Collaborate Disseminate
Consider the following simple C program that asks the user for to input their user name and password in order to get access to some website. (The correct username is supposed to be "admin" and the password is a secret random numb… Continue reading How to do a bufferoverflow attack for a simple C program?
I’m testing the following /event/insert API endpoint which I believe may be vulnerable to a MongoDB injection. Specifically, I’m concerned about any/all injections that would overwrite or delete records in my Mongo location_history collect… Continue reading Is this vulnerable to a nosql injection?
I am currently trying to perform a return-to-libc attack against a locally run program. Here are the steps I did:
I calculated the bytes needed to overwrite the saved return address
I used a buffer overflow to overwrite the saved return … Continue reading Ret2libc exploit not working but it seems correct in GDB
I’ve been solving some CTFs lately, but I only do web challenges since I want to become a pentester/security researcher. Are there other categories like crypto or reverse engineering (or pwn or misc) that might benefit me in my technical … Continue reading What CTF categories (besides web) are useful for getting a pentesting job? [closed]
I want to exploit this python code (pycryptodome library is used) using the known-plaintext vulnerability of AES in ECB mode:
def get_user_token(name):
cipher = AES.new(key=key, mode=AES.MODE_ECB)
name = name.encode(‘utf-8’).decod… Continue reading Exploit AES-ECB in json.dump() [closed]
I’m trying to develop a simple buffer overflow CTF challenge inspired by the "Csaw 2016 Quals Warmup" challenge, here. I’ve managed to replicate the source code:
#include <stdio.h>
#include <stdlib.h>
int easy(){
s… Continue reading Simple Buffer Overflow (Function Call) Problem
I’m stuck on a CTF exercise that has been quite difficult to get a grasp of. I have access to a server as a user. On this server, there’s only root other than me. I am supposed to access a file in root where I have no permissions or read t… Continue reading CTF assistance on linux privilege escape [closed]
What is the best way to get more information from the information-gathering stages/ reconnaissance when trying CTFs? Is there any workflow for a new cybersecurity student who knows some programming?
for example consider against virtual mac… Continue reading CTF or Bug Bounty info gathering workflows [closed]
I’m working on a CTF challenge that involves exploiting a double-free vulnerability to modify the value of a specific global variable, PASSWORD, in a C program. The program allows for custom memory allocation and deallocation within a pred… Continue reading How to Exploit Double-Free Vulnerability to Overwrite a Specific Variable in C?
I have found the padding payload to gain a buffer overflow. Now I need to execute the shellcode. I’m looking for a jmp rsp gadget but I haven’t found it. Can I directly put the rsp address manually or should I combine other gadgets (ASLR d… Continue reading No jmp rsp gadget in buffer overflow