1

I am testing a dll file , in a C# console app , and by the looks of it the dll file sends a web request with encrypted and then encoded values to a remote server.

after intercepting and analyzing the request it seems like base64 encoding but when i try to decode it the result is totally unreadable so i am assuming that the string is first being encrypted and then encoded into base64 format and then sent to the server.

I opened the dll file in JustDecompile to find the encryption key , but i dont know where to start my search for the key , is there any hard and fast rule about the location of the key? or it could be anywhere inside the dll file? if so then whats the best possible method of finding the key or underlying encryption method ?

thanks in advance

4
  • well, the key would probably be in the resources (dont' remember JustDecompile to know if it does expose those - probably). As for the method I would start by looking for some request related functions names and if dll is not obfuscated that shouldn't be an issue – Paweł Łukasik May 12 at 19:39
  • A key can be anything, a String a bunch of bytes, it is often next to impossible to identify the key just by looking at it. The beter way is to check the .net documentation for common crypto functions and check where they are used. For being able to encrypt something you have to feed the key as parameter into those functions so this is the point where you can try to trace back where the key comes from. – Robert May 13 at 14:02
  • I'm not sure what you are trying to achieve. But in public-private key cryptography, for example, a message would be encoded against the public key of the recipient. Without the recipient's private key you still won't stand a chance to decrypt it. That is: your assumption that there is an encryption key which also is used as decryption key may prove ultimately flawed. If you figured that something gets sent, can't you intercept it before it even gets encrypted? – 0xC0000022L May 14 at 20:44
  • @0xC0000022L i am using a dll file in a C# console app , as far as i know the encrypted string that is being sent to the server cant be intercepted before it gets encrypted , i am using "fiddler everywhere" to intercept the request – Umer May 14 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.