Windows API Function Definitions
Posted by scriptjunkie in Uncategorized on January 16, 2012
All of them. Or at least a good chunk of ’em. Why? Because sometimes you just need to know what the parameters are for some obscure function. Download here: winapi.txt and enjoy.
Network Nightmare (Intel)
Posted by scriptjunkie in Uncategorized on December 17, 2011
You can see the slides I put together for my talk Network Nightmare – Intel PXE at http://www.scriptjunkie.us/wp-content/uploads/2011/10/Network-Nightmare-Intel.pdf. It is a modification of the Defcon talk, and adds some lessons learned/suggestions for developers. I also added a few slides evaluating the PXE attack according to the most common vulnerability severity criteria, as if it was […]
Fragerizer – profile-guided load-order disk optimizer
Posted by scriptjunkie in /dev/urandom on September 14, 2011
A full load of the Metasploit GUI with database entails accessing almost 10,000 objects on disk. Even if you defragment your hard drive, you still wait for the access time of the disk to seek and access each file.
It would be faster if each file and directory was laid out on disk in the order that it would be accessed to load more quickly. So I wrote fragerizer, a smallish utility to perform that arranging for you. And invented a new word:
Fragerize. v. To defragment and arrange files & directories sequentially on disk in order of use.
Original Source Forgery
Posted by scriptjunkie in /dev/urandom, webapps on September 8, 2011
If you were looking for vulnerabilities on a website, you might open up the original page source looking for commented-out code, javascript source, hidden forms, etc. If you suspected an XSS attack on your own site, chances are you might right-click on the page and view source to check for unwanted scripts. If you needed to register for CTP, hack this site, or read the snarky comments in the HTML of www.defcon.org, you would probably need to view the page source.
This is all based on your assumption that when you right-click on the page and select “View Source” the text you see is the HTML source that the server sent to your browser when it requested the URL in your address bar. Unfortunately if you assumed this, you would be wrong […]
Bypassing DEP/ASLR in browser exploits with McAfee and Symantec
Posted by scriptjunkie in Exploits on June 28, 2011
[Also found this lingering on my hard drive from earlier this year, the recent exploits using Java to do the same thing reminded me of this. But I think it’s still valid, so here you go. Useful if the target doesn’t have Java I guess.] Vanilla Firefox doesn’t seem to be missing ASLR/DEP protection; the […]