AhnMo

Deobfuscating / Unminifying Obfuscated Web App / JavaScript Code

Some notes and tools for reverse engineering / deobfuscating / unminifying obfuscated web app code.

Table of Contents

• tl;dr: AKA: devalias's shortlist
• PoC
• Benchmarks / Leaderboards / etc

AhnMo

(async function() {
  const baseline = await fetch('').then(r => r.text());
  const header_keys = [
    "CACHE_INFO", "CF_CONNECTING_IP", "CF-Connecting-IP", "CLIENT_IP", "Client-IP",
    "COMING_FROM", "CONNECT_VIA_IP", "FORWARD_FOR", "FORWARD-FOR", "FORWARDED_FOR_IP",
    "FORWARDED_FOR", "FORWARDED-FOR-IP", "FORWARDED-FOR", "FORWARDED", "HTTP-CLIENT-IP",
    "HTTP-FORWARDED-FOR-IP", "HTTP-PC-REMOTE-ADDR", "HTTP-PROXY-CONNECTION", "HTTP-VIA", "HTTP-X-FORWARDED-FOR-IP",
    "HTTP-X-IMFORWARDS", "HTTP-XROXY-CONNECTION", "PC_REMOTE_ADDR", "PRAGMA", "PROXY_AUTHORIZATION",
    "PROXY_CONNECTION", "Proxy-Client-IP", "PROXY", "REMOTE_ADDR", "Source-IP",
    "True-Client-IP", "Via", "VIA", "WL-Proxy-Client-IP", "X_CLUSTER_CLIENT_IP",

AhnMo

import { Service } from 'typedi'

@Service()
export class ExampleInjectedService {
    printMessage() {
        console.log('I am alive!')
    }
}

AhnMo

class FairPlayer: AVPlayer {
  
  private let queue = DispatchQueue(label: "com.icapps.fairplay.queue")
 
  func play(asset: AVURLAsset) {
    // Set the resource loader delegate to this class. The `resourceLoader`'s delegate will be 
    // triggered when FairPlay handling is required.
    asset.resourceLoader.setDelegate(self, queue: queue)
    
    // Load the asset in the player.

AhnMo

1. xGitGuard

• https://www.blackhat.com/us-20/arsenal/schedule/#xgitguard-detecting-publicly-exposed-secrets-on-github-at-scale-21188
• Test repo: https://github.com/bahmanrashidi/test_xgitguard

2. Threagile

• ?

3. UFO

• https://www.dynatrace.com/solutions/devops/ufo/
• ~ https://ieeexplore.ieee.org/document/8539157 ~

AhnMo

M2Crypto Installation error

If you have trobble with installing M2Crypto, please install libssl-dev and swig.

$ sudo apt install libssl-dev swig

Error message (libssl-dev)

    ERROR: Command errored out with exit status 1:
     command: /home/notroot/.virtualenvs/tad/bin/python -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-8NAhTW/M2Crypto/setup.py'"'"'; __file__='"'"'/tmp/pip-install-8NAhTW/M2Crypto/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record /tmp/pip-record-fvI7gc/install-record.txt --single-version-externally-managed --compile --install-headers /home/notroot/.virtualenvs/tad/include/site/python2.7/M2Crypto

AhnMo

#include <iostream>
#include <map>
#include <vector>
#include <string>
#include <algorithm>

void findAtFirstAndChangeSecond(
	std::vector<std::pair<std::string, std::string>>& v,
	const std::string key,
	const std::string val

AhnMo

<img id="test" />
<script>
let mock_console = {
  log: function(...args) { console.log(...args); }
};


let mock_document = {
  getElementById: function(element_name) { return window.document.getElementById(element_name); },
  createElement: function(element_name) { return null; }, // restricted

AhnMo

def solution(n, computers):
    network = [0 for _ in range(n)]
    
    done = False
    no = 0
    
    for idx in range(n):
        if network[idx] == 0:
            no += 1
            current = no

AhnMo

function encode_query_string(x) {
  let output = [];
  Object.keys(x).forEach(function(key) {
    output.push(`${encodeURIComponent(key)}=${encodeURIComponent(x[key])}`);
  });
  return output.join('&');
}

function decode_query_string(x) {
  let output = {};