Introduction Introduction Hyper-V is the backbone of Azure, running on its Hosts to provide efficient and fair sharing of resources, but also isolation. That’s why we, in the vulnerability research team for Windows, have been working in the background …
I know that LLMNR is the “new version” of NetBIOS and both of them are basically for resolving names to IP addresses
I also know some exploits based on them, like a MiTM attack that the attacker sends a malicious response to the victim wh…
I am practicing writing exploit for Simple Web Server 2.2rc2.
I was able to:
find proper offset to overwrite SE Handler and Next SEH
find POP,POP,RET address
My problem is that, I can’t execute my shell (generated by msfvenom:
msfv…
How is it possible to correlate or detect user logons, e.g. via ssh/rdp, to associate the origin user and target user?
My use case is to know who actually (personal/identifiable) used a technical account (non-personal).
Sidenote: Both clie…
I’m trying to fully understand the concept behind CSRF, and more importantly, how to protect against it.
Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value of the random anti-CSRF token I insert i…
This is not a has-badBIOS-pwn3d-me post, so don’t worry about any paranoid rants.
Having read a thorough analysis/debunking of the alleged evilware, I certainly understand that the technology badBIOS uses for communication (some type of s…
After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I don’t have any file upload handling func…
Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem).
(source)
Yes I know that the solution is to "install and use a HTTP server for local…
We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (ACM).
One of our clients is concerned ab…
Suppose I have a penetration tester working in my data center. She is testing my systems and is probably finding some issues, allowing her to gain root access to a machine that is inside a subnet deep inside the company network.
How can I …
