XOR Known-Plaintext Attacks

In this blog post, we show in detail how a known-plaintext attack on XOR encoding works, and automate it with custom tools to decrypt and extract the configuration of a Cobalt Strike beacon. If you are not interested in the theory, just in the tools, go straight to the conclusion 🙂 . A known-plaintext attack … Continue reading XOR Known-Plaintext Attacks →

attack attacks beacon blog blog post blue team cobalt cobalt strike configuration continue cryptanalysis decrypt encoding extract forensics plaintext plaintext attack strike theory tools xor