Android Reversing - Finding the RSA Key of Akamai BMP
IntroductionThis article I am going to show you how you can use various tools to reverse engineer Android applications. The goal of this article will be to reverse engineer an Android application that uses Akamai’s Bot Manager Premier (BMP), aka the mobile protection SDK. You can recognise this from the x-acf-sensor-data header that is sent with requests. ..
Read more
Deobfuscating Imperva's utmvc Anti-Bot Script - Part 1
IntroductionIn this post, we’re going to take a deep dive into the utmvc challenge script that is part of the FlexProtect suite (formerly called Incapsula) by Imperva. The utmvc challenge is one of two challenge scripts that are presented to a user’s browser when browsing a protected site, the second being reese84. Depending on the setup of the site, the u..
Read more
Deobfuscating Imperva's utmvc Anti-Bot Script - Part 2
Part 2 - Control Flow FlatteningFlattening Control FlowIn part 1 we successfully revealed all of the strings in the script. In this part, we are going to tackle the control flow obfuscation. Control flow obfuscation is a technique to jumble up the order of code in order to make it harder to follow. It jumps around and is usually found in a switch block. I’..
Read more