I'm Building a Browser for Reverse Engineers
In the expanding world of AI my heart still lies in AST transforms, browser fingerprinting, and anti-bot circumvention. But my workflow felt... primitive.
nullpt.rs • blog
Latest posts
Reverse Engineering Vercel's BotID
Vercel recently announced BotID, an anti-bot meant to protect against bots without requiring manual intervention. This post reverse-engineers the script and takes a peek inside.
Forging Passkeys: Exploring the FIDO2 / WebAuthn Attack Surface
Passwords are dying and passkeys are taking over. In this post we tear apart WebAuthn and build our own software FIDO2 authenticator from scratch.
Breaking the 4Chan CAPTCHA
In this blog post, I will talk about my successful experiment in machine learning using TensorFlow to automate solving the 4Chan CAPTCHA.
Hacking GTA V RP Servers Using Web Exploitation Techniques
FiveM provides a powerful framework to create game experiences not otherwise possible in Grand Theft Auto. However, this power can be abused by attackers through the use of XSS in vulnerable NUI resources.
Compiling a Custom Browser to Bypass Anti-Bot Measures
In this blog post, I will be documenting the journey veritas and I took to extract the AES keys and browser flags/fingerprint from the Supreme anti-bot system.
Evading JavaScript Anti-Debugging Techniques
Debuggers serve as invaluable tools that empower developers to halt code execution and thoroughly analyze its behavior at any given moment. By utilizing debuggers, developers can efficiently identify and resolve issues within their code, making it an indispensable part of their toolkit.
Devirtualizing Nike.com's Bot Protection (Part 2)
Last time, we went over performing string extraction on the VM, and scratched the surface of analyzing the execution itself. However, this leaves the significant problem of actually devirtualizing the bytecode. For instance, we mentioned that individual strings are difficult to extract in a static manner—as specific values of the instruction pointer are required—but this difficulty also applies to…
Devirtualizing Nike.com's Bot Protection (Part 1)
In this blog post, we'll examine the virtualization obfuscation used by Nike
Reverse Engineering Tiktok's VM Obfuscation (Part 1)
TikTok has a reputation for its aggressive data collection. The platform has implemented various methods to make it difficult for reverse-engineers to understand exactly what data is being collected and how it is being used.
The Modernization of the Latrine
It's no question that bathrooms are a necessity for a business to accommodate their customers. However, a question stands- how much do these bathrooms really accommodate people?
Tackling JavaScript Client-side Security (Part 1)
Jscrambler, a leader in JavaScript Client-side security makes claims to “Bullet-proof your Web Application in 2 minutes” but what have they done to make these claims? And does it really bulletproof your application?
Anatomy of a Supreme Bot (Part 3)
What happens when we checkout an item that’s out of stock? Only one way to find out.
Anatomy of a Supreme Bot (Part 2)
The ultimate goal of a bot is to make it to checkout. Let’s get started on that!
Anatomy of a Supreme Bot (Part 1)
The Supreme bot market has become flooded with bots. They all do the same thing and claim to be better than the next. How do they work exactly? Good question.