Posts:

Table of Contents

• Introduction
• Discounts (in alphabetical order):
  • Hak5
  • Hex-Rays
  • Malformity Labs
  • Netsparker
  • No Starch Press
  • Paterva
  • Rapid7
  • SANS
  • Security Roots
  • Syngress
  • Your name here ?

Table of Contents

• Introduction
• Discounts (in alphabetical order):
  • Hak5
  • Hex-Rays
  • Malformity Labs
  • Netsparker
  • Read more

Table of Contents

• Introduction
• Disclosure Timeline:
• Vendor Details
• Vulnerability Details
• The patch
•  
• Leveraging SQL Injection
• Cool! We got Admin, now what?
• Code Execution
•  
• Further Exploitation?

Table of Contents

• Introduction
• Disclosure Timeline:
• Vendor Details
• Vulnerability Details
• The patch
• Read more

Good morning everyone,

Welcome to BlackHat Europe 2013 !  As announced in my post a couple of days ago, I’ll try to post short write-ups about some of the talks right after the presentation has finished.   Read more

A lot has been said and written already about heap spraying, but most of the existing documentation and whitepapers focus on IE7 or older versions. Although there are a number of public exploits available that target IE8, the exact technique to do so has not been really documented in detail. Of course, you can probably derive how it works by looking at those public exploits. With this tutorial, I'm going to provide you with a full and detailed overview on what heap spraying is, and how to use it on old and newer platforms. I'll start with some "ancient" techniques (or classic techniques if you will) that can be used on IE6 and IE7. We'll also look at heap spraying for non-browser applications. Next, we'll talk about precision heap spraying, which is a requirement to make DEP bypass exploits work on IE8. I'll finish this tutorial with sharing some of my own research on getting reliable heap spraying to work on IE9. Read more

Traditional Egghunter

An Egghunter is nothing more than an assembly routine to find shellcode somewhere in memory. We typically deploy an Egghunter when there is no more room in our buffer that we can use to initially redirect EIP Read more

On June 14, 2011 HD Moore announced the Metasploit Bounty contest, offering a cash incentive for specific vulnerabilities to be submitted as modules in the Metasploit Framework. Titled "30 exploits, $5000 in 5 weeks", a post on the Rapid7 blog lists the 30 "bounties" selected by the MSF team, waiting for someone to claim and submit a working exploit module. Read more

This document describes the various commands, functionality and behaviour of mona.py. Released on june 16, this pycommand for Immunity Debugger replaces pvefindaddr, solving performance issues and offering numerous new features. pvefindaddr will still be available for download until all of its functionality has been ported over to mona. Read more

Ahh.. Vegas.. What happens in Vegas, stays in Vegas right ? With a variety of cons ahead (BlackHat, Defcon, B-Sides, …) there is plenty of things that can and will happen at Vegas. Will you be there to witness & enjoy it ? Getting to Vegas is just one part of the story. Getting access to one of the cons is the second part, but in case of B-Sides, there are no tickets left anymore. So, in case you were not able to get one of the free tickets to B-Sides LV, there's good news ! We have 2 tickets for B-Sides LV (august 3 & 4, 2011)… and we're giving them away...but not without a little 'battle'... Read more

Over the last few weeks, there has been some commotion about a universal DEP/ASLR bypass routine using ROP gadgets from msvcr71.dll (written by Immunity Inc) and the fact that it might have been copied into an exploit submitted to Metasploit as part of the Metasploit bounty. I'm not going to make any statements about this, but the ROP routine itself looks pretty slick. Read more