Security Research & Engineering Practice

Technical articles migrated from Yuque.

A Survey of the Security Risks of File Hash Leaks

::::danger A Survey of the Security Risks of File Hash Leaks I did a dedicated round of research on this question, in both Chinese and English sources. Conclusion first: the answer to “is a file hash leak harmful” is not a simple yes or no — it is highly context-dependent. :::: If the hash is merely an offline integrity-check value — for example the SHA256SUMS file publicly published on a Linux distribution’s official site — it is usually not a secret. On the contrary, it should be published and signed so users can verify download integrity and authenticity of origin. This is exactly how Fedora’s official verification instructions, Debian’s official image verification instructions, and Ubuntu’s official tutorial are designed. ...

From "Invalid Invite Code" to Binary Patching: A Tauri Reverse-Engineering Practice

Got my hands on a beta app - Wukong. Opened it up — an invite code input box popped up. Invite code? I didn’t manage to get an invite code today… Most people give up at this point. My first reaction was: how is this thing implemented? I didn’t expect this little investigation to burn through my entire Coding Plan Pro quota. 1. Initial Exploration With a target to crack, the first step is figuring out its architecture. ...

Android Reverse Engineering: LSPatch, the Root-Free Patch Mode

::::success How do you bundle your Hook module together with the App? The idea is: use LSPatch to embed the LSPosed framework into the APK, so there is no need to modify the App’s business code — instead, :::: Embedded Hooks (LSPatch / XPatch) —— the most elegant route https://windysha.github.io/2019/04/18/Xpatch-%E5%85%8DRoot%E5%AE%9E%E7%8E%B0App%E5%8A%A0%E8%BD%BDXposed%E6%8F%92%E4%BB%B6%E7%9A%84%E4%B8%80%E7%A7%8D%E6%96%B9%E6%A1%88/ https://github.com/WindySha/Xpatch?tab=readme-ov-file This route best fits your current situation. If you like writing Hooks (Java/Kotlin) but dislike editing Smali (assembly), then this route is a great fit. The idea ...

Android Reverse Engineering in Practice: Attack and Defense of App State Machines, Seen Through Cracking "Movie Hunter"

LSPosed module: cc-aligned-debugSigned-xxxxQluvnDtXmttQ-.zip Original app files: DYLS-xxxxX9y9lvWKr5dr-.zip Ad-free modified version: dyls-3.1.2.0-noAd.zip Tags: Android reverse engineering, Smali, state machine, logic vulnerability Preface: When Hooking Meets a “Corpse File” In red team security testing, we are used to hooking with Frida or Xposed, precisely modifying memory like a surgeon. But recently, while analyzing an app called “Movie Hunter” (电影猎手), I ran into an interesting confrontation. This experience made me rethink: the highest form of cracking is often not fighting the code logic, but reshaping the data source. ...

Golang Gorilla/sessions Session Forgery Risk Analysis and Reproduction

A fairly routine testing workflow: the project runs on Go and uses the ubiquitous Gorilla/sessions to manage sessions…… Background The first thing I noticed was that the cookie could be base64-decoded — and then decoded a second time…… This cookie is a typical encrypted CookieStore session value from gorilla/sessions, matching the format: <timestamp>|<base64-encoded-session-data>|<MAC> Where: Part 1 is a timestamp Part 2 is the gob-encoded session value, then base64-encoded; Part 3 is an HMAC-SHA signature used to verify data integrity; If we know the secret key (for example this project’s hardcoded "changeme"), we can decode/forge/modify the session. B64-decode it, and we get ...

Red Team Essential! Frp Anti-Traceability Enhanced Build

frp is a great tool — high performance, stable, and worth using. However, its configuration file has gone through two format generations (.ini ->.toml), and the options can be somewhat complicated for newcomers. When project timelines are tight and workloads heavy, you may not have time to figure out what all these options mean in a short period. Hence this article — written on April 14, 2025; the currently applicable frp version is: https://github.com/fatedier/frp/releases/tag/v0.61.2 ...

[SOC] Traffic Protection Effectiveness: How to Verify Whether Your Internal Network IDS Is Working Properly

::::info http://www.testmyids.com/ :::: To determine whether an internal network intrusion detection system (IDS) is running properly and effectively detecting potential threats in network traffic, you can take a hands-on approach to verify its functionality. A well-known resource frequently used for this kind of testing is http://www.testmyids.com/ This website is designed for security professionals, aiming to help them assess whether their IDS can accurately identify and raise alerts on potentially malicious activity or non-compliant network requests. ...

Stable Packet Capture: Intercepting Traffic from Various Devices via a Transparent Proxy (mitmproxy Usage)

Tutorial reference https://blog.csdn.net/zhuxian1277/article/details/111875951 Use Case mitmproxy is a powerful man-in-the-middle proxy tool that lets you intercept, view, and modify traffic between clients and servers. Its transparent proxy mode makes mitmproxy extremely useful in specific scenarios, especially when network traffic needs to be analyzed or tested without changing any settings on the target device. No proxy configuration needed: Unlike Burp Suite, mitmproxy in transparent mode does not require manually setting an HTTP or HTTPS proxy on the target machine. This means the end user or test subject will not notice the proxy’s presence, reducing the chance of human intervention. Certificate installation: Although no proxy configuration is required in transparent mode, to intercept and decrypt HTTPS traffic you still need to install mitmproxy’s root certificate on the target machine. This is similar to Burp Suite, since both must handle the SSL/TLS handshake to view encrypted traffic. Via MitmWeb, you can view captured packets locally; in terms of usage it is not much different from Burp. ...

The Form Is a Honeypot, the PDF Is the Real Target: Bypassing Websites That Pretend You Need to Register

Some things, once you know them, you will never be “fooled” by them a second time. cheat on me? I remember the first time I tried to download a whitepaper from a security vendor’s website, and a form popped up: “Please fill in your name, phone number, email, and company name before downloading.” I did as asked, even going so far as to use a throwaway email address. ...

[SOC] Defending Against Apereo CAS Deserialization Attacks with Suricata

1. Attack Characteristics of the Vulnerability The root cause of this vulnerability is the deserialization of untrusted user input, which involves a hardcoded key. An attacker can leverage deserialization gadgets already present on the target machine to perform malicious operations. The traffic characteristics of normal versus malicious requests are described below. A normal login request. Request execution length: 1121 Response Status code: 200 Response length: 7287 Malicious exploitation - no response echo Request ...