Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Israeli Mossad launches cyber challenge

3d375032374147a7865753e4bbc92682.xyz

Post reply on HN
Print view View original

51–60 of 121 posts

Re: Israeli Mossad launches cyber challenge

#53

Post by revocheese »

atdt wrote: post #44

Decompile the apk, and run 'strings' on assets/flutter_assets/kernel_blob.bin. Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl . (Grep for the IP to find it.) So, using the web site name as the seed and the 'client id' as the password, we get: $ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "…

following your steps at getting the strings, which in turn helped me get the code of the whole application

first of all, as per the code, the User-Agent must be setup to "iWalk-v2"

then doing a simple get request to http://35.246.158.51:8070 will return {"AuthURL":"/auth/v2"}

replacing the original url with http://35.246.158.51:8070/auth/v2 and then sending a json like '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "d7c6bdcfcb184bf587ceee7c7c28e72e"}' with "Content-Type: application/json" returns {"IsValid":false,"LockURL":"","Time":136764}

the Time here (as per my understanding in the code) is the request duration, which somehow contradicts postman's request duration field

now one weird thing I've noticed about this app is this, if i install it on a regular device, and connect that to a proxy, then type gibberish into the fields then click Login, the following code gets invoked

  void _submit() async {
    final form = formKey.currentState;
    if (form.validate()) {
      setState(() => _isLoading = true);
      form.save();
      _networkActions.login(_seed, _password)
                      .then((result) => _loginCompleted(result))
                      .catchError((e) { 
                        _loginCompleted(new Token("", false, 0));
                      });
    }
if a loading icon appears then I assume that the code passed the condition and passed this line of code "setState(() => _isLoading = true);" now the weird part is that, I don't see any outgoing connections from the app... (I use charles to capture requests)

Re: Israeli Mossad launches cyber challenge

#54

Post by nocturnial »

mrlatinos wrote: post #32
TheLoneTechNerd wrote: post #30

Earlier quoted context omitted.

Level 1: The people who just go to the site/download the APK Level 2: The people who realize that the requested actions are likely unsafe, and complain about it Level 3: People who realize that this is part of the challenge and just use a VM Nobody on HN is "this dumb", if you want to participate in a challenge with an intelligence agency , take the proper precautions

The majority of the population is Level 1. Consider what that means for Mossad. Enjoy your challenge.

I thought the majority of the population was level 4.

Level 4: Ignore it.

Re: Israeli Mossad launches cyber challenge

#55

Post by Paraesthetic »

Scoundreller wrote: post #37
pmiller2 wrote: post #36

Earlier quoted context omitted.

Download to a burner machine, then airgap it by removing/disabling all networking hardware, inside a room with no other computers. ;)

Then sell the system to an unsuspecting soul on eBay.

Or gumtree

Re: Israeli Mossad launches cyber challenge

#56

Post by Paraesthetic »

salawat wrote: post #10

Oh, come on. You have to have an old phone lying around to factory reset for shits and giggles. Not like they'd burn good zero days on a publicity stunt. Remember, this thing'll be getting picked apart by everybody considering the source. Unless you're afraid of getting black bagged that i...

Chief.. Chief come in... Damn lost him

Re: Israeli Mossad launches cyber challenge

#57

Post by andr0id »

Searching for "iWalk-v2" on google gives following book as the first result:

https://books.google.rs/books?id=1nfhpqvLSM4C&pg=PA397&lpg=P...

on page 397 there is entry in index: iWalk, v2 71 on the same page there are interesting terms like islamic terrorism, jihad via internet, judism... also page number 71 which stands next to iWalk term is interesting coincidence since this riddle is celebrating 71 years of Israel independence...

Re: Israeli Mossad launches cyber challenge

#58

Post by andr0id »

revocheese wrote: post #53
atdt wrote: post #44

Decompile the apk, and run 'strings' on assets/flutter_assets/kernel_blob.bin. Poke around and you'll find code for POSTing JSON-encoded credentials to http://35.246.158.51:8070/auth/getUrl . (Grep for the IP to find it.) So, using the web site name as the seed and the 'client id' as the password, we get: $ curl -X POST -H "Content-Type: application/json" -d '{"Seed": "3d375032374147a7865753e4bbc92682", "Password": "…

following your steps at getting the strings, which in turn helped me get the code of the whole application first of all, as per the code, the User-Agent must be setup to "iWalk-v2" then doing a simple get request to http://35.246.158.51:8070 will return {"AuthURL":"/auth/v2"} replacing the original url with http://35.246.158.51:8070/auth/v2 and then sending a json like '{"Seed": "3d375032374147a7865753e4bbc92682", "P…

It's normal that you don't see any traffic using Charles, since Charles can only intercept traffic made by HttpUrlConnection or OkHttp, since flutter is not using any of those two..you can't see anything in Charles.
Post reply on HN