Gill.Singh.A

A complete, A-to-Z reverse engineering teardown of a LockBit 3.0 (LockBit Black) ransomware sample — covering PE structure, encrypted sections, dynamic API resolution, polymorphic trampolines, custom cryptography, the leaked builder toolkit, and every anti-analysis trick packed into 146 kilobytes of compiled code. Prologue “Control is an illusion. The only thing that’s real is the code.” — Elliot Alderson, Mr. Robot A ransomware binary is engineered to be opaque. Every string encrypted, every API call hidden, every section entropy-maxed to resist static analysis. The developers assume you won’t look past the decoy imports and the noise. But binary analysis is a conversation — you ask the right questions, and the code has no choice but to answer. This post is the full transcript of that conversation with LockBit 3.0. ...

In this blog, I’ll walk through how I captured a WPA 4-Way Handshake from a nearby access point and cracked the password offline, using a wireless adapter in monitor mode, a deauthentication attack, and a custom wordlist built from a vendor’s default password pattern. Prologue “The world is a dangerous place, not because of those who do evil, but because of those who look on and do nothing.” — Elliot Alderson, Mr. Robot ...

In this blog, I’ll walk through how the STUN protocol and WebRTC can expose a caller’s real IP address during a WhatsApp call, and how I built a tool that captures STUN packets to extract and geolocate the other participant’s IP in real time. The idea for this came from reading Analyzing WhatsApp Calls by Schirrmacher, which breaks down the network-level behavior and low level workings of WhatsApp calls. That analysis made me want to build something that automates the entire process: from packet capture to IP extraction to geolocation, all in one tool. ...

In this blog, I’ll show how an unauthenticated Android Debug Bridge (ADB) port on a Smart TV gave me an instant root shell on the device, and how I turned that shell into a covert SOCKS proxy using chisel, routing my network traffic through a television set sitting in a room somewhere on the network. Prologue “The telescreen received and transmitted simultaneously.” - George Orwell, 1984 The smart TV in the corner of the room is always on, always connected, and always trusted. It sits on the network alongside everything else, pulling firmware updates, streaming content, phoning home to telemetry servers. Nobody monitors its traffic, nobody patches its firmware, and nobody thinks to ask what else it might be doing. Under the hood, it runs Android on a full Linux kernel, and if someone left its debug port open, you don’t need a vulnerability at all. You just need to connect. ...

In this blog, I’ll show how a single unauthenticated vulnerability in a Hikvision CCTV camera gave me not just a root shell on the device, but a covert network proxy, routing my traffic through the camera so every packet appeared to come from a surveillance device instead of my machine. Prologue “Quis custodiet ipsos custodes?” (Who watches the watchmen?) - Juvenal A CCTV camera’s entire purpose is to watch. It records everything in its field of view, day and night, trusting that nobody will turn the lens around. But nobody watches the watcher. Behind the lens is a computer, an embedded Linux system, with its own processor, its own network stack, and its own firmware. If that firmware carries an unpatched vulnerability, the device built to expose intruders becomes the perfect place to hide. ...