPAHX

     

       799
       +
       .hotel:           

     

       800
       +
       key.:             

     

       801
       +
       gnr:              79125065

     

       802
       +
       locktype:         guest

     

       803
       +
       lsn:              92044507

     

       804
       +
       shared.:          

     

       805
       +
       flag:             Yes

     

       806
       +
       .shared:          

     

       807
       +
       .key:             

     

       808
       +
       page.:            

     

       809
       +
       name:             

     

       810
       +
       previous:         App:EN:Honors:Digital Key:Key

     

       811
       +
       .page:            

     

       812
       +
       purchase.:        

     

       813
       +
       booking.:         

     

       814
       +
       dates:            10132024:10142024:1

     

       815
       +
       .booking:         

     

       816
       +
       bookingid:        54486330

     

       817
       +
       .purchase:        

     

       818
       +
       site.:            

     

       819
       +
       type:             PA

     

       820
       +
       .site:            

     

       821
       +
       user.:            

     

       822
       +
       aam.:             

     

       823
       +
       segments:         15218869,26458327,19493122,21537957,22516131,17952857,23583601,17952894,19484989,21539153,22889861,21539313,26458383,21881915,15217574

     

       824
       +
       .aam:             

     

       825
       +
       language:         en

     

       826
       +
       login.:           

     

       827
       +
       status:           Logged-in

     

       828
       +
       .login:           

     

       829
       +
       memberId:         2257829743

     

       830
       +
       stayid:           2960880196

     

       831
       +
       tierpoints:       Member

     

       832
       +
       .user:            

     

       833
       +
       .hm:              

     

       834
       +
       .c:               

     

       835
       +
       ce:               UTF-8

     

       836
       +
       cp:               foreground

     

       837
       +
       d.ptfm:           ios

     

       838
       +
       mid:              61621496110939688115558742623055817571

     

       839
       +
       pageName:         HHonors 2024.10.1 (1)

     

       840
       +
       pe:               lnk_o

     

       841
       +
       pev2:             AMACTION:digital key:key:unlock_btn

     

       842
       +
       products:         ;GCYPAHX;;;;

     

       843
       +
       t:                00/00/0000 00:00:00 0 240

     

       844
       +
       ts:               1728899984

     

       845
       +
       ```

     

       846
       +
       

     

       847
       +
       > response 

     

       848
       +
       ```text 

     

       849
       +
        {

     

       850
       +
         "stuff":[ {

     

       851
       +
           "cn":"TMS","cv":"web=17836315,Web-app=15217574,Web-app=17952857,Web-app=17952894,web-app=19493122,web-app=19484989,web-app=21539153,web-app=21539313,web-app=21881915,web-app=22516131,web-app=22889861,web-app=23583601,web-app=15218869,web-app=26458327,web-app=26458383,web-app=21537957","ttl":30,"dmn":""

     

       852
       +
         }

     

       853
       +
         , {

     

       854
       +
           "cn":"fltk","cv":"segID=15218869","ttl":30,"dmn":""

     

       855
       +
         }

     

       856
       +
         ],"uuid":"61645808922583835885560882535048239660","dcs_region":7,"tid":"RufgJCfxTjg="

     

       857
       +
       }

     

       858
       +
       ```

     

       859
       +
       

     

       860
       +
       About a second afterward I get a second request to `https://smetric.hilton.com/b/ss/hiltonglobalprod/10/IOSN030200030900/s88785229` with similar form data. Diff shown below.

     

       861
       +
       

     

       862
       +
       ```text

     

       863
       +
       23c23

     

       864
       +
       < action:           digital key:key:unlock_btn

     

       865
       +
       ---

     

       866
       +
       > action:           digital key:key:unlock:unlock_success

     

       867
       +
       31,33d30

     

       868
       +
       < element.:

     

       869
       +
       < click:            digital key:key:unlock_btn

     

       870
       +
       < .element:

     

       871
       +
       36c33

     

       872
       +
       < initiate:         1

     

       873
       +
       ---

     

       874
       +
       > success:          1

     

       875
       +
       48,50c45,47

     

       876
       +
       < timeCaptureAEP:   2024-10-14T09:59:44.676Z

     

       877
       +
       < timeCaptureEpoch: 1728899984

     

       878
       +
       < timeCaptureISO:   2024-10-14T05:59:44-0400

     

       879
       +
       ---

     

       880
       +
       > timeCaptureAEP:   2024-10-14T09:59:45.537Z

     

       881
       +
       > timeCaptureEpoch: 1728899985

     

       882
       +
       > timeCaptureISO:   2024-10-14T05:59:45-0400

     

       883
       +
       79c76

     

       884
       +
       < segments:         15218869,26458327,19493122,21537957,22516131,17952857,23583601,17952894,19484989,21539153,22889861,21539313,26458383,21881915,15217574

     

       885
       +
       ---

     

       886
       +
       > segments:         21537957,22889861,23583601,15218869,17952857,21881915,21539313,22516131,19484989,26458383,19493122,17952894,15217574,21539153,26458327

     

       887
       +
       97c94

     

       888
       +
       < pev2:             AMACTION:digital key:key:unlock_btn

     

       889
       +
       ---

     

       890
       +
       > pev2:             AMACTION:digital key:key:unlock:unlock_success

     

       891
       +
       100c97,99

     

       892
       +
       < ts:               1728899984

     

       893
       +
       ---

     

       894
       +
       > ts:               1728899985

     

       895
       +
       >

     

       896
       +
       > *:8080mitmproxy 10.4.2 

     

       897
       +
       ```

     

       898
       +
       

     

       899
       +
       > response diff

     

       900
       +
       ```text 

     

       901
       +
       <   ],"uuid":"61645808922583835885560882535048239660","dcs_region":7,"tid":"RufgJCfxTjg="

     

       902
       +
       ---

     

       903
       +
       >   ],"uuid":"61645808922583835885560882535048239660","dcs_region":7,"tid":"69dMPcWjQD4="

     

       904
       +
       ```

     

       905
       +
       

     

       906
       +
       replaying either of the requests does nothing except give a new tid value but doesn't unlock the door. The `sxxxxxxx` part of the reuqest url also changes on every new request and doesn't seem to match any discernable pattern. The `IOSN030200030900` part never changes however. My guess is that that part is a hotel reference id. From doing some ducking around online I couldn't find any references to the `smetric.hilton.com` domain but it was blocked by uBlock origin as part of the [EasyPrivacy](https://easylist.to/#easyprivacy) block list. The app also seems to issue requests to this url.

     

       907
       +
       

     

       908
       +
       ## Wrap up

     

       909
       +
       

     

       910
       +
       I tried running a bluetooth scan to see if I could find the locks but nothing popped out as being a likely culprit. I did however find an interesting set of 3 bluetooth devices named "clearsky smart fleet" which upon research seems to be scissor lifts / construction equipment made by a company called [JLG](https://smartfleet.jlg.com/) which is quite interesting. That would make sense however as I saw several scissor lifts outside the hotel on my way in. By the time I'm writing this its 6:41 and I need to eat breakfast so I'll probably finish this post in the car this afternoon. Overall this was a really interesting experiment and while I sadly did fail at unlocking doors from my laptop I do feel more confident with reverse engineering app requests now! The next step would probably be to grab the app bundle and try to decompile it looking for the urls we saw but I don't have a mac on me and i've never done that before. Next post?

     

       911
       +
       

     

       912
       +
       Taking inspiration from the [LOW←TECH MAGAZINE](https://solar.lowtechmagazine.com/) I will be taking any questions / comments about this article via email and then posting them here to my site! If you have a question or comment feel free to email me at [me@dunkirk.sh](mailto://me@dunkirk.sh). Now to go eat breakfast :)