Intro

Exploitation - it-sec-catalog - References to vulnerability exploitation stuff. - Project Hosting on Google Code. 1.

How to use this wiki ... or several advices for beginners 1.1. Required knowledge At least the basic knowledge of assembly, OS internals, C/C++ languages are needed to get the most value from this wiki. 1.2. Most simple vulnerabilities from the point of view of exploitation are stack-based buffer overflows. Peter Van Eeckhoutte's (corelanc0d3r) series of tutorials are right thing to start with - those structure is well-formed, explained step-by-step and covers most exploitation topics starting from those easy, continuing with more and more complex.

Another great reading that definitely will help novice exploit writers to warm up is the "Smashing the stack in 2010" by Andrea Cugliari and Mariano Graziano. And for all those who are assuming long prospective roadmap: "How do I become a Ninja? ". 1.3. Keep in mind that old articles (or new, that focused on old OS) might confuse you. 1.4. As you might have noticed, in table there is a column called Type. 1.5. 2. 2.1. From 0x90 to 0x4c454554, a journey into exploitation. I put some time in and compiled a list in a course type layout to help people in process of learning exploit development.

I hope my research will help others spend more time learning and less time searching. First off I want to thank the corelan guys for the help they have provided me so far in the process. layout: I will be posting in a hierarchical structure, each hierarchy structure should be fully understood before moving on to the next section. I will also post sets of Parallel learning topics that you can use to study in line with other topics to help prevent monotony. These Parallel areas will have a start and end mark which shows when they should be complete in perspective to the overall learning desktop background Link to Backgrounds Other Posts like this one: Because of quality of these posts I wanted to put them at the top.

Python: One of my favorite languages and growing in popularity python is a powerful language that is easy to use and well documented. Past, Present, Future of Windows Exploitation. Hi all this is v0.1 of this post and in this post i’m going to have a review and brief history on exploitation with focus on windows . this post will be done III part : part I : brief history of buffer overflow part II : history of windows exploitation from windows 2000 to windows 7 part III : feature of exploitation Part I : brief history of buffer overflow Starring : Robert morris , Aleph_one , Solar designer , Matt Conover , Casper Dik it’s been long time after : morris worm in 1988 (first known computer worm that used a buffer overflow to attack) aleph one wrote Smashing The Stack For Fun Profit in phrack 49 in ~1996 so he start taking about detailed strcpy exploitation : Matt Conover wrote first detailed heap overflow tutorial in 1999 heap tut and solar designer wrote first generic heap exploit on windows netscape exploit and later solar designer released same thing to remove executable permission for stack on the linux here.

Smash the Stack 2010. The Ethical Hacker Network - Smashing The Modern Stack For Fun And Profit. By Craig J.

Heffner When it comes to buffer overflows, ‘Smashing The Stack For Fun And Profit‘ by Aleph One is still the first resource many people are directed towards, and for good reason; it is thorough, well written, and chock-full of examples. However, the GNU C Compiler (gcc) has evolved since 1998, and as a result, many people are left wondering why they can’t get the examples to work for them, or if they do get the code to work, why they had to make the changes that they did.

Having these same problems myself, and being unable to find an updated version of Aleph One’s document on the web, I set out to identify the source of these variations on my own. I have taken the liberty of writing this paper to share my findings with others who are experiencing the same problems I did, but it is meant only to be a modern supplement to Aleph One’s paper. The Problem(s) example3.c: —————————————————————————— void function(int a, int b, int c) { char buffer1[5]; char buffer2[10]; int *ret; [TUTORIAL] Exploit Writting Tutorial From Basic To Intermediate. Exploit Writting Tutorial From Basic To Advanced There are increasing number of bloggers who like to share thier knowledge in exploit especially the topic on how to create and write your own exploit.

In this post, I would like to combine the exploits tutorial that I have came across. This is not the comprehensive collection but at least its a good starting point for exploits beginners. David Hoelzer tutorial that is intended for application/software developers from SANS Institude. For application/software developers, the overall presentation is meant to explain the basic concept of buffer overflow, how does it occurs, how to exploit it using manual/automation way and create the exploit using metasploit and automate the exploitation process.

The source code of the vulnerable server can be found on his blog. The video tutorials can be downloaded here. X86 Opcode and Instruction Reference.