Edwin Siebel edwinsiebel

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Some notes and tools for reverse engineering / deobfuscating / unminifying obfuscated web app code.

Dutch Government Bug Bounty Scope

The National Cyber Security Centre (NCSC) contributes to jointly enhancing the resilience of the Dutch society in the digital domain and, in doing so, realizes a safe, open and stable information society by providing insight and offering a perspective for action. Therefore it is essential that the ICT systems of the NCSC are safe. The NCSC strives towards providing a high level of security for its system. However, it can occur that one of these systems has a vulnerability.

For more information about reporting the bugs go to https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd

Source https://gist.github.com/random-robbie/f985ad14fede2c04ac82dd89653f52ad
https://www.communicatierijk.nl/vakkennis/r/rijkswebsites/verplichte-richtlijnen/websiteregister-rijksoverheid

The following describes a technique to achieve HTTP request smuggling against infrastructure behind a HAProxy server when using specific configuration around backend connection reuse. This was tested against HAProxy versions 1.7.9, 1.7.11, 1.8.19, 1.8.21, 1.9.10, and 2.0.5. Of all these tested versions, only 2.0.5 was not vulnerable out of the box, although it is when using the no option http-use-htx configuration, which reverts back to the legacy HTTP decoder. 2.1 removed the legacy decoder so it is not affected.

To actually exploit HTTP smuggling using the issue described in this writeup, the backend server(s) behind HAProxy would also have to be vulnerable in the sense they too would need to suffer from a bug, but one which parses and accepts a poorly formed Transfer-Encoding header (almost certainly violating RFC7230), and allows HTTP keep-alive.

The HAProxy bug - sending both Transfer-Encoding and Content-Length

This is how HAProxy handles a request when Transfer-Encoding and Content-Length is p

Now, we need to sign the unsigned APK and run an alignment utility on it to optimize it and prepare it for the app store. If you already have a signing key, skip these steps and use that one instead.

Let’s create keystore file using this command Syntax:

keytool -genkey -v -keystore .keystore -alias -keyalg -keysize -validity

For Example :

	#!/usr/bin/env python3
	# Ref https://gist.github.com/altbrace/52ae1783b31257021520673fadb95b6e

	from pydbus import SystemBus
	from gi.repository import GLib # don't mind the import error if you get one, it should work
	import subprocess
	import time
	import re

	ADDRESS = '74_5C_4B_0C_C4_41' # your Bluetooth device's MAC separated by underscores

	import java.io.*;
	public class JavaDeserial{

	public static void main(String args[]) throws Exception{

	FileInputStream fis = new FileInputStream("/tmp/normalObj.serial");
	ObjectInputStream ois = new ObjectInputStream(fis);

	NormalObj unserObj = (NormalObj)ois.readObject();
	ois.close();

	# gcloud auth activate-service-account --key-file=85.json
	# gcloud projects list

	project="my-project"
	space=""

	echo "gcloud auth list"
	gcloud auth list
	echo -e "$space"

	== Adb Server
	adb kill-server
	adb start-server

	== Adb Reboot
	adb reboot
	adb reboot recovery
	adb reboot-bootloader

	== Shell

Edwin Siebel edwinsiebel

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Table of Contents

Dutch Government Bug Bounty Scope

The HAProxy bug - sending both Transfer-Encoding and Content-Length