sathishshan

Remote Traffic to Localhost -> Ex: Curl to Burp

Tunnel Establishment:
ssh -fNT -R 8080:localhost:8080 username@IP

Test Run:
curl -svk https://www.google.com -x http://localhost:8080

-----------------------------------------------------------------------------------

sathishshan

while true; do nc -l localhost 8888; done

curl localhost:8888
curl -F test=@fun.cpp -F key=@enc.txt localhost:8888

sathishshan

HS256 - Weak Signing Key: Brute Force

hashcat -a 0 -m 16500 <JWT TOKEN> /path/to/jwt.secrets.list

npm install jwt-cracker
jwt-cracker <token> [<alphabet>] [<maxLength>]

HS256 - Extracting Public Key from JWT token:

https://github.com/silentsignal/rsa_sign2n/tree/release/standalone

sathishshan

HS256 - Signature:

echo -n "<JWT Base64url encoded - Header.Payload>" | openssl dgst -sha256 -hmac '<SECRET>' -binary | openssl base64 

The output of the signature will give base64 encoding, convert that to base64url encoding

SZf1eovdqV+1mo8rvI79UxQT3Ue/mJd3ipXu8XO01os=

Change (+ to -), (/ to _), (Omit the padding == or =)

sathishshan

openssl x509 -inform der -in cacert.der -out burp.pem
openssl x509 -inform pem -subject_hash_old -in burp.pem
openssl x509 -inform pem -subject -in 9a5ba575.0

mv burp.pem 93f6f67f.0

adb push 93f6f67f.0 /system/etc/security/cacerts

adb shell

sathishshan

import socket, sys, time

def listen(ip,port):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((ip, port))
    s.listen(1)
    print("Listening on port " + str(port))
    conn, addr = s.accept()
    print('Connection received from ',addr)
    while True:

sathishshan

Adding/Replacing the PublicKey in mobile application (FingerPrint):

Generating SHA256 hash from the Burp cert:

// It generates Publickey from the Burp Certificate

$ openssl x509 -inform der -in burp_CA.der -pubkey -noout -out burp.pub


// It converts burp publickey to base64 encoded format

sathishshan

// ==UserScript==
// @name           Login_MO
// @namespace      Auto_Login
// @description    Login_Auto
// @version        1.0
// @match          https://site.com
// @run-at         document-start
// ==/UserScript==

window.addEventListener('load', function() {

sathishshan

// ==UserScript==
// @name           Login
// @namespace      Auto_Login
// @description    Login_Auto
// @version        1.0
// @match          https://site.com
// @run-at         document-start
// ==/UserScript==

window.addEventListener('load', function() {

sathishshan

#single video
youtube-dl --cookies youtube.com_cookies.txt "URL"

#playlist
youtube-dl --yes-playlist --cookies youtube.com_cookies.txt "URL"

You can use: --playlist-start, --playlist-end, --playlist-reverse or --playlist-items to achieve this goal.

#Note: cookie should be in Netscape format