Wunda Userid & Password

[andrewratcliffeuk]

Hi, thanks for creating & maintaining the Wunda integration. Much appreciated. I'm keen to adopt and use it but slightly nervous about the technique required to obtain userid and password. Do we seek the userid and password that is used to access the Wunda app, or is this a different userid and password?
TIA, Andy

[chezlong]

Its the credentials used by the app to access the HubSwitch. Its not visible to the user in the app. The integration suggests using a IP sniffer to extract it, and gives a example of an iPhone usage. Im on android and have installed pcap Android, but to cant see any direct local access traffic to the bug at the IP address I know its on.
Hoping someone can chip in with much more detailed instructions!

[tonyroberts]

@chezlong is correcrt, the credentials to access to HubSwitch are different to the ones used to log in to the app and are not visible to the user, hence the need to capture it from the network traffic.

I only have experience on iOS, but the method should be the same on Android. Open whatever tool you are using to sniff the network traffic and start it, then switch to the Wunda app and perform some action that will communicate with the HubSwitch (e.g. change the temperature in a room and wait a second or two for it to update). Then, go back to the app capturing the traffic and you will see the http requests to the HubSwitch in there. Look at the request headers and get basic auth Authorization header, and decode as per the readme.

[chezlong]

On the homeassistant community I posted a query about this- I saw only HTTPS traffic in the pcap captures (from PCAP android) and no local traffic (to 192.168... the IP address of the hubswitch.). However, just reading above, I realised I wasnt waiting long enough before terminating the capture. I've just repeated it now, and see some local HTTP traffic. So, thanks for the hint!

[tonyroberts]

Ah ok, good to know, thanks :) I'll update the readme with that.

[chezlong]

BTW opening the PCAP with wireshark gives the credentials without having to do the decode64. It also allows a bit of 'exploring' of the data. But then you've done all that reverse engineering for us, thanks!