Collaborate Disseminate
I am doing corelan course tutorial #2 . I am improving a lot quickly, but I would to know something about this course , I know it’s based on windows xp, but I am mixing a bit with windows 7 CVE stack overflows depending on th… Continue reading Corelan free course / exploit development to modern exploit development
I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc.
However, I don’t see how to exploit an executable simultaneously protecte… Continue reading Methods of exploiting a Windows executable protected by "Control Flow Guard" and "Return Flow Guard"?
OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help explain if it would make se… Continue reading When to perform secure code review?
I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions.
Usually, the function’s .plt entry should (lazy) resolve the function on first invocati… Continue reading How to disable .got.plt protection using GCC on Ubuntu 18.10?
Most of my questions were answered in this post ASLR bypass with info leak
However, I just want to know the process of getting the memory address from the information leak to then using it in the final exploit.
It seems to … Continue reading Bypassing ASLR using information leaks
I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?
# Return Address for W… Continue reading Exploit Development on windows environments
We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app.
So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, device setting, contacts… Continue reading Can an attacker spoof content provider, backup manager or wallpaper manager in Android?
There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube.
Why are there no write-ups on macOS exploitation techniques, taking into account th… Continue reading Why are there no free resources on exploit development on macOS? [on hold]
I’m trying to exploit the following code with a buffer overflow and make it run the overflowed function:
#include <string.h>
#include <stdio.h>
void overflowed() {
printf(“%s\n”, “Execution Hijacked”… Continue reading Problem with overwriting the return address (buffer overflow)
I used msfvenom to generate cmd reverse shell, but I need to run without creating .vbs file on the disk. How can I do that with mshta?
mshta vbscript:Execute(“MsgBox(“”amessage””,64,””atitle””)(window.close)”)
My code: