Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
1
vote
0answers
591 views

Bypassing Certificate/SSL Pinning using AppMon

I'm trying to reverse engineer an app that has Native layer certificate pinning, I can't go that deep in to patching so I've been looking in to other available options, one i came accross was appmon, ...
0
votes
2answers
188 views

Legality of sniffing own traffic between mobile app and server

Recently I found a bug on a mobile app which claims to protect their users' privacy, however after connecting my phone with burp and installing a certificate I noticed that this app was sending a ...
0
votes
3answers
4k views

Android app man-in-the-middle attack

Let's suppose I have an Android app that after strong authentication pulls sensitive data from server A and sends it to server B without storing it. The data appears only in the network traffic (...
3
votes
2answers
206 views

Why does some malware limit their scope to certain countries?

I've noticed that some reports on malware mention that a certain malware or exploit kit (RIG TK, step 2 for example), limit their scope to certain countries or actively avoid infecting other countries ...
0
votes
2answers
183 views

How to create a format that is very difficult to reverse engineer? [closed]

I am learning about file formats. I have an application that will do analytics and will have some personal information. I need to make it such that only some people are able to access data and even ...
0
votes
3answers
353 views

Find algorithm from Digest and Plaintext

I want to edit a connection string in a config file containing what seems to be a hashed password. I know the followings: -oldPwd in current configured file -oldHash in current configured file -...
5
votes
1answer
421 views

What makes malware like Stuxnet or Duqu so advanced?

While malware such as Stuxnet and Duqu have been known for at least six years now, they are still (to the best of my knowledge) considered to be the most advanced malware ever publicly known. My ...
0
votes
1answer
2k views

How to decode hex code and modify it? Binascii.unhexlify [closed]

I am reviewing the code hosted at edb and the portion I am trying to make sense of and modify is at line 78 reversetcp_shellcode = binascii.unhexlify(b'...
2
votes
2answers
353 views

I just received a phishing text message, how could this have worked?

I received a phishing text message that pretended to be my bank. It had a link that went to a site that redirect to the following script: <html><script language="javascript">var page = "...
5
votes
1answer
2k views

How to reverse engineer WannaCry? [closed]

I was reading an article today about a Google researcher linking the WannaCry malware to the earlier malware Cantopee. I had two primary questions based on the contents of the article. What do the ...
0
votes
1answer
394 views

Secure compiled .NET source code applications ASP.NET and Windows Forms [closed]

Right now I'm working as a software development leader in my enterprise. Here's the main issue of everything. A software developer that works with us. There has been some rumours about this user ...
1
vote
2answers
1k views

Segmentation fault error when calling user defined function in shellcode

I am getting the segmentation fault error when I called function "target" in my shellcode. Here's the C code of program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #...
1
vote
0answers
143 views

IDA PRO address issue [closed]

i'm doing some capture the flag challenges, i struggle when I debug on linux with 'ida'. Ida shows that ESP points to '0xFFFFC050' but i can't access it. here's a picture:
30
votes
8answers
7k views

Is there a way to prevent someone from making his own client app for my webservice? [duplicate]

Say I have a RESTful web service and a commercial Android app on the front end which is used to interact with it. I may use SSL so that the endpoints are not visible, but someone could still do some ...
1
vote
0answers
107 views

Implications of FirebaseAuth credentials in an Android .apk

I'm currently looking at an .apk for Android and I came across some hard-coded credentials. Apparently these are used for something called FireBaseAuth, which seems to be a Google service. I'm not ...
1
vote
3answers
545 views

Securing hashes of short strings

My understanding is that if I tell you that a given hash is the hash value of a single alpha-numeric character, then you can trivially identify what the source string is, by brute force checking the ...
6
votes
3answers
994 views

Why Youtube, or any other Google services use account binded authorization key plain in the url?

in the past I expirmented with Google available api tools, like the Drive and Youtube api's. The way it works is after you purchase a deveopler account, you are granted to many of Google services ...
0
votes
2answers
146 views

Where to find current, live botnet executable clients

I've been able to find readily available botnet source code online however I'm currently working on my university research project and require access to an actual botnet client which encompases DGA's (...
1
vote
2answers
501 views

Read memory of a java application

I need some starter advice here. Never done Java reverse engineering before, but I needed to somehow read the memory of a running desktop java application. The process communicates with an external ...
0
votes
1answer
164 views

What tools exist to crack, disable, and undo the effects of a malicious Linux binary? [closed]

I'm a network Penetration Tester and I'm trying to learn how to crack binaries. As an exercise, I've spent two days trying to crack a Linux binary that was supposedly designed to be cracked. ...
3
votes
1answer
2k views

Heap Overflow - unlink() technique exploitation on x86_64 (64 bit)

Trying to exploit this sample vulnerable program: /* Heap overflow vulnerable program. */ #include <stdlib.h> #include <string.h> int main( int argc, char * argv[] ) { char * ...
1
vote
1answer
115 views

Is it possible to protect your software and similar from being cracked? [duplicate]

With reverse engineering, you can disassemble, edit and do a lot more. This is probably used for cracking software in order to get the full versions and avoid using actual money. I do not really ...
4
votes
1answer
110 views

SSH access during manufacturing

What are security pros and cons if we have to enable SSH access during the manufacturing of the device (i.e. Fire Alarm Control Panel)? It is a manufacturer requirement. SSH access will be disabled ...
8
votes
1answer
493 views

Exploitation: EIP refuse to jump to the stack although it's executable

I wrote a program in C that is exploitable to BOF. TL;DR - My payload (NOP-sled + shellcode + return address) overrides EIP but I can't set EIP to point to the address of my payload, although I ...
0
votes
1answer
543 views

How malware analyst job looks like?

I would like to be a malware analyst. Now I am a Java Developer but for a long time I have been interested in security, especially in malware analysis. I would like to know how this job looks like? ...
9
votes
1answer
268 views

How to legally blog about Windows internals

In the field of malware analysis and reverse engineering, many job postings call for familiarity with the PE file format, Windows internals, etc. However, Microsoft presumably doesn't want people ...
0
votes
2answers
952 views

Buffer Overflow: Advice on exploiting

int play() { int a; int b; char buffer[010]; a = 0x41414141; b = 0x42424242; if (write(STDOUT_FILENO, "For a moment, nothing happened. Then, after a second or so, nothing ...
0
votes
2answers
99 views

Forcing a black box to register a ssl cerificate

I have in my home a proprietary device, which I took an interest to see what it does over the network. I first determined his Ip on my network, and the port used to pass http/s requests, then arp ...
41
votes
11answers
14k views

Can software passwords be bypassed by reverse engineering?

Let's say, I have Admin privileges in my OS (Windows or whatever). When software XYZ is installed and executed, that means there is communication between the OS and XYZ and the OS executes and sees ...
0
votes
1answer
224 views

Is possible to apply an inverse function to remove a compiled object?

I create a watermark with photoshop like this To make this watermark I use a software functions of a software (for example photoshop). Functions is implement like set instructions (my variables) a, ...
2
votes
1answer
375 views

Interactive shell not opening

I'm performing a buffer overflow attack on a binary and I managed to get proper return address and execute my shell code. It successfully ran the shell code. But I'm not getting a shell. When I type ...
14
votes
2answers
4k views

Viewing the stack

I recently started learning about buffer overflows and how they work. Someone shared a binary to practice on (in a vm, don't worry). I've been feeding strings to the socket that the binary opens, and ...
2
votes
1answer
834 views

Exploit VS Reverse Engineering VS PenTest [closed]

To start let me say that I'm trying to find my way in infoSec...I wanna know which path to follow. My background is basic database CRUD programming (HTML Php, JavaScirpt, Java etc...) I just read an ...
1
vote
0answers
406 views

Mitigating Memory Dump and Analyze of an Application

I have used Frida and Fridump for Memory Dump & Strings Dump on a mobile device which I installed an app for testing. In the strings.txt file I have extracted using the mentioned above tools, I'm ...
1
vote
0answers
137 views

“Random” key generated every second, how can I tell how it is created? [closed]

Long story short, I have a program that generates 32 character keys. These keys change every second so I assume they are time based. Some of these keys are as follows: 8é 03]TyjzyQ;µ°g'Ôñ"KL2ûä*ª ...
1
vote
0answers
106 views

Volatility Plug-ins to investigate packed exe files

I am using volatility for malware analysis. I have got a process in my memory image that is packed by malware using UPX packer. Malfind plugin doesn't show injected code for it also. How can i use ...
0
votes
1answer
56 views

Why a pdf is opened when I click a url when the url specifies its a zip ?Is this link trustworthy?

So basically the href of the anchor tag is something like hxxtp://www.xxxx/xx.zip and the anchor tag text visible to user is something like xxxx.pdf ,when user clicks it Mozilla opens it as a .pdf but ...
1
vote
3answers
16k views

How to set reverse tcp connection when doing pentesting in VMs?

msfconsole is a cool opensource pentesting tool from metasploit. Once the exploit is valid, we can set payload to the victim. For persistent connection, we may need meterpreter. But we often test ...
0
votes
2answers
239 views

What is actually happening in the background when using such things as airmon? [closed]

Firstly: Apologies if this is not the relevant place to ask this, if not then some direction would be good (thank you). I have been interested in Information Security for some years now, but have ...
1
vote
1answer
377 views

Starting off with Malware Analysis

I am starting off with malware reversing/analysis for the first time. I have been going through many resources on the internet. Some of them being pretty awesome and helpful, like SANS resources, ...
3
votes
3answers
1k views

Found DSA and RSA private keys hard-coded in a file during penetration testing. How to use them for SSH authentication?

We are performing a penetration test as part of a study where the hardware unit listens for connection over FTP, SSH, and Telnet. All of these are password-protected. The hardware unit must first be ...
0
votes
1answer
287 views

Why use XOR or OR operator for “bypass” a conditional jump

I'm currently working on a challenge on root me but had to read the solution on internet because I couldn't progress anymore. I read this article which talk about the challenge I'm currently working ...
2
votes
2answers
659 views

Disk encryption with OTP to protect source code

We have to ship a hard- and software prototype to a customer for a first field test. The software is just not ready (protected - too much Python code) for distribution without the possibility, that ...
-1
votes
1answer
158 views

Decompiling folders inside a jar file [closed]

I am in possession of a jar file that I have reason to believe has a RAT inside. I downloaded it inside of a virtual machine with jad installed and began to attempt to look at the source. I found that ...
11
votes
1answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
3
votes
1answer
4k views

Which file encryption algorithm is used by Synology's Cloud Sync feature? [closed]

I'm trying to find out which encryption method is used by a piece of software I use, viz. the 'Cloud Sync' feature of Synology's DSM 6.0 running on a Synology NAS. (Background. This Cloud Sync ...
0
votes
1answer
291 views

Possible to take hash from know result and algorithm?

I am trying to build a casino site in PHP where users can play roulette. I found this algorithm that I want to use to "roll" numbers: <?php $secret = '...
5
votes
2answers
275 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
1
vote
1answer
514 views

How can I find the size of an array just from compiled C program?

I'm playing around with buffer and heap overflow vulnerabilities, and it is all fine to exploit stuff when you have the source code and can see all the variables, their sizes and values, etc. But, ...
1
vote
0answers
64 views

Polymorphic Analysis

I'm a beginner at malware analysis. For my research studies, I have to identify polymorphic malware based from experiments. I would like to know if there are any guides showing how to analyze the code ...