Introduction ‘FILE’ structure exploitation is one of the common ways to gain control over execution flow. The attacker overwrites a ‘FILE’ pointer (say stdin, stdout, stderr or any other file handler opened by fopen() ) to point to his/her own forged structure. This structure contains vtable , which is a pointer to a table which contains functions which are called when the original ‘FILE’ pointer…
This post is about developing a secure OAuth 2.0 server, the inherent weaknesses of the protocol, and their mitigation. Introduction Recently, I had the opportunity to mentor a fellow student at SDSLabs on a project related to the OAuth 2.0 protocol. It was then that I decided to read the official manual for OAuth 2.0. It took me a few hours to go through the entire document and analyze it. The…
Introduction It is good to know that nowadays, developers have started paying attention to security while building websites. Almost everyone is aware of SQL Injection . Herein, I would like to discuss another kind of vulnerability related to SQL databases which is as dangerous as SQL Injection, and yet not as common. I shall demonstrate the attack and discuss various defense strategies. Disclaimer…
This post is about my GSoC project, that I worked on during summer, 2016. I worked under the LabLua organization on adding a test suite and improving documentation for elasticsearch-lua. elasticsearch-lua . Introduction Elasticsearch is a distributed, scalable and full-text search engine based on Lucene. It provides an HTTP web interface and handles JSON documents. It is presently ranked 1 in the…
This post is about installing and maintaining multiple versions of Lua, LuaJIT, and Luarocks using luaver. This is perhaps the easiest and the most systematic way to go about installing any of the above. Introducing Lua Version Manager (luaver) Lua Version Manager or luaver allows you to easily install and switch between multiple versions of lua, luajit, and luarocks in a seamless and consistent…
Introduction Here I am going to demonstrate how to gain shell access by overflowing a vulnerable buffer. I shall show it with both ASLR disabled as well as ASLR enabled(for those who don’t know about ASLR, I’ll come to it soon). This post is in continuation with ‘ Buffer Overflow Exploit ’, which I wrote earlier. You need not go through it if you’re familiar with it. Prerequisites: I expect you to…
This post is about elasticsearch-lua . I developed it during the summer of 2015 as part of GSoC(Google Summer of Code) 2015 . Here I shall describe the reasons for various software design decisions that I took. Note: This post is not about ‘How to use elasticsearch-lua’. I would recommend you to go through the README and the documentation on how to use elasticsearch-lua. Introduction Elasticsearch…
Introduction The Domain Name System is an essential component of the functionality of most Internet services. It provides a distributed solution for services such as resolving host names to IP addresses and vice versa. DNS was designed around the early 1980s without any security consideration. This was mainly because at that time networks were quite small. All the hosts in the network were known…
Introduction In this blog we will talk about running network applications securely. A simple program(that takes I/O from the console) can be run as a secure service using a combination of xinetd and chroot . I used this technique while developing challenges for Backdoor . The ECHO challenge is a good example. Key points: The program running in the background takes I/O directly from the console.…
Introduction I am interested in exploiting binary files. The first time I came across the buffer overflow exploit, I couldn’t actually implement it. Many of the existing sources on the web were outdated(worked with earlier versions of gcc, linux, etc). It took me quite a while to actually run a vulnerable program on my machine and exploit it. I decided to write a simple tutorial for beginners or…
Introduction Somewhere back in May, I started getting messages such as this on facebook: I had around 300 friends then and got almost 8-9 such messages. The interesting thing was that those people were completely unrelated. According to me some of them didn’t know each other. Suspecting some trick I decided to analyze the file. Analysis Handling the zip file I downloaded the zip file and verified…
Initial days… I had started coding on Windows. I began to get familiar with the graphical interfaces of NetBeans, Visual Studio, Eclipse etc. As I got to know more about programming and developing I began to hear about a certain thing called ‘linux’. This word kept popping out in many articles of stackoverflow or other resources that I used to depend upon. At first the name gave me the image of a…