Uncategorized
Arbitrary Download of Images
This is a bug I found in flickr.
For example think I want to download this image.
https://www.flickr.com/photos/yuliatangled/5502737663/sizes/l
[code language=”html”]
www.flickr.com/photos/yuliatangled/5502737663/sizes/l
[/code]
The owner had disabled the download option to users.
(more…)
Share this:
Sim Editor Stack Based Buffer Overflow
Last week I bought a SIM card reader. Along with it came the software for it. It was SIM Card Editor 6.6. You can download it from here. The app is pretty cool. You can manipulate the SIM card’s data with it. However I noticed something strange in this application. When we are loading file for example suppose with 4 “A” characters we would get the output as “ªª”. Just two characters will be displayed. When I gave the input as “4141” the result would be “AA”. This time the correct output we need. What was the reason for this? From what I noticed was that when we enter “AAAA” the hex values would be “\x41\x41\x41\x41” the app will take two values each and evaluate to hex.
When we give the input as “4141” this is what happens.
So suppose we want to enter a hex string we have to just give the input. For example we want to give the application “AA” we have to give just “4141”. Taking that into consideration the rest was easy. The return address is overwritten with our buffer.
[code language=”python”]
buff = "41" * 500
with open("ex.sms", ‘w’) as f:
f.write(buff)
[/code]
Share this:
2014 in review
The WordPress.com stats helper monkeys prepared a 2014 annual report for this blog.
Here's an excerpt:
The concert hall at the Sydney Opera House holds 2,700 people. This blog was viewed about 38,000 times in 2014. If it were a concert at Sydney Opera House, it would take about 14 sold-out performances for that many people to see it.
Click here to see the complete report.
Share this:
Acknowledged by Lievensberg
https://www.lievensbergziekenhuis.nl/paginas/141-disclaimer.html
Share this:
JS via Images
Recently I saw an awesome research by Ange Albertini in abusing a GIF file and injecting JS inside. You can download his code from here The following code is a custom made gif , yet abused by our JS payload.
(more…)
