Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [obfuscation]

Obfuscation refers to hiding the intended meaning of communication.

0
votes
1answer
57 views

Key Encryption / Obfuscation

I got a GUI Program, which loads the Logic from a webserver if the entered License Key is valid. The actual connection string I hexed and xor'd with a secret key. (which is unfortunately static) The ...
1
vote
1answer
50 views

How can I make sure that my Python code cannot be accessed by the user of my web app?

I have a Python Program whose code I would like to protect. For sake of example, let's say I coded a novel function called "add" which does the following: def add(n1, n2): return n1 + n2 I'd ...
0
votes
1answer
98 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
2
votes
1answer
153 views

C++ binary obfuscation: how to get around license checks being a simple if/then branches?

I'm looking into binary obfuscation for an exectuable binary written in C++. I realize preventing cracks is impossible, but making it slightly harder would be nice. No matter how complex the actual ...
0
votes
1answer
41 views

Are auto-type features of password managers actually effective against keyloggers?

Of course if you think of a "keylogger" as a program that can only read keystrokes, then copy-pasting on the clipboard is going to be enough. But we know that keyloggers are not really only "logging ...
2
votes
0answers
116 views

How to obfuscate C++ code with movfuscator?

I want to obfuscate a C++ application using movfuscator, but movfuscator currently uses C as the source language and not C++. I tried to do the followings (as they recommended, but with no success): ...
5
votes
4answers
1k views

Does appending randomness to a token before encrypting it, make it more secure?

Scenario: User requests page on my site Server builds up token using various values, encrypts it (via an industry-standard algorithm, nothing homegrown) using a key only the server knows, and returns ...
1
vote
2answers
147 views

How to obfuscate a assemblies binary compiled with .NET framework?

How to obfuscate a binary compile with .NET framework? Tools such as Ebowla and Pecloak.py will encrypt it but the program won't run. Even UPX can't pack it. Wondering are there any ways to obfuscate ...
-1
votes
1answer
296 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
2
votes
1answer
171 views

How to obfuscate SSH tunnel Mac?

I am looking to test a DPI (deep packet inspector). I currently have it set up to block SSH connections (which it does successfully). I have learned that DPI can be bypassed by obfuscating/encrypting ...
0
votes
0answers
35 views

De-obfuscating PHP [duplicate]

<?php $xgxjr = 's0dty-xo1Hfbrki38g6_mn\'pc4e9a*257#lvu'; $qwymcxu = Array(); $qwymcxu[] = $xgxjr[9] . $xgxjr[29]; $qwymcxu[] = $xgxjr[16] . $xgxjr[10] . $xgxjr[16] . $xgxjr[11] . $xgxjr[30] . $...
1
vote
2answers
208 views

How to make a well-known malicious programs undetectable by anti-virus solutions? [closed]

I want to make well-known malicious programs, like Mimikatz and Incognito, undetectable by anti-virus solutions. I have already tried various approaches myself, like packing the binary with UPX or ...
0
votes
2answers
335 views

Extract URL from obfuscate javascript

I have an obfuscated script. I was asked to de-obfuscate the code and extract the URL from the script. However, I used multiple de-obfuscation tools such as https://www.javascriptdeobfuscator.com/ ...
1
vote
1answer
205 views

Extract urls from obfuscated android malware

Working on android malwares, i have faced many android malwares that typically contain urls which are bank phishing page. This type of malwares are growing in number so an automated detection system ...
4
votes
1answer
558 views

Trying to understand what this PHP malware does [closed]

My server has been hacked recently and the hacker has uploaded multiple malicious source code to the web server. I have already de-obfuscate the code, but I still don't understand what it does. It ...
0
votes
0answers
28 views

Security of password to database in 2-layer SW model

I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly. This of course mean that the ...
1
vote
1answer
405 views

Android anti-tampering and SSL pinning bypass solid implementation [duplicate]

Is there any advance solution for Android application anti-tampering and bulletproof obfuscation implementation? I have been already using following protections in my application: Obsufcation using ...
-2
votes
1answer
73 views

Visual Studio anonymity

Recently me and me colleague was wondering about obfuscating / removing project info. If application is reverse engineered than what kind of information the engineer sees? Can he see the email of the ...
0
votes
1answer
342 views

Modify Win OS banner to avoid OS detection

I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.
2
votes
1answer
215 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
8
votes
1answer
367 views

How to Change a Culture of “Security Through Obscurity”

I have worked for a number of organizations in the past that utilize practices that are justified by what I would describe as "Security through Obscurity" including the following: Weak/Vulnerable two ...
0
votes
0answers
69 views

Obfuscated JavaScript from an email [duplicate]

I received an email pointing to a Sharepoint website. I downloaded the zip file and there was a JavaScript file inside. This was the content of the file. Sorry, I was not able to format it properly ...
1
vote
1answer
344 views

About the IEEE P1735 standard

I read this article from The hacker news (article). I understand the figure showing how P1735 works but I'm wondering, when you ship your IP (Intellectual Property) to a client, the code needs to be ...
0
votes
0answers
38 views

Unpacked camera firmware filesystem contains strange CGI files

I used binwalk and uncramfs to extract the filesystem from the firmware of a Swedish made camera system. Strangely, most cgi files that I would be interested in from a vulnerability standpoint, seem ...
2
votes
1answer
249 views

Generating request-specific token for an API

We have an API openly accessible through a data visualization on a website and an app. We'd like to make the life of potential data scrapers a bit more difficult. First thing we did was to add some ...
27
votes
8answers
5k views

Should firmware images for IoT be encrypted for security reasons?

When working with Internet of Things devices, is it recommend to obfuscate or encrypt firmware images pushed to clients? This to make reverse engineering harder. (They should be signed of course)
72
votes
3answers
11k views

Strange code running at startup

A piece of code was running on my Windows machine at startup. I would like to know exactly what this code is doing; it seems to refer to something like crackbook? @echo off if %...
1
vote
2answers
141 views

Is there a point to obfuscating form field values?

Our company provides omnichannel (web, mobile, etc.) solutions for the banking industry. One of our customers is pushing for obfuscating or encrypting the contents of the form fields (client-side, on ...
0
votes
0answers
32 views

Plain-text URL mitigation in android

I was testing an android application and found various URLs where the application is sending data. These URLs were present in plain text e.g. send_data(https://example.com/abc12434) What is the best ...
3
votes
2answers
158 views

Is it possible to send a message and 100% obfuscate the origin of the sender in a p2p networked message board?

I am thinking of an app that could allow people to share text so they can post grievances about a totalitarian government in a p2p network. It has to be p2p because a website can be blocked. This ...
2
votes
1answer
135 views

Dangers of jpeg with attachment

If anyone has any suggestions for tags, feel free to add them, seeing as i'm not yet familiar with the ones used on this site. I was wondering what the dangers are of appending a file to an image. ...
0
votes
1answer
211 views

DRM on CSS or even HTML files through domain locking via Javascript?

If you are planning to downvote me to oblivion, let me clarify what this question is about: I am not interested to prevent someone from copying my website. I know there are no foolproof method. My ...
1
vote
3answers
131 views

What all file types can we hide an archive file inside?

This tutorial explains how you can "hide" an archive file like .zip inside an image file by using the command: copy /b image.jpg + hide.zip output.jpg Doing so allows you to right click output.jpg ...
1
vote
1answer
362 views

I'm an idiot. Need help with JavaScript “codebreaking” and analysis [duplicate]

I accidentally executed a .js file from a phishing source with Windows Script Host. If possible I really don't want to reformat. If anyone could analyse this file it'd be awesome. I'm running Windows ...
7
votes
1answer
991 views

Preventing XSS in SVG

Currently assessing an application, I found out that it is possible to submit an SVG fill containing Javascript (the app is also vulnerable to XXE). I wondered if there was a method to prevent those ...
31
votes
3answers
5k views

How to deobfuscate suspicious JavaScript code? [duplicate]

I'm a sysadmin and one of my users just told me that he opened a JavaScript received by mail. Apparently there is no impact but since I don't know this language well, especially when its obfuscated, I ...
1
vote
0answers
298 views

How a packed malware runs the unpacked code?

When we run a packed malware it will unpack the code in dynamically allocated heap memory and heap can be kept non executable and I find no purpose to make heap executable. So, how the malware ...
1
vote
0answers
307 views

Is it possible to obfuscate binaries with UPX or similar software?

Warez scene groups often compress their binary executables using UPX or similar software. I've heard somewhere that they do this to obscure the algorithms they use from other groups, but I find this ...
2
votes
1answer
686 views

Deobfuscate office VBA code (malware) [closed]

I have been sent a malicious email and I am trying to figure out what the malicious code does. I have managed to find the payload by decrypting the Chr() values, but the rest of the code is ...
-2
votes
1answer
37 views

Why recovery of malicious code often fails from packed file?/ [closed]

I read it in a paper that recovery of the malicious code often fails from the packed file. Can you tell me some of the possible reasons why it fails?
-6
votes
2answers
240 views

Is cryptography the same as Obfuscation? [closed]

Obfuscation is the transformation of data, but as I understand it, obfuscation permanently transforms data while encryption just encrypts it and can be decrypted with a secret key later. So is ...
0
votes
0answers
57 views

sshd login obfuscation by prompting for a password although password login is disabled?

The sshd.config and fail2ban both work by blocking authentication requests over a specified path, thus notifying the attacker about the protection measures in place. Wouldn't it be more desirable to ...
0
votes
2answers
217 views

Hash based code obfuscation

The code below if(str1 == "abc") {} can be converted to if(hash(str1) == 0x8732e) {} // assume hash("abc") == 0x8732e to obfuscate the code. But they are not equivalent when hash collision occurs;...
3
votes
2answers
413 views

What is the meaning of this possible malware?

My hosting service was helping me to identify a problem, and we found the following possible malware (which, of course, we have removed). Unfortunately, I'm not terribly technical, and so I am ...
0
votes
3answers
578 views

Suspicious base64 code, no one knows from where. Is it harmless? [closed]

While doing some testing on my site I found this code at the bottom of several of our pages. It appears to be encoding for a scaleable vector file of Pinterest's logo, that's all fine and good, but I ...
67
votes
7answers
14k views

Is image blurring an unsafe method to obfuscate information in images?

Is image blurring an unsafe method to obfuscate information in images? I.e., is it possible to "de-blur" the image, if you know the algorithm and the setting, or by trial & error? For instance, ...
0
votes
0answers
185 views

Settings for evading IDS by Metasploit

I like to test the evading options of Metasploit. It offers two insertion techniques: TCP::max_send_size Maximum tcp segment size. (0 = disable) TCP::send_delay Delays inserted before every ...
8
votes
2answers
355 views

Is there a reason why legit web sites are using this type of obfuscation?

Saw some top 200 web sites (by Alexa) using obfuscation in the javascript code. Any ideas on why they do it? My guess is that they do it to prevent data scraping, but not sure. Thanks. youtube ...
1
vote
0answers
132 views

Obfuscated PHP code found in WordPress core files and plugins [duplicate]

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...
92
votes
4answers
39k views

I was tricked on Facebook into downloading an obfuscated script

I got a notification on Facebook: "(a friend of mine) mentioned you in a comment". However, when I clicked it, Firefox tried to download the following file: comment_24016875.jse This is an ...