HackDig : Dig high-quality web security articles for hacker

Kernel Exploitation: Advanced

In Part 1 of this article series, we had reverse engineered the driver and identified buffer overflow vulnerability in it. In this part, we will cover the next step of developing the exploit, and for that, we will have to go through various structures and offset. Since this a kernel land exploitation, a typical MSFvenom shellcode will not work.The expl
Publish At:2017-09-18 17:00 | Read:2528 | Comments:0 | Tags:Exploit Development exploit

Which OpenVPN fixed several remotely exploitable flaws that were not detected by recent audits

OpenVPN is an open-source software application that implements virtual private network (VPN), it is used for creating secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities.OpenVPN uses a custom security protocolthat leverages SSL/TLS for key exchange; it is one of the most popular VPN solutio
Publish At:2017-06-27 20:05 | Read:3284 | Comments:0 | Tags:Exploit Development exploit

Exploiting Protostar – Heap Levels 0-2

In this article, we will be solving Heap Levels of Protostar. We will be mainly focusing at how and why of Heap Buffer overflows.Introduction:Heap memory can be viewed as another memory region. Heap memory is allocated via different memory allocators such as dlmalloc, jemalloc, ptmalloc, etc. In this article, we will be looking into vulnerabilities rel
Publish At:2017-06-27 01:40 | Read:3384 | Comments:0 | Tags:Exploit Development exploit

Exploiting Protostar – Format String Vulnerabilities

In this article, we will be solving format string vulnerability challenges from Protostar VM by exploit-exercises.com. We will also try to automate some boring stuff and leverage our exploit to code execution.IntroductionFormat String Vulnerabilities have been out there for quite a long time now, the main idea of exploiting format string vulnerabilitie
Publish At:2017-04-17 19:50 | Read:2912 | Comments:0 | Tags:Exploit Development exploit

Exploiting Protostar – Stack 4-7

In this article, we will be solving remaining challenges from Protostar VM by exploit-exercises.com.IntroductionIn this article, we will see how to find and conclude the offsets to EIP (Extended Instruction Pointer) by just looking at the disassembly of the program. We will also have a look at bypassing return address restrictions using techniques like
Publish At:2017-04-06 12:20 | Read:4685 | Comments:0 | Tags:Exploit Development exploit

How to Exploit XSS with an Image

IntroductionCross Site Scripting is one of the most common and powerful vulnerabilities on the Web.The OWASP organization has classified it in the third place in the top ten of the most critical web applications vulnerabilities(OWASP Top 10 – 2013: https://www.owasp.org/index.php/Top_10_2013-Top_10 )Figure 1: OWASP TOP 10 – 2013The cross-site scr
Publish At:2017-02-07 11:05 | Read:4016 | Comments:0 | Tags:Exploit Development Xss exploit

Understanding Security Implications of AngularJs

In this article, we will have a brief overview of security implications of AngularJs which mainly includes basics of AngularJs and inner working of various sandbox escapes for different versions being discovered so far.IntroductionAngularJs is a JavaScript framework used to create RIA application. It allows the developers to create client-side template
Publish At:2017-01-13 03:10 | Read:4579 | Comments:0 | Tags:Exploit Development

Most Exploited Vulnerabilities: by Whom, When, and How

Top Ten Vulnerabilities included in Exploit KitsWhich are the most exploited vulnerabilities by hackers in 2016? Who used them and how?Let’s start from a study conducted by the threat intelligence firm Recorded Future that analyzed most common vulnerabilities used in the exploit kits and let’s cross this information with the archive of Secu
Publish At:2016-12-30 00:10 | Read:4727 | Comments:0 | Tags:Exploit Development exploit

Writing Burp Extensions (Shodan Scanner)

In this article, we will have an overview of writing Burp extensions. At the end of the post, we will have an extension that will take any HTTP request, determine the IP address of domain and get specific information using Shodan API.I have divided the article in the following hierarchy so that you can skip some sections if you already know.Introducing
Publish At:2016-12-23 00:15 | Read:4345 | Comments:0 | Tags:Exploit Development

Metasploit Cheat Sheet

Metasploit is a framework and not a specific application. As a framework, the user can build their own specific tools that can be used for specific tasks. It eases the effort to exploit known vulnerabilities in networks, operating systems, and applications, and to develop new exploits for new or unknown vulnerabilities.Terms to KnowSystem exploitation
Publish At:2016-11-29 22:05 | Read:3662 | Comments:0 | Tags:Exploit Development

Data Extraction Using Binary Conversion/Binary Anding

This article covers how to extract data in case of blind SQL injections in fastest and most efficient way.OverviewSQL injection vulnerability has been out there for a very long time and over a period of time, many researchers had presented tons of techniques for exploiting the vulnerability and exfiltrating data. However, there are certain techniques t
Publish At:2016-09-19 18:40 | Read:2221 | Comments:0 | Tags:Exploit Development

From Local File Inclusion to Code Execution

IntroductionLocal File Inclusion (LFI) is one of the most popular attacks in Information Technology. In this article, we are not going to focus on what LFI attacks are or how we can perform them, but instead, we will see how to gain a shell by exploiting this vulnerability. If you don’t know how the attack works, you can have a look here first: F
Publish At:2016-08-05 01:55 | Read:4427 | Comments:0 | Tags:Exploit Development

Exploiting Windows DRIVERS: Double-fetch Race Condition Vulnerability

IntroductionA race condition occurs when two or multiple running threads manipulate the same resources without any synchronization mechanism regulating access to these resources. The presence of race conditions often leads to undesirable behavior ranging from erroneous results to a complete crash of the program. In this article, we will be looking into
Publish At:2016-07-12 10:50 | Read:4627 | Comments:0 | Tags:Exploit Development Vulnerability exploit

Exploiting Format Strings: Getting the Shell

In this article, we will have a look at how to exploit format String vulnerabilities to get a shell.Overview:In this article, we will briefly have a look at how to overwrite specific memory location, how to inject our shellcode in current memory of program and further overwrite the some desired memory address to execute our shellcode.NOTE: Memory addre
Publish At:2016-07-05 14:35 | Read:4045 | Comments:0 | Tags:Exploit Development exploit

Exploiting Format Strings: The Stack

This article covers how to exploit format String vulnerabilities to fetch and write arbitrary values to and from the stack.Overview :In this article, we will learn what Format String Vulnerabilities is, how we exploit it to read specific values from the stack, further we will also have a look at how we can use different format specifiers to write arbit
Publish At:2016-07-01 18:45 | Read:3819 | Comments:0 | Tags:Exploit Development exploit

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud