|
|
|
How are the hashes of URLs of this government Internet censorship list calculated |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
How are the hashes of URLs of this government Internet censorship list calculated Par Reverse EngineeringLe [2014-05-21] à 00:52:16
Présentation : Currently I am analyzing a child protection internet censorship software. I am especially interested in the part which includes the government filterlist as hashed URLs. For further research on the blocklist I'd like to know how the hashes are calculated. I hope that r RE can help There is one 140kb dll which reads an URL from the registry, downloads a xml file with about 3000 hashes and has apparently a verifyURL function to compare URLs with those on the list. The hashes are 44 bit hex chars The first two are always 00. The third is almost always 0 or 1 97pourcents but a few times its a number between 2 and 6 -- maybe something like type of filter complete domain, single URL or some obscure thing like ftp . The forth bit looks kind of random but its not evenly distributed. Then there are 40 bit truly random hex chars, just like a sha1 hash. I know some of the cleartext URLs on the list, like sex.com, youporn.com or rotten.com. I tried calculating all kinds of variants of those domains, like with or without http , www or trailing slash but apparently they don't use plain sha1 hashes. Already tried to load up everything in ollydbg and IDA and setting breakpoints, but I don't know ASM and can't figure out how this works. It would be awesome if someone thinks this is interesting and worth a look I uploaded the dll file, the blocklist and the stuff the ddl reads from the registry here http www.shost.ch uploads 1400682917.zip 145kb zipped . The free filter software itself is about 17mb and can be downloaded here https tinyurl.com nqpfy8w I guess not in English though . submitted by bankan link 1 comment
Les mots clés de la revue de presse pour cet article : internet
Les videos sur SecuObs pour les mots clés : internet
Les mots clés pour les articles publiés sur SecuObs : internet
Les éléments de la revue Twitter pour les mots clé : internet
Les derniers articles du site "Reverse Engineering" :
- An infection by malware such as BlackEnergy on any vital infrastructure system has the potential to be catastrophic
- BestDatingSite CLICK IneedSEEEX for ReverseEngineering
- Triton DBA framework - Version 0.3 is out with a new design
- Reverse engineering Google Nest Devices
- Reversing the Dropcam, Part 3
- X-Post r theinternetofshit Hardsploit-The essential security auditing tool for Internet of Things devices you'll need in your toolbox
- PhishXposed Online service that analyzes suspicious Emails and facilitates the quick detection of phishing emails and malicious attachments.
- 22 Ransomware Prevention Tips The State of Security
- Love your country, but never trust its government
- You Compiled This, Driver. Trust Me .
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
