Court of Analysis and Testing

Last time in arm buffer overflow chapter we look at how an attacker can bypass NX and ASLR protection by simply brute force the location of the stack memory because of the low entropy of address randomization. Although brute-forcing the address is easy but is not an elegant way to defeat further protection such as canary. Actually, there is a second way to defeat not just NX and ASLR but also canary protection by utilizing a technique called "information leaking" using the format string attack For the sake of POC, we will be using source code from billy ellis exploit challenge (link: https://github.com/Billy-Ellis/Exploit-Challenges/blob/master/ROPLevel5.zip ) // //  roplevel5.c //  // //  Created by Billy Ellis on 09/08/2017. // // #include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> char feedbackString[32]; char feedbackString2[32]; void give_feedback(){         printf("\033[1mLeave...

Hi guys back again with the introduction of Heap Overflow, this time we move to the third challenge of the heap protostar challenge "Heap 2" Static Analysis: Before we move into the exploitation, let's take a look at the source code first and do a little bit of analysis At the start of the main function, we immediately enter an infinite loop and then there is a fgets function that will be used to store your input into the "line" variable. Notice that fgets is a safe function since it has a size limitation that enables the program to allocate enough memory without getting the risk of buffer overflow  After accepting our input the program will compare the value with 4 string which is "auth ", "reset", "service" and "login". If we choose "auth " options it will allocate memory in the heap for "auth" struct with malloc and then fill the memory with a bunch of zeroes using memset(). Finally, the...

Disclaimer: This post only for education only ! not to cause any destruction on any living system. Be smart! In the previous post about fuzzing we take a look at how we can conduct network fuzzing using boofuzz to find a bug that leads to us to get Remote Code Execution in one of the old software in windows XP (check the post ) but that was just an introduction and we only scratch the surface on how we can utilize fuzzing. So in this post, we are going to take a deeper look on what is actually fuzzing we will cover how many types of fuzzing out there, rule of thumbs on fuzzing and how we can create our own fuzzing to fit our objectives using python so put on your black hoodie because we are going to hacker mode This post is inspired by this paper: https://www.exploit-db.com/papers/12965 What is Fuzzing There are lots of good definition that explain what is the meaning fuzzing but if you asked me, fuzzing is a process of identifying bugs by delivering an unexpected ...