For Hack Night, Nitin and I set about teaching students how to read and write x86 assembly. I was tasked with teaching students how to write x86. Naturally, being short on time I decided to cheat by writing some C code, compiling it, and taking a peek at the output
This past weekend, April 19th 2013 in the year of our lord, Brooklynt Overflow assembled to partake in the spectacle of pwning known as PlaidCTF. I'm particularly fond of PlaidCTF because it is the first CTF that I played in as a member of Brooklynt Overflow so many
If you were busy in Cancun over spring break, you missed out on our hardware hacking workshop in the ISIS lab! Hardware hacking is an important area of security research because while vulnerabilities in software and network interfaces have more visibility, vendors of hardware systems typically do not expect attacks
Introduction Last month, Brooklynt Overflow competed in the UCSB iCTF competition. Unlike some of the other competitions we've been playing in lately, this was an attack/defense style competition in which we had a Virtual Machine containing 9 vulnerable services; our goals were to find the vulnerabilities within
We hope you enjoyed our April Fools' Joke! Subscribe to our blog for technical posts on offensive security. Check out our program here. The ISIS Lab has teamed up with Microsoft, Google, Adobe, and Carnegie Mellon University Cylab to fix security. Our distributed static binary analysis whitebox fuzzing sandbox
Just a bit of warning about clang. By the default state the clang compiler does not install stack cookie checks to its function calls. Given a simple function that managers buffers: {% highlight c%} int inner(char * input) { char buf[8]; strcpy(buf, input); return(-0); } int main(int argc, char
Thanks to David, Kai, and Kevin for help with various phases of this challenge. This is a writeup on solving a particular CTF challenge, as well as a meta-writeup on practical applications of using Burp Suite to beat HTML forms into submission when manual entry is becoming tiresome. We start
Introduction: This kind of attack exists because of the cryptographic padding that takes place on the message length. Since, Plaintext can be of varying length, however block ciphers require that all messages need to be exact number of blocks. To satisfy this requirement we use padding, to get the exact
This blog post describes about the lesser known attack, targeted towards HTTP Headers due to improper input validation. It also describes on how other attacks can be mounted using this mechanism. Introduction: All the websites rely upon HTTP to transmit data between client(browser) and server. Client sends a request
Newsletter
Please check the first part of this series on Android 101, if you want to check the necessary tools and how to prepare for the app assessment. Lesson6Activity (Encryption vs Encraption) As the title suggests, this lesson is about encryption. Specifically, it concentrates difficulties with key management and why relying
Please check the first part of this series on Android 101, if you want to check the necessary tools and how to prepare for the app assessment. Lesson4Activity (SSL man in the middle): The instructions for this lesson suggest that we need to intercept the token that is sent as
This app was released in this year's Shmoocon'13 by Intrepidus Group. You can get the app from the Google play store. This app as the name suggests is an android security learner app, there are deliberate vulnerabilities in this app from bad logging to intent manipulation.
