DEV Community: The Black Mamba🔥

🚀 📸 Creating Accessible and Stunning code screenshots

The Black Mamba🔥 — Sat, 31 Aug 2024 16:58:21 +0000

Code Screenshots are a great way to share code snippets in social media, but often times they are not accessible, or the snippet needs to be hosted on some other site and link them.
With code keep, you can create snippets, and add detailed descriptions, and customize and create a screenshot out of it.

Let's see how can we do that.

Steps

Create an account on https://codekeep.io
Add a snippet
Hover over the snippet and click on the screenshot icon, it will take you to https://codekeep.io/screenshot with your code snippet
Click on link and copy the link to the code

Now you can share your custom screenshot with an accessible link to the code snippet.

You can also embed the code snippet on your site by clicking the share/embed button and copying the iframe code

📖 Case Study: ⚙️ Reverse Engineering using Node JS 👾

The Black Mamba🔥 — Sat, 02 Nov 2019 19:15:07 +0000

⚠️ 🚧 Warning!! : This post is about reverse engineering

Back in the old days, there used to be pirated version of software/games which were available on the torrent. All these software/games came with an nfo file, which can be opened in notepad that contains instructions on how to crack the game/software, and along with that came the keygens/patch/cracks. a small application with dope music....🎼

🏁 The Intro

When you click on the patch it will do some magic and you open the software it will be licensed.
Out of curiosity, I searched for a random app with a subscription to test, which had a trial version. I am not going to disclose the software here and will be focusing only on the methods that I used to crack the software.

🧠 How the software worked
The software checks the license every-time it starts and then redirects to the application, so every-time you open the software it presents you with a login screen where you enter your credentials and it redirects to the dashboard.

🐾 Starting Point
Initially my experience with MITM Attack(Man in the Middle) came to the rescue. Basically MITM is an agent that acts as a proxy, which means all the requests and responses will pass through the agent. I used Charles Proxy which can be used as a proxy for an MITM attack.

Normal Flow: The software connects to the server directly

👨🔄🌐.

MITM: The software connects through the proxy and we will be tapping the request and response that the software is making.

👨🔄🧟🔄🌐

Imagine the green witch as Charles Proxy.

I started analyzing the requests that the app is making using Charles Proxy and found that the app is making a request to the http://domain.com/api which contained a large json about the license details, I looked for a clue and it had a json key called "days_left" so if I could change the response, I can control my subscription and use the software to set any end date.

Majority of windows applications will be running on top of .net framework and will have the helper functions in the DLL file, I was thinking a way around and found dnsspy , a tool which can show you contents of the library file. I searched for the API endpoint in the DLL files after importing them to dnsspy, and found the url in a constants file.

🗞️ Next Plan
Next steps are very easy, we have the modified json response with days_left set to 999999999 and also the API endpoint URL from the DLL file.
What next
Step 1: I wrote a simple node.js script which returned the modified response whenever the API endpoint is called.
Step 2: I changed the endpoint in the DLL to point to my script ie: http://localhost:9000

I replaced the original DLL file with the modified one!! And voila it worked!!!

💬 Connecting the dots
Some of the software's can easily be hacked by changing a few lines, for eg, if the library is having a function that returns whether the license is valid or not, then we can change it to return true always. This depends on the level of security that the developer has incorporated into the software.

🛠 Fixes that I can think of to prevent this attack

Transport data over HTTPS (It doesn't solve this issue, but while inspecting the payload (information that is sent out by the app), the attacker won't be able to see the payload, unless he installs a remote certificate.
Rather than relying on the json data, use some cryptographic algorithms to decrypt/encrypt the data (the attacker still has access to client code, from which he can find the decryption logic and apply it on the payload to get the value and replay the same)
SSL Pinning to prevent the connection to other endpoints (did it during android development)

If you have any more suggestions, please let me know in the comments.

Being truly "secure" is a myth.

Disclaimer: This is for educational purpose only

Thanks for reading!!

➕ GIT: ⏬ Pulling from a different repository.

The Black Mamba🔥 — Fri, 01 Nov 2019 19:01:48 +0000

Recently while working on a freelance project, i came across an interesting scenario where the previous developer has maintained 2 repositories, one in gitlab and the other in heroku.

The gitlab account is a repository to hold the code, and the heroku repository is linked to the build pipeline. i have made changes to the gitlab repository and the changes needs to be made to the master branch of heroku repository.

This is a scenario which i have never encountered before. After some investigation i found out that, you would do this when you want to create a new app from the same base or core (that's meant to be its purpose, but the scenario here is different).

Coming to the solution,

Add the other repository as a remote
git remote add upstream https://www.gitlab.com/something/somrepo.git
(upstream refers to the gitlab repository)
Now the two remotes will be shown (Screenshot from Source Tree)
Now pull the changes from master branch of gitlab repository to heroku.
git pull upstream master
Push the changes to the repository , now your heroku branch will have all the changes from the master branch of gitlab.

🚀#2 Made an OpenSource Markdown Editor ✨(PWA+Electron+Angular+Indexed DB)🎉.

The Black Mamba🔥 — Fri, 04 Oct 2019 17:03:02 +0000

This is my second opensource project, after Paper ,which is a note-taking app with "networkless" sharing.
You can check out the app here.
Paper

About Markdown Editor,

i have posted an article about paper on dev.to and also made a listing on product hunt. From the feedback that i got from fellow developers i made a standalone WYSIWYG markdown editor.

Thanks to Ilya Lesik for providing the idea for a markdown editor, and to Quintus Cardozo for this comment.

Quintus Cardozo • Sep 22 '19

Looks great. Have you looked I to Index DB to increase the storage space for notes

This projects uses indexed db for larger storage space, and i have decided to go with pwa and electron so it can be used as a native app.

Markdown Editor

Support on ProductHunt

Features

👆One Click Licence, Contribution Guidelines Export

💾Load and Save Markdown to Indexed DB

🚀Copy/Download Markdown with one-click

🌟Auto Save for Markdowns

🌓Dark/Light Mode

🎎Resizable Split UI

✨Assist for Inserting Images/Link

🚅Save Frequently used Contributing Guidelines/Contributors/Licence on to local storage

📬Opens the recent file, that you were editing on resuming

⚛️ Electron & PWA app for offline use

🔌 No Internet

📖 OpenSource

If you like this project, ⭐️ star on github/ follow me on twitter to get my project updates.

🍻Feel free to contribute to the project/provide feedback regarding the project.

🚀Made Paper , an offline note taking app with a "networkless" share option.🖥️🔄📱

The Black Mamba🔥 — Sun, 22 Sep 2019 07:13:33 +0000

Paper is created by me and

Jijin P 👨‍💻🦄Follow

👨‍💻Fullstack Developer ⚡️ ✨Laravel ExpressJS 🤘🏻 ⚛️ReactJs VueJs 💻NodeJS PHP 🔥 Firebase 🦄

What lead to the creation of Paper?
The idea to create paper came out when we both were working on a side project and wanted to share text/links between our 🖥️🔄📱computers/mobile, thanks to BSNL (Indian Broadband Network) and its fluctuating internet connectivity, we thought of working on an offline note sharing application leveraging local storage and QR code.

✅ Live Preview: https://paperapp.now.sh

Pros
🔥 PWA Based
📖 OpenSource
⛓️ Easy Share
🔌 No Internet
🖥️ LocalStorage
📠 Share through QR
🌗 Dark/Light Theme
🖥️🔄📱Ideal for sharing between PC and Mobile / Mobile to Mobile

Cons
💾 Limited Storage
📳 No Web Based Sharing/Storage
🐘 Large texts are not supported
📷 Sharing depends on camera and depends on camera quality and background lighting
🖥️🔄🖥️ PC-PC Sharing is tough to achieve as you don't want to move your laptop and point it at another one 🙄. Well you can do a 🖥️🔄📱🔄🖥️

Paper is a PWA made with Angular,It uses local storage for storing notes, so you can't store more than 10 MB of notes, and sharing of large text via QR is not supported (seems to be a issue)
it uses QR code for sharing the note between devices.

If you like this share it/follow us on twitter, star this on github

// Detect dark theme var iframe = document.getElementById('tweet-1175447635970248704-620'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=1175447635970248704&theme=dark" }

JP1016 / Paper

🚀A "no-cloud" note taking app with "networkless" sharing. https://paperapp.now.sh

Paper

🚀A "no-cloud" note taking app with "no-network" sharing.

✅ Live Preview: https://paperapp.now.sh

Made with ❤️ by

Features

🔥PWA Based

📖 OpenSource

⛓️ Easy Share

🔌 No Internet

🖥️ LocalStorage

📠 Share through QR

🌗 Dark/Light Theme

🤝 Contributing

Contributions, issues and feature requests are welcome! 😍

Show your support

Give a ⭐️ if this project helped you! 🥰

If you like this app , Star it on Github, Follow me on Twitter

Icons made by Smashicons from www.flaticon.com

View on GitHub

Upvote on Product hunt
https://www.producthunt.com/posts/paper-6/

🤝 Contributing
Contributions, issues and feature requests are welcome! 😍

📱 Two Faces of Google 🌗 Crackdown of CamScanner,UC and Cheetah 🚫

The Black Mamba🔥 — Fri, 06 Sep 2019 17:48:41 +0000

Recently, CamScanner has been discovered with an adware by Kaspersky, and it has been removed from the play store by google, but the company blamed it on their ads partner and now the app is back in store!!
This is not the first time a popular app is getting penalised by google.

On November 2017,

UC Browser has disappeared from the Google Play store. The Alibaba-owned mobile browser, which garnered more than 500 million downloads last month and has over 100 million users in India, is no longer visible on search - though other UCWeb applications - UC Browser Mini and UC News - still are. The development emerges months after the Chinese app had been accused of sending personal data of its Indian users to a server in China, and it's unclear for now what the reason for the removal is.

On December 2018

If you were, for some reason, hoping to download CM File Manager or Kika Keyboard, I have some bad news. A report last week claimed that Cheetah Mobile and an associated company called Kika Tech were engaged in some shady advertising practices, and now Google has responded. These two apps have been suspended from the Play Store, and Google may still take further action.
App analytics firm Kochava claimed last week that Cheetah Mobile and Kika both engaged in so-called "click fraud" by claiming credit for app installs even when they didn't show an ad. Cheetah Mobile blamed a third-party SDK for the issue, but Kochava says Cheetah develops the offending SDK. Google initiated an investigation following the report and has removed CM File Manager (cache) and Kika Keyboard (cache). Cheetah Mobile's file manager had more than 50 million downloads, and the keyboard was north of 100 million. Cheetah Mobile also voluntarily removed its Battery Doctor and CM Locker apps from the Play Store following the initial report.

.....and guess what???

All these apps owned by big companies have successfully made its way back to the app store.

Now coming to the other side,

Normal Publishers has to write a blog and if its gets enough coverage, it will get noticed by the team and they will restore it (if it doesn't violate any policies).

Google has terminated my activities and Google Play Developer Account
https://medium.com/@julianinho/google-has-terminated-my-activities-and-google-play-developer-account-7a89e6699f07

Google just deleted my nearly 10-year-old free & open-source Android app
https://medium.com/@mmathieum/google-just-deleted-my-nearly-10-year-old-free-open-source-android-app-7fbc52edc50a

These are some of the instances where indie developers accounts were banned for little/no reasons, and the biggies who got multiple strikes are having their accounts live. According to google, 2-3 strikes is all that needed to ban an account , still these big apps survives.

Recently,Youtube has also been accused of favouring celebrity channels and bend their rules for them, and google denied it

Share your thoughts!!