Hack Like a Pro: The Basics of XORing « Null Byte :: WonderHowTo

Welcome back, my novice hackers!In a recent tutorial, I showed youhow to use shikata_ga_nai to change the signature of a payload to evade detectionby security devices (firewalls, IDS, etc.) andAV software.Shikata_ga_nai is an encoding module inMetasploitthat XORs the payload through multiple iterations (the number of iterations is up to you), thereby changing the payload's signature. When the payload bypasses the security devices and the AV software, it then reverses the XORing and the payload is executed normally on the victim's system.From the questions and comments I received on that guide, it became apparent that not all of you are familiar with this concept of XOR. This guide is dedicated to those of you who are not familiar with this common technique in information technology, and as refresher for those who are.What Is XOR?XOR stands for eXclusiveOR. In logic and in everyday language, an OR can mean thateitherstatement is true orbothare true. In other words, the statement will evaluate to true if any of the statements are true. So, if I say, "The sky is cloudy OR the sky is blue," it will evaluate to true if either statement is true or if the sky is blue AND cloudy.The exclusive OR makes a distinction between these two and means only the case where one of the two statements is true. It is used throughout computing for numerous purposes, including the encryption of the payload using shikata_ga_nail, error checking, and setting parity bits on a RAID, among many other things.As you know, computers operate with millions of on/off switches. Modern computers uses transistors to operate these on/off switches, but of course, early computers used vacuum tubes and any on/off switch would suffice.These on/off switches are represented by a single bit that is often represented by ano. That bit can be on or off. If it is off, it is represented with a0(zero) and if it is on, it is represented with a1(one). Additionally, the 0 represents false and the 1 represents true. It might help you to remember this by thinking of the question, "Is the switch on?" True if it is "on" (1), and false if it "off" (0). Hope that helps.Boolean AlgebraBoolean algebra is the algebra of statements that evaluate to either true or false. This is useful in computing because we can represent these two states (true or false) by a single bit. When the statement is false, it is represented by a zero (off) and when it is true it is represented by a one (on).Truth TableIn logic and computing, we often use what are known as truth tables. These truth tables represent all the possible cases and whether they would evaluate to true or false, hence the name "truth tables". In the case of XOR, there are only four possible cases as illustrated below.Note that whenever the two inputs are thesame(00, 11) they evaluate to false. whenever the two inputs aredifferent(10, 01) the XOR evaluates to true. So, to summarize, same is 0 and different is 1.XOR CipherThe XOR cipher is a relatively simple cipher that encrypts the input by using a key that is then XORed against the input to create an output. For example:One of the advantages of the XOR cipher is that it is simple and fast. In addition, it does not need a separate algorithm to decipher it, as all systems can XOR. This is why it works so well in Metasploit's shikata_ga_nai encoding.XOR in RAIDSXOR is used in RAID levels 3–6 for creating parity information. RAID 1 is mirroring the hard drive, which means we need twice as many drives (and cost) to create fault tolerance. On the other hand, parity information is used to make certain that if one drive fails, the original information can be recovered. In this way, the RAID has fault tolerance without a huge additional expense.For example, a RAID can assure the recovery of bytes 10011100 and 01101100 from two (or more) hard drives by XORing these bytes, resulting in (11110000) and writing it to another drive. In a RAID 3 arrangement, this is a separate drive. In a RAID 5 arrangement, as illustrated above, the parity is interspersed among the drives.Under this method, if any one of the hard drives are lost, the lost byte can be recreated by XORing bytes from the remaining drives. For instance, if the drive containing 01101100 is lost, 10011100 and 11110000 can be XORed to recover the lost byte.XOR in Error CheckingXORing is also implemented in CRC, or cyclic redundancy check, a common method in computing to detect whether any accidental errors have entered the data. CRC is used for error checking in TCP, hard drives, cell phones, and nearly every other type of data transmission. Although the mathematics are beyond the scope of this tutorial, suffice to say that at least, in part, CRC uses XOR.I hope this short tutorial on XOR is helpful and enlightening to my novice hackers, as XOR is used throughout IT and hacking. It is especially important in exploit and payload obfuscation to avoid detection by security devices and AV software.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Security-Oriented C Tutorial 0xFC - A Simple XOR EncryptorHow To:Use the basic logic tools in LittleBigPlanet 2News:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Make a 4 Input XOR-Gate in MinecraftHow To:Security-Oriented C Tutorial 0xFA - Enhancing Our CrypterHack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHow To:Find 3D Snapchat Filters for New Effects with Your iPhone's Face ID CameraNews:The 5 Best Apps for Scanning Text & Documents on AndroidHow To:Start editing video projects in Adobe Premiere Pro CS3Review:My 6 Months Using the 12.9-Inch iPad ProHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterHow To:Get All the New iPad Pro Wallpapers on Your iPhoneHow To:This Quick & Easy Shortcut Minces Garlic in SecondsHack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)News:You Can Get a OnePlus 7 Pro with INSANE Specs for the Price of theXRor S10eHow To:Get LED Color Effects for Music Playing on Your AndroidHow To:Flip a Clip in Final Cut Pro X 10.1.2How To:You Can Easily Hack Instagram for a Crazy Amount of Likes (But You Totally Shouldn't)How To:Export video to the web with Final Cut ProTHE FILM LAB:Intro to Final Cut Pro - 03THE FILM LAB:Intro to Final Cut Pro - 02THE FILM LAB:Non-Linear Editing Basics, Final Cut Pro - Part 01Null Byte:Never Let Us DieHow To:The Official Google+ Insider's Guide IndexHow To:Shellcoding Tutorial, Linux x86 Part 1Redstone Logic Gates:Mastering the Fundamental Building Blocks for Creating In-Game MachinesNews:Skater Dolly EssentialsNews:Automatic Editing App V.I.K.T.O.R. Is So Much Fun You'll Want to Shoot Even More VideoNews:HackingNews:What does Pro Tools HD Native mean for you?News:SEO - Ugly Vs Popular - Just Like Highschool!News:Bricked iPad Pros, Error 56, & How to Fix