I started gera's exercises on format strings vulnerabilities. I am going to start on the stack next. This post will be my first ROP practice and it was fun :). The main purpose of "warming up the stack" exercises is to just bypass the canary. However, I
Web200 For this challenge, credentials were provided. We see the following page upon logging in: Clearly, this site doesn't get many visitors Nothing particularly stands out. To the source! <iframe src="content/news.php?type=1"></iframe> It seems the news content
This challenge provided a pcap file and the question ''What am I searching for?". A hint dropped in the irc channel by hockeyinjune helped us to look in the right place. All this challenge required was to look at the http traffic in wireshark and analyze some
Web 400 Upon visiting the site we are greeted with a login page. My, that person certainly is TALL. No credentials were provided as a hint for this challenge, so we'll have to brute force them. Some common combinations to try are administrator:123456, user:qwerty, admin:password,
For Web Challenge 300, you were presented with a news website, BluesNews. Although we're not told what we need to do, we probably want administrator access. Let's take a look at all the possible attack vectors to help us get the access we want. Clicking one
This past weekend, the ISIS lab held CSAW CTF quals. For more information about the event see: csawctf.poly.edu Here is the description for bin2 Bin2 - 300 Points ssh csawctf.poly.edu:30002 binary: bin2 Environment: ASLR, Ubuntu 11.04 {% highlight bash %} user21000@ubuntu:~$ uname -a Linux ubuntu
Here's a simple program to illustrate a stack smash. {% highlight bash %} $ date Wed Sep 14 11:36:21 EDT 2011 $ uname -a FreeBSD fbsd.local 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Fri Feb 18 02:24:46 UTC 2011 root@almeida.cse.buffalo.edu:/usr/obj/usr/src/
This post is long overdue. I decided to step it up from FreeBSD to Debian. The last format string challenge from gera is a vanilla format string. You can find this challenge here. {% highlight c %} /* fs5.c * * specially crafted to feed your brain by gera */ /* go, go, go! */ int main(
This is a summary of [Iwaniuk 2011] PHP 5.3.6 (source) uses two slightly different datastructures to handle metadata on a file upload/multifile upload [RFC 1867]. PHP gates which of these codepaths and datastructures to use based on user controlled input, and it is possible to mangle the
One more completed challenge is needed before we can declare format strings dead. This challenge from the format string section of Gera's Insecure Programming is basically solvable using the same approach as challenge #3. I am going to keep this post brief. If you want a more detail
This article discusses a new bug class that was introduced in XMLHttpRequest Level 2, how the bug manifests and some solutions to different problems. HTML5 is a hot topic in web security today. Mostly because of how expansive it is in relation to older web specifications, but also because it
This gera's insecure programming challenge is solvable (pwnable) in a similar fashion as my previous post. The challenge's source is posted. The challenge can be found at gera's format string 3 {% highlight c%} /* fs3.c * * specially crafted to feed your brain by riq */ /* Not
