Collaborate Disseminate
I have a Rust-app executing Python-scripts using PyO3. The Python-scripts are uploaded by users, so I need to check for unsafe code before executing it. The scripts should only be able to do mathematical operations and in no case should ac… Continue reading Filter arbitrary code for blacklisted keywords except on commented lines
I have a Rust application receiving a lot of data. The programmer can make different Python files to test different algorithms on that same data. He uploads the Python file and in Rust the Python-file is executed using PyO3.
So the purpose… Continue reading Securing arbitrary code execution in Rust
Is it possible to write small application logic (for example 4 KB) on a TCP packet? like for example a simple logic that just sends back "Hello" to the IP address (user) who wrote a specific command like "Summon Hello" … Continue reading Writing small application logic directly on a TCP packet
I am trying to do a go program to execute a .exe file, but without be actually a .exe file. The idea is to read the executable from a .txt file and decode it (it is in base64). Once I hava that code stored in a variale, I want to execute i… Continue reading execute command in go without storing the command in a .exe file
I currently got interested in binary exploitation (even though I do not know if today is still useful).
I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know that this vulnerability is nowadays rare… Continue reading Unable to execute shellcode on x86_64 architecture
I’m the attacker. What are all the options to run code at the Windows startup:
If I have administrator rights?
If I have normal user rights?
Can someone put any program (or script) in this method or it needs to have some kind of Windows … Continue reading What are all ways to run code at Windows startup?
I’m looking for a way to exploit CVE-2019-11500. Here’s how it’s described: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for strings in quotes. This happens because the ‘… Continue reading Help creating an exploit for CVE-2019-11500
I used Didier Stevens’s pdfid.py to check a pdf, and it found js and automatic actions associated with the pdf:
How do I check if this is malicious code?
Computers connected to networks are constantly threatened by attackers who seek to exploit vulnerabilities wherever they can find them. This risk is particularly high for machines connected to the Internet, …read more Continue reading Arbitrary Code Execution Over Radio
I read a lot of reports where ‘hackers’ potentially exploited a ‘Hidden HTTP Parameter’. There are also tons of tools which are developed for this exact purpose.
Example : https://blog.yeswehack.com/yeswerhackers/parameter-discovery-quick-… Continue reading What exactly are Hidden HTTP Parameters?