exploit | 易学教程

Does the ModelDriven interface poses a security explot in struts2?

阅读更多关于 Does the ModelDriven interface poses a security explot in struts2?

background: I coded a struts2 ActionSupport class with ModelDriven. It's a hibernate/spring web app, using OSIV and attached entities in the view (JSP). I received this email today from the architect 'punishing' me for putting an object that had a reference to an attached entity on the struts2 valuestack via the ModelDriven<E> interface. Is he correct or what? Obviously, this is a serious thing I am doing but I am not following what he is saying, and I really don't feel like taking up his offer and visiting him at his desk after this. oh boy. Time to change careers. --- from the architect ---

My php site was hacked by codes uploaded as image..?

阅读更多关于 My php site was hacked by codes uploaded as image..?

问题 Yesterday my site was comprised. The attacker changes the index.php file to their own (with all their glory messages and greet). I've notified the hosting company about this (we are running on a dedicated server), and on my part, I'm trying to fix anything that seems to be the cause, cause I'm still unable to point how exactly did our server was attacked, but I think I've found certain script-based loopholes that could possibly be the culprit. Our site has an image uploader form, but all

OSX malware and exploit collection (~100 files) + links and resources for OSX malware analysis

阅读更多关于 OSX malware and exploit collection (~100 files) + links and resources for OSX malware analysis

此文为关于MAC OSX系统的所有攻击脚本和溢出代码的收藏集。附带资源链接和相关讲解文档~mark下 'Tis the season. Here is a nice collection of ~100 Mac OS malware and Word document exploits carrying MacOS payload (all are CVE-2009-0563) along with links for OSX malware analysis. Please send your favorite tools for OSX if they are not listed. CVE-2009-0563 CVE-2009-0563 Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office

How are buffer overflows used to exploit computers?

阅读更多关于 How are buffer overflows used to exploit computers?

How are buffer overflows used to exploit computers? How is one able to execute arbitrary code simply by causing stack or heap overflows? I understand that portions of the programs memory are overwritten that aren't supposed to be, but I don't see how this leads to one executing their own code. Also, must the 3rd party's malicious code be written in the target processors assembly language? This is the most widely known document on the subject: Smashing the Stack for Fun and Profit However, 'stack overflows' have nothing to do with buffer overflows. Stack overflows are generally just an error

How does this milw0rm heap spraying exploit work?

阅读更多关于 How does this milw0rm heap spraying exploit work?

I usually do not have difficulty to read JavaScript code but for this one I can’t figure out the logic. The code is from an exploit that has been published 4 days ago. You can find it at milw0rm . Here is the code: <html> <div id="replace">x</div> <script> // windows/exec - 148 bytes // http://www.metasploit.com // Encoder: x86/shikata_ga_nai // EXITFUNC=process, CMD=calc.exe var shellcode = unescape("%uc92b%u1fb1%u0cbd%uc536%udb9b%ud9c5%u2474%u5af4%uea83%u31fc%u0b6a%u6a03%ud407%u6730%u5cff%u98bb%ud7ff%ua4fe%u9b74%uad05%u8b8b%u028d%ud893%ubccd%u35a2%u37b8%u4290%ua63a%u94e9%u9aa4%ud58d%ue5a3

How to write a buffer-overflow exploit in GCC,windows XP,x86?

阅读更多关于 How to write a buffer-overflow exploit in GCC,windows XP,x86?

void function(int a, int b, int c) { char buffer1[5]; char buffer2[10]; int *ret; ret = buffer1 + 12; (*ret) += 8;//why is it 8?? } void main() { int x; x = 0; function(1,2,3); x = 1; printf("%d\n",x); } The above demo is from here: http://insecure.org/stf/smashstack.html But it's not working here: D:\test>gcc -Wall -Wextra hw.cpp && a.exe hw.cpp: In function `void function(int, int, int)': hw.cpp:6: warning: unused variable 'buffer2' hw.cpp: At global scope: hw.cpp:4: warning: unused parameter 'a' hw.cpp:4: warning: unused parameter 'b' hw.cpp:4: warning: unused parameter 'c' 1 And I don't

How do I create formatted javascript console log messages

阅读更多关于 How do I create formatted javascript console log messages

I 'waddled' by the Console in Chrome on Facebook today. Surprisingly I got this message in the console. Now my question is: How is this possible? I know that there are a few 'exploit' methods for the console, but how can you make such font formatting in the console? (and is it console.log?) Yes, you can format the console.log() with something like this: console.log("%cExtra Large Yellow Text with Red Background", "background: red; color: yellow; font-size: x-large"); Note the %c preceding the text in the first argument and the style specifications in the second argument. The text will look

Writing Secure C and Secure C Idioms

阅读更多关于 Writing Secure C and Secure C Idioms

"The average man does not want to be free. He simply wants to be safe." - H. L. Menken I am attempting to write very secure C. Below I list some of the techniques I use and ask are they as secure as I think they are. Please don't not hesitate to tear my code/preconceptions to shreds. Any answer that finds even the most trivial vulnerability or teaches me a new idea will be highly valued . Reading from a stream: According to the GNU C Programming Tutorial getline: The getline function will automatically enlarge the block of memory as needed, via the realloc function, so there is never a

How is integer overflow exploitable?

阅读更多关于 How is integer overflow exploitable?

问题 Does anyone have a detailed explanation on how integers can be exploited? I have been reading a lot about the concept, and I understand what an it is, and I understand buffer overflows, but I dont understand how one could modify memory reliably, or in a way to modify application flow, by making an integer larger than its defined memory.... 回答1: It is definitely exploitable, but depends on the situation of course. Old versions ssh had an integer overflow which could be exploited remotely. The

buffer overflow example from Art of Exploitation book

阅读更多关于 buffer overflow example from Art of Exploitation book

I was reading this book Art of Exploitation, which is kinda good book and I run across that example from exploit_notesearch.c file. Briefly author tries to overflow program from notesearch.c int main(int argc, char *argv[]) { int userid, printing=1, fd; char searchstring[100]; if(argc > 1) // If there is an arg strcpy(searchstring, argv[1]); else // otherwise, searchstring[0] = 0; The argument of the main function is copied to the searchstring array and if the argument is bigger than 100 bytes it will overflow the return address from the main function. The author prepares the shellcode in