Morocco-CNSS App Fully Decrypted – Static Analysis & All Security Layers Bypassed
by darkMods - Saturday July 5, 2025 at 01:29 PM
#1
[Image: ?u=https%3A%2F%2Ftse1.mm.bing.net%2Fth%2...67d6b8f2b2]

MaCNSS Full Static Analysis – Security Layers Fully Compromised

Crypto & Obfuscation defeated:

XOR obfuscation broken using key: "hox_11_55_99"

AES-CBC encryption logic traced (AES/CBC/NoPadding)

SHA-256 integrity checks removed

Base64-encoded keys and payloads decoded

Obfuscated strings dynamically decrypted from smali_classes3


Security protections bypassed:

Talsec SDK (Root, Emulator, Debugger, Hook detection neutralized)

Frida & Debugger detection defeated (TracerPid, isDebuggerConnected, dynamic hook checks)

Certificate and signature verification logic disabled

Device binding fingerprint check bypassed

Firebase Messaging security logic reverse-engineered


Recovered secrets:

Firebase config + messaging topics

Internal API endpoints including auth token exchanges (/openid-connect/token)

Hardcoded flags: privilegedAccess, installNonMarketApps, FLAG_WINDOW_IS_OBSCURED

Internal session flow, X-device-id, and auth tokens from React Native bundle

Final Note: Static protections (AES, XOR, SHA) and dynamic protections (Frida, Talsec) were all bypassed.
Application is now fully reverse engineered and vulnerable to logic abuse and API abuse.

FILE 2
https://t.me/darkmodsBOARD/
Reply
#2
Hello , where is the database ? we need the excel file, thanks
Reply
#3
Wow is it after the last app update?
Reply
#4
Wow is it after the last app update?
Reply
#5
thanks
Reply
#6
merci
Reply
#7
(05-07-25, 01:29 PM)darkMods Wrote: [Image: ?u=https%3A%2F%2Ftse1.mm.bing.net%2Fth%2...67d6b8f2b2]

MaCNSS Full Static Analysis – Security Layers Fully Compromised

Crypto & Obfuscation defeated:

XOR obfuscation broken using key: "hox_11_55_99"

AES-CBC encryption logic traced (AES/CBC/NoPadding)

SHA-256 integrity checks removed

Base64-encoded keys and payloads decoded

Obfuscated strings dynamically decrypted from smali_classes3


Security protections bypassed:

Talsec SDK (Root, Emulator, Debugger, Hook detection neutralized)

Frida & Debugger detection defeated (TracerPid, isDebuggerConnected, dynamic hook checks)

Certificate and signature verification logic disabled

Device binding fingerprint check bypassed

Firebase Messaging security logic reverse-engineered


Recovered secrets:

Firebase config + messaging topics

Internal API endpoints including auth token exchanges (/openid-connect/token)

Hardcoded flags: privilegedAccess, installNonMarketApps, FLAG_WINDOW_IS_OBSCURED

Internal session flow, X-device-id, and auth tokens from React Native bundle

Final Note: Static protections (AES, XOR, SHA) and dynamic protections (Frida, Talsec) were all bypassed.
Application is now fully reverse engineered and vulnerable to logic abuse and API abuse.

FILE 2
https://t.me/darkmodsBOARD/

thaaaaanks
Reply
#8
Thanks
Reply
#9
(05-07-25, 01:29 PM)darkMods Wrote: [Image: ?u=https%3A%2F%2Ftse1.mm.bing.net%2Fth%2...67d6b8f2b2]

MaCNSS Full Static Analysis – Security Layers Fully Compromised

Crypto & Obfuscation defeated:

XOR obfuscation broken using key: "hox_11_55_99"

AES-CBC encryption logic traced (AES/CBC/NoPadding)

SHA-256 integrity checks removed

Base64-encoded keys and payloads decoded

Obfuscated strings dynamically decrypted from smali_classes3


Security protections bypassed:

Talsec SDK (Root, Emulator, Debugger, Hook detection neutralized)

Frida & Debugger detection defeated (TracerPid, isDebuggerConnected, dynamic hook checks)

Certificate and signature verification logic disabled

Device binding fingerprint check bypassed

Firebase Messaging security logic reverse-engineered


Recovered secrets:

Firebase config + messaging topics

Internal API endpoints including auth token exchanges (/openid-connect/token)

Hardcoded flags: privilegedAccess, installNonMarketApps, FLAG_WINDOW_IS_OBSCURED

Internal session flow, X-device-id, and auth tokens from React Native bundle

Final Note: Static protections (AES, XOR, SHA) and dynamic protections (Frida, Talsec) were all bypassed.
Application is now fully reverse engineered and vulnerable to logic abuse and API abuse.

FILE 2
https://t.me/darkmodsBOARD/
Reply
#10
thanks, can you upload the file 
i remember it was on breachforums for free
Reply


Forum Jump:


 Users browsing this thread: 2 Guest(s)