Questions tagged [obfuscation]
Obfuscation refers to hiding the intended meaning of communication.
181
questions
4
votes
1
answer
128
views
How can I identify open-source JavaScript libraries within minified code?
These days, most websites minify & concatenate their code.
Are there techniques to identify open-source libraries within minified, concatenated code?
I'm mostly interested so I can focus analysis ...
- 34.6k
1
vote
0
answers
105
views
Can anyone decipher this .BAT malware? [closed]
Its a 3.37MB batch file. When opened in Notepad/++ it's all Chinese and some unknown characters. It's still remaining largely undetectable despite being launched in the wild more than 2 days ago, ...
- 11
0
votes
1
answer
160
views
Obfuscated HTML [closed]
I'm looking at a potential phishing site and I see that some of the HTML is obfuscated. It's not Base64. All the links look like this:
<link
href="6bkaQeQe69e/st-...
0
votes
0
answers
24
views
Found several potentially malicious PHP files but not sure what they are doing? [duplicate]
A friend found several suspicious PHP files on his server when we was upgrading his Wordpress install. They are all in the public_html folder and the filenames are the name of his domain with ...
- 101
2
votes
4
answers
811
views
Code obfuscation and source code repositories
As I understand, code obfuscation is used to make reverse engineering difficult/hard for the adversaries/red team.
Now if I use a source code obfuscator where a .C/.CPP file is used as input and an ...
1
vote
0
answers
2k
views
Best port to setup Outline VPN for obfuscation
Many outline access keys use a random port but some do 443, I’ve found out since port 443 is for http its harder to find out that port is using a vpn.
So the question is, why don’t other Outline ...
- 21
-1
votes
3
answers
150
views
Who can we read the contents of the variable? Which format is used? [closed]
We are not IT security specialists but we are very curious to know more about a scam we received through mail.
We received a mail with a HTML file attached. The subject of the mail looked very ...
- 3
0
votes
2
answers
224
views
DomainFronting - re-routing and SSL certificats
I'm looking for a specific answer regarding the TLS handshake in a scenario of domain-fronting.
Following hensonsecurity and zscaler blogs I have noticed that a detailed description regarding the re-...
1
vote
1
answer
1k
views
UUIDs replacing inremental IDs in URLs
I am reading about implementing UUIDs in URLs instead of incremental IDs to reduce attack vectors using obfuscation. I plan to create a UUID from an incremental ID and store the UUID which would be ...
- 175
0
votes
2
answers
198
views
Is it possible to eavesdrop HTTPS encryptions by file size?
I see that HTTPS uses symmetric encryption for the file transfer, often AES. I also read that AES uses padding to help obfuscate the data itself. Though I am curious how powerful that padding is when ...
- 101
103
votes
5
answers
14k
views
Can I safely preview a short link?
There are a lot of different URL shorteners out there, like Bitly or TinyURL. Besides their main purpose of shortening a link, they also:
obfuscate the actual URL
collect statistics about the usage ...
- 1,683
2
votes
0
answers
67
views
What does this potentially malicious php code do? [duplicate]
Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
- 121
31
votes
16
answers
14k
views
How can I prove to users that my obfuscated code is not malicious without unobfuscating?
I created my own anti-adblock system, that does something similar to services like BlockAdblock except mine goes about Adblocker detection in a different manner (and so far cannot be bypassed like ...
- 671
-1
votes
1
answer
653
views
What is this obfuscated JS code trying to do? [closed]
I received phishing email that contains base64 encrypted JS code in the attachment. I decrypted it but can't understand it because of obfuscation. Do you guys have any clue what this code is trying to ...
0
votes
1
answer
205
views
Why is the -L (list) option of iptables not available to non-root users?
Many tools in Linux allow for checking things as a non-root user. For example, at any time, I can check whether a service is running:
$ systemctl status ntp
However, the iptables needs to be used as ...
- 1,017
0
votes
1
answer
773
views
PHP code in image file
My drupal website was getting hacked recently. While cleaning up the malicious scripts, I found that the hacker uploaded an image file (sites/default/files/test.jpg) contains below code.
...
- 187
1
vote
1
answer
151
views
Obfuscating android malware [closed]
I am exploring android malware forensics and am trying out payload generation and delivery, while also trying obfuscation. I have used commercial tools, e.g. ProGuard and also open sourced tools, eg. ...
- 13
1
vote
2
answers
1k
views
How to secure containerized python source code deployed at client side cloud
How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do ...
- 23
2
votes
4
answers
4k
views
.Net dll encryption
By nature, .NET assemblies are extremely easy to reverse engineer. Say I want to hide some code by embedding an encrypted .dll into another .dll that is to be decrypted and loaded at runtime:
compile ...
- 81
1
vote
1
answer
477
views
Passwords stored as obfuscated text, not encrypted
An application I admin (but did not develop or implement) claims to be storing passwords in a database using “reversible encryption.”
I have access to the database table, and was able to work out that ...
- 13
0
votes
2
answers
182
views
How to Prevent Copying of Device Source Code in Manufacturing
Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
- 1
0
votes
0
answers
16
views
What does this obfuscated PHP script do? [duplicate]
I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake.
The script in it's original form looks like this:
$zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
- 253
1
vote
1
answer
437
views
Is it possible for a javascript malware to put keylogger extension in my browser? [duplicate]
I clicked on "It's like you" virus in Facebook Messenger. Then I archived the original link with archive.ph (archive.today), and during the process the site showed me this: https://pastebin....
3
votes
3
answers
2k
views
Securing client side code of react application [duplicate]
I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription.
Are there any methods to ...
1
vote
1
answer
232
views
The hidden meaning of the source code of the malware?
I'm studying the source code of malware developed in c++ and I have two questions in the source code below
This is probably code that loads malicious dlls into memory.
typedef BOOL (WINAPI *...
- 13
2
votes
2
answers
2k
views
How to decrypt a file to memory and run it from memory?
How someone might run an encoded executable, mp3, or any other file safely in memory after being decrypted.
A use case might be someone trying to make code or a file only usable through their service ...
0
votes
1
answer
475
views
Mixing VPN Protocols
Is there any benefit to mixing vpn protocols as far as obfuscating your traffic. Would a multiple hop setup like (openvpn(server1) + wireguard(server2)) be better or is (openvpn(server1) + openvpn(...
0
votes
3
answers
1k
views
Traffic obfuscation under targeted surveillance
When you are under targeted surveillance and all of your internet traffic is tapped (including parts where you exit from a VPN to the internet), is there any point in using traffic obfuscation? It won'...
- 11
2
votes
1
answer
692
views
Hiding Tor traffic to prevent deanonymization
I am trying to figure out what is the best way to hide Tor traffic in order to improve anonymity.
While Tor is pretty good at hiding users’ IP addresses, its traffic stands out. This can be ...
- 29
1
vote
0
answers
153
views
Would Indistinguishability obfuscation make Javascript cryptography viable?
I know Javascript Cryptography is considered harmful because:
Secure delivery of Javascript to browsers is a chicken-egg problem.
Browser Javascript is hostile to cryptography.
The "view-source&...
- 111
0
votes
1
answer
5k
views
Obfuscating an .exe file
Is there a way to obfuscate an existing .exe file?
I'm in a situation where I cannot transfer the winPEAS.exe file (for PrivEsc purposes) on a Win10 machine because of the AV blocking the executable.
...
- 11
0
votes
0
answers
27
views
Does "Security By Obfuscation" have any place in good security practices? [duplicate]
One thing I've had hammered into me by pretty much every security expert I've talked to is that security by obfuscation is not a substitute for actual security measures. However, it has me wondering; ...
- 101
0
votes
0
answers
102
views
How to protect IP-sensitive data in files generated and used by users
I'm working on an offline windows application that generates and loads key results as files. However, these files provide key insights into how our product works internally. To make matters worse my ...
- 101
0
votes
3
answers
371
views
How can I protect me from... myself?
So, here is the deal:
I have a file I cannot change. I cannot, but I know in the future I will want to change it. It's of my understanding that it's not possible to make this file unchangeable while ...
- 74
1
vote
0
answers
456
views
Insecure Binary protection iOS Pentest Report
Thirdparty pentest company reported their findings in our iOS app.
In the report explanation for this vulnerability is
Apple provides default encryption for applications; however, the encryption ...
- 111
0
votes
1
answer
196
views
Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]
There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
- 191
101
votes
4
answers
15k
views
Why is this 435 × 652 pixel JPEG over 6 MB?
This was, before someone helpfully fixed it after seeing this question, a relatively unassuming and tiny photo of a ̶f̶i̶s̶h̶ nudibranch, with 283,620 pixels. It has some metadata: text Exif tags as ...
- 782
-1
votes
1
answer
714
views
obfuscating a Cython source code [closed]
After some research on how I can protect my python source code on similar topics here and other sites, most agree that I should convert my .py file to .pyd using Cython, but the problem is in the ...
- 1
0
votes
1
answer
310
views
I obfuscated my commercial software, i lost source [closed]
I obfuscated my web software with srcProtector and I archived files, I uploaded a new version of the software on the website.
The problem is I forgot to copy files in a new path for backup.
VERY VERY ...
0
votes
1
answer
256
views
Is using SecureString in combination with Xor considered secure enough for standalone Windows app?
The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string.
License.Import(string name, string email, ...
- 1,335
0
votes
1
answer
251
views
Can someone decode this for me?
I decoded some of the original traffic from hex and got the below output. I'm not sure how to decode it further. Any help? Thanks.
T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=22&X=...
- 15
-2
votes
1
answer
161
views
Banking App With Sensitive Info In Plain Text
I have a car loan and wanted to make a payment through their website. To enroll for online payments, it asks for the last 4 numbers of my social security number, birth date and account number, but ...
- 287
1
vote
1
answer
722
views
Help with decoding this? Base64 attack [closed]
I'm trying to decode this attack. I know it's attempting to send some kind of malicious command to the web server but I can't figure out how to decode it. It's like encoded more than once or something....
- 15
0
votes
0
answers
472
views
Packaging Python code for github: should I obfuscate author email address from the `setup.py`?
The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available ...
- 151
0
votes
0
answers
255
views
Securely unpack malware
I'm trying to find a way to securely unpack Windows Malware packed with UPX, I need to unpack a lot for analysis so automating the process as much as possible is beneficial.
I've found a few methods ...
- 101
0
votes
1
answer
206
views
Should I complie software after making all the variable and function names "1-2 character"? [duplicate]
In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
- 3,482
2
votes
1
answer
7k
views
How can I obfuscate a 64-bit executable Windows file? [closed]
Hyperion works OK when scrambling/obfuscating win32 files, but I am trying a program that seems to be a Win64 executable, and it fails:
C:\Hyperion>hyperion.exe -v mimikatz.exe output.exe
-------...
79
votes
5
answers
16k
views
Does code obfuscation give any measurable security benefit?
I've always firmly held the belief that obfuscation is essentially useless. Obfuscated code is not impossible to read, only harder to read. I had the belief that a sufficiently skilled attacker would ...
user163495
0
votes
0
answers
238
views
What are good examples of "Dynamic opaque predicates"?
I am studying the concept of software obfuscation and come across this interesting scheme, dynamic opaque predicate:
Basically it either goes two false branches, or two true branches, and ...
- 183
-1
votes
1
answer
1k
views
How can Runtime-Crypters stay FUD
A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
