Reverse-engineering a login password's RSA encryption in a JS case study

A sanitized educational write-up examines how an enterprise office platform encrypts login passwords on the client side. The site routes logins through a third-party identity-as-a-service provider, and captured traffic shows the account sent in plaintext while the password appears as a variable-length hex string, consistent with RSA. The analysis notes that the core difficulty lies not in the standard algorithm but in a big-integer RSA implementation, a choice among three hard-coded public keys, and a single webpack bundle that must be environment-shimmed before running. It also highlights that the plaintext is URI-encoded before encryption and that a separate captcha verification ticket is needed alongside the password. The author describes locating the relevant function by searching for keywords like RSA and encryptedString in the bundle. All domains and site-specific constants are replaced with placeholders, and the piece frames itself as an explanation of the technique rather than a guide to abusing any service.