Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Israeli Mossad launches cyber challenge

3d375032374147a7865753e4bbc92682.xyz

Post reply on HN
Print view View original

41–50 of 121 posts

Re: Israeli Mossad launches cyber challenge

#42

Post by laurentl »

The French cyber security community has a similar challenge every year: https://www.sstic.org/2019/challenge/ (in French).

The challenges usually involve static analysis / disassembly, breaking improperly configured crypto, etc. The best part (for me at least) is that competitors must submit a write-up of how they cracked the challenge, and the best write-ups are published. It makes for fascinating reading even if you’re not really into that scene.

Re: Israeli Mossad launches cyber challenge

#44

Post by atdt »

Decompile the apk, and run 'strings' on assets/flutter_assets/kernel_blob.bin.

Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl. (Grep for the IP to find it.)

So, using the web site name as the seed and the 'client id' as the password, we get:

$ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "d7c6bdcfcb184bf587ceee7c7c28e72e"}' http://35.246.158.51:8070/auth/getUrl

The response is an HTTP 200 and: {"AuthURL":"/auth/v2"}

http://35.246.158.51:8070/auth/v2 is I guess the next step.

edit: The /auth/getUrl endpoint responds to any request with the same response, so that may not be the right Seed/Password combination.

Re: Israeli Mossad launches cyber challenge

#45

Post by stdcall83 »

atdt wrote: post #44

Decompile the apk, and run 'strings' on assets/flutter_assets/kernel_blob.bin. Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl . (Grep for the IP to find it.) So, using the web site name as the seed and the 'client id' as the password, we get: $ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "…

Got to this point by running the APK in sandbox and tracking the TCP packets...

Re: Israeli Mossad launches cyber challenge

#46

Post by whoisjuan »

hashberry wrote: post #41

This site loads the jQuery library in order to... 1. Access $("#text1")[0].innerHTML 2. $( document ).ready() { typeWriter (); } facepalm

It's done like that because the typeWriter effect is actually rendering line break elements (
) as it shows up.

Re: Israeli Mossad launches cyber challenge

#48

Post by arboroia »

atdt wrote: post #44

Decompile the apk, and run 'strings' on assets/flutter_assets/kernel_blob.bin. Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl . (Grep for the IP to find it.) So, using the web site name as the seed and the 'client id' as the password, we get: $ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "…

You're close, but that first endpoint is just to retrieve the auth URL, no need to post anything to it. It then passes the seed and password to the returned URL, so: "http://35.246.158.51:8070/auth/v2" gets '{"Seed": "xxx", "Password": "xxx"}' of some kind

I haven't yet figured out what those are though...

See:

  Future login(String seed, String password) {
    var headers = new Map();
      return _netUtil.get(LOGIN_URL, headers:headers).then((dynamic authUrl) {
      try {
        if (authUrl == null) {
          return Future.sync(() => new Token("", false, 0));
        }
        var loginUrl = BASE_URL + AuthURL.map(json.decode(authUrl.body)).url;

Re: Israeli Mossad launches cyber challenge

#49

Post by mescal »

atdt wrote: post #44

Decompile the apk, and run 'strings' on assets/flutter_assets/kernel_blob.bin. Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl . (Grep for the IP to find it.) So, using the web site name as the seed and the 'client id' as the password, we get: $ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "…

I think you must also fake the user agent as "iWalk-v2"

Re: Israeli Mossad launches cyber challenge

#50

Post by arboroia »

arboroia wrote: post #48
atdt wrote: post #44

Decompile the apk, and run 'strings' on assets/flutter_assets/kernel_blob.bin. Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl . (Grep for the IP to find it.) So, using the web site name as the seed and the 'client id' as the password, we get: $ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "…

You're close, but that first endpoint is just to retrieve the auth URL, no need to post anything to it. It then passes the seed and password to the returned URL, so: " http://35.246.158.51:8070/auth/v2" gets '{"Seed": "xxx", "Password": "xxx"}' of some kind I haven't yet figured out what those are though... See: Future login(String seed, String password) { var headers = new Map (); return _netUtil.get(LOGIN_URL, head…

So reading about flutter, there's quick reload information in debug mode[0]

This leads me to believe that the seed and password entered in development / in the cookie jar from a previous attempt are somewhere in the `isolate_snapshot_data` file

[0] https://github.com/flutter/flutter/wiki/Flutter-engine-opera...

Post reply on HN