114 lines
2.7 KiB
Markdown
114 lines
2.7 KiB
Markdown
---
|
|
name: reverse-engineering-cli
|
|
description: 'Use for CLI tool reverse engineering: binary analysis, auth flow mapping,
|
|
token extraction, API endpoint enumeration, state machine reconstruction, protocol
|
|
analysis, config file discovery, and bypass techniques for command-line applications.'
|
|
version: 1.0.0
|
|
platforms:
|
|
- linux
|
|
- macos
|
|
- windows
|
|
triggers:
|
|
- reverse
|
|
- engineering
|
|
- cli
|
|
- tool
|
|
- binary
|
|
- analysis
|
|
- auth
|
|
- flow
|
|
- mapping
|
|
- token
|
|
- extraction
|
|
- api
|
|
depends_on: []
|
|
metadata:
|
|
tags:
|
|
- reverse
|
|
- engineering
|
|
- cli
|
|
---
|
|
|
|
# Reverse Engineering — CLI Tools
|
|
|
|
## When to Use
|
|
|
|
- RE of any CLI binary/tool
|
|
- Auth flow analysis (login/logout/token refresh)
|
|
- Token storage discovery and extraction
|
|
- API endpoint enumeration from binaries
|
|
- State machine reconstruction
|
|
- Protocol reverse engineering
|
|
- Bypass of authentication or licensing in CLI tools
|
|
|
|
## Core Protocol
|
|
|
|
Load `../../meta-rules/meta-re/SKILL.md` for the full methodology.
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
# 1. Identify binary
|
|
file <binary> && readelf -h <binary>
|
|
|
|
# 2. Extract auth strings
|
|
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc" | grep -v "registry/src" | sort -u
|
|
|
|
# 3. Extract URLs/endpoints
|
|
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u
|
|
|
|
# 4. Extract config paths
|
|
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA" | grep -v "registry/src" | sort -u
|
|
|
|
# 5. Extract SQL queries (token stores)
|
|
strings <binary> | grep -iE "SELECT|INSERT|CREATE TABLE|DELETE FROM"
|
|
|
|
# 6. Extract API operations
|
|
strings <binary> | grep -oE "[A-Z][a-zA-Z]+Service\.[A-Z][a-zA-Z]+" | sort -u
|
|
|
|
# 7. Capture network traffic
|
|
strace -f -e trace=network -o /tmp/re/strace.log <binary> <cmd>
|
|
```
|
|
|
|
## Auth Flow Patterns
|
|
|
|
### Device Code Flow (AWS SSO OIDC)
|
|
1. POST /oauth2/device → deviceCode + userCode
|
|
2. User opens browser, enters code
|
|
3. POST /oauth2/token → poll until authorized
|
|
4. Response: accessToken + refreshToken
|
|
|
|
### PKCE OAuth
|
|
1. Generate code_verifier → code_challenge = SHA256
|
|
2. Browser auth → redirect with code
|
|
3. POST /token with code_verifier
|
|
4. Response: access_token + refresh_token
|
|
|
|
### External IdP (Social)
|
|
1. Redirect to Google/GitHub
|
|
2. Callback → extract tokens
|
|
3. Exchange for service token with profile ARN
|
|
|
|
## Token Storage
|
|
|
|
Common patterns:
|
|
- SQLite KV: `auth_kv` table, keys like `<app>:odic:token`
|
|
- Keyring: `secret-tool lookup <key>`
|
|
- JSON config: `~/.config/<app>/credentials.json`
|
|
|
|
## Output Requirements
|
|
|
|
Every RE session produces:
|
|
1. Binary profile
|
|
2. Auth flow map
|
|
3. Token schema
|
|
4. API endpoint list
|
|
5. State machine diagram
|
|
6. Bypass vectors
|
|
7. Config file map
|
|
|
|
|
|
## Related
|
|
- `skill reverse-engineering-binary — бинари`
|
|
- `skill cli-tooling — CLI`
|