MonkeHacks #53

Reverse Engineering, Workshop, London

Author

Monke
February 22, 2025

MonkeHacks #53

It was a pretty hectic week! I improved my automation codebase further with some design patterns, reversed a Java application, found a ton of bugs with rez0 and archangel, and travelled down to London, where I met up with green-jam.

It’s been an interesting month - March is also shaping up to be busy. Anyway, onto the main content.

Hanging out with green-jam in London!

Weekly Ideas / Notes 

  • I switched my workout program this week from 5×5 strength training to more hypertrophic training that target specific muscle groups. I also started tracking my nutrition properly. This feels like the next step up for my training goals. Given that I need to rest my finger injury, I’ll likely replace my 2/2 bouldering/gym routine with 1 day in the bouldering place and 3 days or 4 days in the gym. As someone who’s been a scrawny half-Asian dude all my life, this feels like a big step forward for me.

  • I reworked my automation again. This time I made a big structural change - I put each service into its own file like services/subfinder.go. The logic remained the exact same, so this didn’t take too long to do. The service is now an interface, and each new service must implement certain methods and follow a particular specification I wrote. This is much more organised than before - not only can it be boilerplated a lot more easily, but adding new services has become as simple as creating that file and adding the file to the registry of services. The rest of my code (database handling, queueing, etc) is abstracted enough to automatically handle new services if they follow the spec. I feel like I learned the why behind certain coding design patterns.

  • I spent a day reverse-engineering an old Java application with Mikey96. Mikey drove to Edinburgh so we booked a meeting room in the WeWork and did some research. It was a real classic scenario - Mikey identified a particular exposed dashboard of something with no real impact, so we figured out what it was running. The platform had locked downloads behind licensing, but I figured out that the download URLs themselves weren’t requiring authentication, so I found a few on Github for some of the software downloads that we needed. The API was also verbose and gave me some download URLs as well, even though the UI stated that a license purchase was required to get the downloads. I used jadx-gui to reverse-engineer the Java source code, but unfortunately the functionality was too limited to find anything substantial on the first day. It was nonetheless a very cool experience.

  • Towards the end of the week, I took the train down to London. The train journey was 5 hours long; I think two or three hours is the sweet spot for train journeys. I met up with green-jam for dinner on Friday. Greenjam is the HackerOne Ambassador for the UK alongside njcve_.

  • I’ll be giving a workshop titled “Client-side Hacking With Devtools” at Bsides Dublin on May 24! It won’t be too complex - I’m hoping that it’ll be a good primer for people looking to get into client-side hacking.

Resources