Intake:Digital

Code Armoring for Enterprise Microservices - PDF Document Document Contents: 1. Introduction - Covers the reverse engineering threat landscape (static and dynamic analysis) and code armoring fundamentals based on Filiol's research 2. Core Techniques Overview:    - Entropy Management and TRANSEC principles    - Malicious PRNG architecture with 59-bit stream cipher    - K-ary code distribution for splitting protection across services 3. Microservice Architecture Design:    - System overview with 4 primary services (VM Runtime, Key Management, Code Generator, Armoring Engine)    - Component architecture details    - Secure communication patterns 4. Implementation Guide with step-by-step code examples:    - Virtual Machine Layer execution    - Bytecode Protection Engine pipeline    - Key Management Service with environmental key generation    - Code Mutation Generator for polymorphic variant...

Client Domain Hooking - Example Attack – duszynski.eu – Piotr Duszyński Client Domain Hooking - Example Attack Written on May 20, 2019 In my last blog post I have released a paper that described all relevant technical aspects of the ‘Client Domain Hooking’, along with a HTTP Strict Transport Security (HSTS) survey made for the TOP 1000 Alexa websites. In this post I will show how to run a simulated, ‘Client domain Hooking’ attack which will be used to evaluate an example browser-based application security posture. “Prerequisites” In order to execute this attack, you will need the following set-up: any active and registered domain name (we will be using ‘cdh.modlishka.io’ as an example). a valid wildcard TLS certificate for the domain that we own (it can be either bought or obtained from the “Let’s Encrypt” service). latest version of Modlishka v.1.1 reverse proxy. target applications, such as the latest version of Chrome browser and example vulnerable WebView based mobile applications....