Questions tagged [networking]

Any kind of communication between computers using a protocol and the infra-structure that allow this communication.

Filter by
Sorted by
Tagged with
1
vote
3answers
541 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
14
votes
4answers
4k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
2
votes
0answers
77 views

Twitter scraping using Python

I've been working on a project to reverse-enginner twitter's app to scrape public posts from Twitter using an unofficial API, with Python. (I want to create an "alternative" app, which is ...
0
votes
0answers
60 views

SSL pinning deep problem

I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app ...
0
votes
0answers
278 views

Windbg vs x64dbg for network analysis

I have a program that I want to perform malware analysis on. The program seems to use HTTPs with SSL pinning (my theory) and some other proprietary protocol. I want to understand what is the best tool ...
0
votes
0answers
241 views

SSL pinning and bypass

I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
0
votes
0answers
46 views

Reverse engineering encrypted AllJoyn packets

I have a "smart" bulb here that is configured via its vendor application but I would very much prefer if I could use it with my openHAB instance. Using Wireshark, I was able to figure out ...
1
vote
2answers
73 views

Identifying hosts on a network with no DHCP

I have a router with an unknown IP address with no functioning DHCP server. I have to connect to the router using a static (non-DHCP) IP (I have tried several including 192.168.1.10). The link LED ...
0
votes
0answers
53 views

Understand the AES encryption mode

I am reverse engineering a software that implements its own encryption over HTTP. The implementation is very simple, the client has the server's public key which it uses to encrypt the data it sends ...
1
vote
0answers
25 views

API-Monitor not logging buffer

I have a problem with API-Monitor. When I try to capture data (here: network traffic), API-Monitor doesn't log the buffer from the recieved data. For send() it works well, but for recv() it doesn't ...
1
vote
1answer
80 views

How to read data from android.car.cluster

While performing a vulnerability scan for open ports of an Android Automotive Infotainment system, I found out that port 5151 is open. Doing a netcat on the open port, reveals a continuous stream of ...
1
vote
1answer
43 views

Inbound network queries not appearing in developer tools of browser

When trying to understand the behavior of web apps, I find myself stumbling against the fact that some network messages do not appear on the network tab of the web developer tool of the browser. For ...
1
vote
0answers
74 views

Restoring online functionality of an obsucure Korean PS2 horror game

Last year I posted for help in order to reverse-engineer and translate a Korean exclusive Horror game for the Playstation 2 called Mystic Nights. Here is the Original Post. Thanks to the kind folks ...
1
vote
1answer
124 views

Spoofing DNS to intercept iot traffic

I've got a bunch of IoT devices that can only be controlled through the Internet, as all their traffic goes through their own "cloud" server. I want to reclaim full control and low latency ...
2
votes
2answers
361 views

Getting started with reversing device network traffic

I am interested in starting to decode and understand some proprietary network traffic, sent from apps on various devices, such as my TV, game consoles, phones etc. Most of the things I want to look ...
0
votes
1answer
49 views

What browser do during initial web page request?

I am trying to understand why if I do fetch() 4 times on the active web page, after the fifth fetch server returns response that I am a "robot" I am using google chrome I go the following ...
0
votes
0answers
65 views

Where are private keys for Google Play stored on an android device?

I am running an application in BlueStacks that was installed with Google Play and am trying to look at network packets which are encrypted using RSA over TLS. I can see the client key exchange packet ...
1
vote
2answers
251 views

NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?

I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
1
vote
0answers
341 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
1
vote
1answer
699 views

Reverse engineer CAN-Bus checksum

I am trying to figure out a checksum algorithm. D1 to D6 is data, D7 is a counter obviously and byte 8 must be a CRC, but I didnt have any idea on how to build it. Tried to check if it fits any ...
0
votes
0answers
2k views

How to capture specific data packets sent in an online game?

I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. ...
1
vote
1answer
103 views

Which JSON object compact binary serialization is this?

I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server. Does anyone recognize this? I've attached the first ...
-1
votes
1answer
91 views

Break when exe send tcp packet

When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet. When I listen with procmon I can see that this exe send and recive tcp packet. 1) I look on the exe file ...
1
vote
1answer
165 views

Encoding method of float

I'm reversing this game and got stuck. To make it simple, You have some amount of coins in the game (float or double) and you can spend it on some things. I started sniffing network traffic and ...
0
votes
1answer
209 views

Determine checksum / CRC algorithm

I am doing reverse engineering on some network protocol. It is client to server communication and I am pretty stuck with identifying checksum (or CRC) algorithm used in packet structure. I tried ...
1
vote
1answer
139 views

Difficulty obtaining malware traffic

I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most ...
3
votes
0answers
64 views

Can a device be forced to stop using SSL? [closed]

Lately I’ve become interested in reverse-engineering the APIs used by the Nintendo Switch Online (NSO) services (especially to see if it would be plausible for me to access their Mario Maker 2 API ...
1
vote
0answers
145 views

Intercept traffic from exe to my Java server

In Windows 10, I can easily intercept traffic of an application using Proxifier and route it to Charles proxy, so that I can inspect and edit the data. exe -> Proxifier (Socks proxy to localhost:...
1
vote
1answer
574 views

Windows : Which process sent TCP/IP packet?

How do I find out which process has sent TCP/IP network packet? Are there some tools that can easily do this? Like in Linux.
0
votes
2answers
1k views

How to breakpoint exe tcp packet

I am debugging an executable in windows with IDA. My exe sends a TCP packet and I want to see which function it uses to send the packets. I looked on the import tab and haven't found any function ...
3
votes
1answer
288 views

What Checksum/CRC algorithm in RF packet?

I am banging my head to figure out the checksum of a RF device, it seems to be a simple one but no luck so far... The first 3 bytes is the SyncWord then 9 bytes is the payload and the last byte ...
0
votes
2answers
735 views

Lutron Caseta Protocol over HTTPS

I have a Lutron Caseta light switch. When I open the iOS app, it connects to lutron.broker.xively.com port 8883. Using a fakedns server I was able to direct that to my server running netcat as follows:...
1
vote
1answer
617 views

Network support when emulating firmware with QEMU

Continuing from this question: Firmware analysis and file system extraction? I am trying to run the QNap firmware using QEmu. I have basically the same firmware as is used in the question above. My ...
2
votes
2answers
587 views

Putting an application in between client and server

I'm attempting to reverse engineer (without dissecting the source code, as my understanding is that reverse engineering by analyzing input and output and building something from scratch that fits is ...
0
votes
3answers
7k views

Limited BusyBox shell

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell. BusyBox v1.19.2 (built-in shell (ash) Enter 'help' for a list of built-in ...
2
votes
1answer
478 views

DGA(Domain Generation Algorithm) based malware files

Where i can get DGA (Domain Generation Algorithm) based malware files for analysis? And,Can I get malware family names which is using Domain Generation Algorithm?
3
votes
1answer
520 views

How to debug packet processing with overlapped socket on Windows

The problem is quite complex so i don't want to run into unneccessary details. I have a network application, that communicates with multiple clients at once via UDP. I haven't written it and there is ...
1
vote
1answer
261 views

Reverse engineer LMTools server status enquiry

We are using FlexLM/Flexera/LMTOOLS (not sure which is the correct) as a licens manager for our Autodesk products. I don't know what version the server is, but I have a fairly old client version, ...
0
votes
1answer
113 views

How does some application get through the block when mobile data plan is exceeded [closed]

I have a mobile data plan of 2 GBs. When I exceed it, I always get redirected to the network operator's website when I trying to load an URL. For some reason Telegram(Android app only, Desktop app ...
1
vote
4answers
1k views

XMPP clubs in league of legends

Hopefully I'm asking this at the right place. League of legends recently added the option to join a club. Clubs still use the XMPP protocol just like before for their public chat rooms: XMPP for ...
3
votes
1answer
277 views

Is this a known encoding or cipher? (multiplayer game network traffic)

I'm trying to decode chat strings in a multiplayer game's network traffic; the way it encodes them is seemingly some arbitrary encoding. I've been analyzing the UDP traffic to the server with ...
1
vote
1answer
366 views

What checksum algorithm is this network protocol using?

I've been working my way through an undocumented TCP-based protocol by monitoring traffic with tcpdump, Wireshark, and some Python packages (scapy, numpy) with good luck so far, but I've hit a wall ...
1
vote
2answers
1k views

Find the right layer header for a corrupt pcap

So the problem is that i have a corrupt pcap file. You can find a the pcap file [here][1]. First i did the file command on it : the.pcap: tcpdump capture file (little-endian) - version 2.4, capture ...
1
vote
1answer
130 views

Find out how an Android app controls my AV Receiver

I have an Onkyo Audio Receiver (AR), and there is an Android app that I can use to control it, change the volume, the channel etc. As a little project at home, I'm working on an app that can control ...
1
vote
1answer
143 views

Reverse Engineering an iBaby M6

The iBaby M6 is a pretty cool baby monitoring system with neat features. It has Android and iPhone apps but unfortunately, there's no PC interface. I was thinking that if the camera was broadcasting ...
2
votes
2answers
1k views

Identifying protocol in a pcap file?

Is it possible to identify a protocol in a pcap file? I have a file which is a capture of data going between my phone and an IP camera, and I'd like to identify the protocol. I am using the app "MEye" ...
3
votes
0answers
182 views

Retrieving database credentials with access to an application that can connect and execute

I was asked to help extract information from an old Progress database. I have physical and remote access to both the database server and a workstation with the client application installed. I am able ...
9
votes
3answers
12k views

Guessing CRC checksum algorithm

I am trying to reverse engineer a 16 bit checksum algorithm of one relatively old (10 years) LAN game that is no longer supported nor has source code available. As it seems, data packets don't have ...
3
votes
1answer
323 views

Reversing a router, single user mode

I'm trying to reverse engineer a binary running on a zyxel router. My first approach would have been to change the password within the .bin firmware itself, but as seen here, I'm having some trouble ...
1
vote
0answers
299 views

Where can i find unix/linux tool for fuzzing for kill-switches? [closed]

I'm looking for linux/unix open-source tools for fuzzing ethernet card for kill-switch packets. https://en.wikipedia.org/wiki/Fuzzing I can imagine how it would be long to brute full of range on ...