Collaborate Disseminate
I’ve been studying heap exploitation on Linux/macOS for learning purposes.
Many of the generic exploits on macOS rely on brute-forcing the 4-bit checksum derived from the rack’s cookie value. This effectively results in a 2^… Continue reading Why isn’t the checksum length increased on macOS to mitigate generic heap exploitation?
I am researching this bug here, where the first line of an arbitrary file can be leaked by triggering a SyntaxError using the compile() function.
Is there a method of leaking the rest of the file, such as similar to the way… Continue reading Leak multiple lines from file
From my understanding a typical way to achieve SEP buffer overflow (ignoring protections like DEP, SafeSEH, etc.) is to overwrite SEH with POP POP RET which goes back to nSEH which we control. nSEH will then be used to point … Continue reading Why can’t you jump from SEH straight to payload for SEH buffer overflow?
Can somebody advise how to exploit this use after free bug on a high level, if this is even possible? Low level (detailed advice) would also be great.
How to obtain code execution here?
The bug is simulated and this is do… Continue reading Obtaining code execution from use after free?
I’m trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses strcpy, so I cannot overwrite the $ra re… Continue reading buffer overflow in MIPS – jump to address 0x0040xxxx
Could someone tell me when or in which paper was introduced for the first time the concept of “exploit primitive” in binary exploitation? For primitive, I mean write-what-where concept, for example.
I want to apply for a job as a penetration tester in a good company. I have a fairly good knowledge of programming and have experience as a back-end developer.
I started to work with Burpsuite, ZAP, Metasploitable2, Juicesho… Continue reading How to get gain the knowledge to be a beginner penetration tester on my own? [on hold]
Some background:
I obtained an Msc degree in scientific computing 7 years ago.
Since then I’ve been working in government IT as an IT / business analist.
My exposure to enterprise IT is mostly conceptual from discussions with… Continue reading Learning path to more advanced security knowledge? (security in OS-context mostly) [on hold]
I am trying to practice buffer overflows on vulnserevr but I am running into an issue with the fstenv CPU instruction overwriting the start of my payload.
All the blogs etc that I can find mention using a NOP sled in order t… Continue reading fstenv CPU instruction interfering in buffer overflow
I’m working on an exploit development challenge right now in which I’ve been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ASLR is disabled. I’ve writ… Continue reading Remote Buffer Overflow w/out Memory Leak