Red Team

Using a recent case, let’s talk about some techniques for obtaining source code in real engagements. (This is also material from a closed-door sharing session a while back: hope you guys enjoy it~ Liquid Files Liquid Files is a foreign file-sharing (cloud disk) system; official site: https://www.liquidfiles.com/ It’s a commercial system, widely used abroad. Today we’ll try to obtain the source code of this system and conduct a preliminary attack-surface assessment (an initial code audit). ...

This article was contributed to the Alibaba Cloud Xianzhi Community. Original content; please cite the source when reposting. Foreword On an utterly unremarkable weekend, a buddy of mine messaged me saying he had a product security test on his hands that he couldn’t handle and asked me to help out. I wasn’t keen at first—but Haidilao hotpot is just too good, and so began this commissioned product security test. Product security testing means using limited resources (time/energy), through security testing and code audit among other means, to uncover as many vulnerabilities as possible, and to leverage these individual findings to drive the developers to fix the product’s security issues. ...