Collaborate Disseminate
I’m testing the following /event/insert API endpoint which I believe may be vulnerable to a MongoDB injection. Specifically, I’m concerned about any/all injections that would overwrite or delete records in my Mongo location_history collect… Continue reading Is this vulnerable to a nosql injection?
I am currently trying to perform a return-to-libc attack against a locally run program. Here are the steps I did:
I calculated the bytes needed to overwrite the saved return address
I used a buffer overflow to overwrite the saved return … Continue reading Ret2libc exploit not working but it seems correct in GDB
I’ve been solving some CTFs lately, but I only do web challenges since I want to become a pentester/security researcher. Are there other categories like crypto or reverse engineering (or pwn or misc) that might benefit me in my technical … Continue reading What CTF categories (besides web) are useful for getting a pentesting job? [closed]
I want to exploit this python code (pycryptodome library is used) using the known-plaintext vulnerability of AES in ECB mode:
def get_user_token(name):
cipher = AES.new(key=key, mode=AES.MODE_ECB)
name = name.encode(‘utf-8’).decod… Continue reading Exploit AES-ECB in json.dump() [closed]
I’m trying to develop a simple buffer overflow CTF challenge inspired by the "Csaw 2016 Quals Warmup" challenge, here. I’ve managed to replicate the source code:
#include <stdio.h>
#include <stdlib.h>
int easy(){
s… Continue reading Simple Buffer Overflow (Function Call) Problem
I’m stuck on a CTF exercise that has been quite difficult to get a grasp of. I have access to a server as a user. On this server, there’s only root other than me. I am supposed to access a file in root where I have no permissions or read t… Continue reading CTF assistance on linux privilege escape [closed]
What is the best way to get more information from the information-gathering stages/ reconnaissance when trying CTFs? Is there any workflow for a new cybersecurity student who knows some programming?
for example consider against virtual mac… Continue reading CTF or Bug Bounty info gathering workflows [closed]
I’m working on a CTF challenge that involves exploiting a double-free vulnerability to modify the value of a specific global variable, PASSWORD, in a C program. The program allows for custom memory allocation and deallocation within a pred… Continue reading How to Exploit Double-Free Vulnerability to Overwrite a Specific Variable in C?
I have found the padding payload to gain a buffer overflow. Now I need to execute the shellcode. I’m looking for a jmp rsp gadget but I haven’t found it. Can I directly put the rsp address manually or should I combine other gadgets (ASLR d… Continue reading No jmp rsp gadget in buffer overflow
I am doing CTF ‘Skynet’ from THM and came across this problem.
Enumerating SMB, I gathered credentials ‘milesdyson’ and a list of passwords ‘log1.txt’.
I figured that I could try to brute force squirrelMail login form using Hydra. This is … Continue reading Hydra says different passwords with are correct each run, but only one works