This whitepaper provides an overview of the tools used in order to analyze malware on Android.
768a61b28e90178964b682b152e60eca11af1e5d5bb90aff633a7c86d60fa152
This is a whitepaper that goes into detail on how a PHP shell can be uploaded when leveraging SQL injection.
4bd1b56e632e868443ab5b6f7e07a054ee3c7586c9391af4c31b235f0d5348db
This whitepaper discusses heap spraying. Written in Portuguese.
4d45d4dd1363f5031cde304561cd53549c288ebffe7ac68449637f119a2fbfcc
This whitepaper documents how to compromise CA ControlMinder versions 12.5, 12.6, and 12.6 SP1 running JBoss version 4.2.2.GA.
d79c4e8b7e01e49acdda05ad5eceda4f0bf7d0d76f4b960c5d9135475bebc7d6
This whitepaper discusses rooting windows server using the PHP Meterpreter Webshell in Metasploit.
969178f6ff5208ad667a07134dd268f1f3afb8fbcc598cfc6a4095ef57d2b50b
This whitepaper discusses how attackers use dictionary-based brute-force attacks to steal other people's bitcoins. Proof of concept tools are included.
d3b473fd72aba55764c5b793c9300a33b4bc94411e4282b14f400213f149aa0d
This is a whitepaper that discusses using heap sprays with vulnerable active-x controls.
182912d0e8bbbc850abf4281ee8356d5767b5cb9c7194c7bbfc2b5eab415ddae
The most popular full disk encryption solution for Linux is LUKS (Linux Unified Key Setup), which provides an easy to use encryption layer for block devices. By default, newly generated LUKS devices are set up with 256-bit AES in CBC mode. Since there is no integrity protection/checksum, it is obviously possible to destroy parts of plaintext files by changing the corresponding ciphertext blocks. Nevertheless many users expect the encryption to make sure that an attacker can only change the plaintext to an unpredictable random value. The CBC mode used by default in LUKS however allows some more targeted manipulation of the plaintext file given that the attacker knows the original plaintext. This article demonstrates how this can be used to inject a full remote code execution backdoor into an encrypted installation of Ubuntu 12.04 created by the alternate installer (the default installer of Ubuntu 12.04 doesn't allow setting up full disk encryption).
83e0e48a068a6889d9cec9e057406641dd9d38932ce22381b3c16a767ef73656
This paper details a vulnerability affecting NVIDIA mental ray, which allows an attacker to take control over a mental ray based render farm.
775f48d6630d6aac147c8f09fc15e01a82cf693584d38a901be40b58fff0f320
This is a whitepaper discussing fuzzing and software vulnerabilities. This is part one. It is written in Turkish.
29c607fe9abef0fbc5dd236320bcc02b3b1b6084b7be47b5e412136cdbb1b06f
This is a brief whitepaper that covers XPATH injection attacks and use cases.
72d2972397b3492bd0d1d375cb0e92be5b5ce54c9372c0809f8b6dc6a39cc58d
This is a brief whitepaper tutorial discussing return-to-libc exploitation.
f1935f980e5eab5d3c4772be6b97efb487d82c08b13fc527519a912c04c08094
This is a brief whitepaper tutorial that discusses integer overflows and underflows.
9b9f3ebcd70a62a4189cceeaf49edd91a6d027ae60c29bc9f51bfd8eb1a1f3fa
This is a brief whitepaper tutorial that discusses format string exploitation.
1544465d9c53bc46b45f199277e5af8bfc93c0c6d2f40f5ff2478c2db9d3714b
This whitepaper is called Off-By-One Exploitation Tutorial. The off by one vulnerability in general means that if an attacker supplied input with certain length if the program has an incorrect length condition the program will write one byte outside the bounds of the space allocated to hold this input causing one of two scenarios depending on the input.
5f0e7988d1f9efa82633300226d7ad14a89ebbc4f3ad3eb4a3d67306232ea70c
Whitepaper called Return-Oriented-Programming (ROP FTW).
0df3dba7ba4fbf596b77ccb6bcaf64bddf65e2fae569ec24d7481f4b6ce3f8b6
This is a whitepaper called Metasploit - The Exploit Learning Tree. Instead of being just another document discussing how to use Metasploit, the purpose of this document is to show you how to look deeper into the code and try to decipher how the various classes and modules hang together to produce the various functions.
8053bf6927fee92962392df083a57d2a8ab44f95c200a4b5ef0d6c585cbd073d
This whitepaper goes into detail on exploitation techniques to bypass modern security mechanisms cerated to mitigate the common buffer overflow in Linux.
a28077f3efc10afd982560236f8d1705726408966a2cf3ce78caa1d0357240c4
These are presentation slides for Explotando Add-On's de Mozilla Firefox, or Exploiting Add-Ons in Mozilla Firefox. Written in Spanish.
be5a0d2d8734ba09d02081c9ed082df4f7e9d69db609f8de7bd83cb6ceeee9dc
This whitepaper explores the post exploitation of Metasploit using a generic shell rather than the meterpreter shell.
90af38e7b5b9001e07a318bfb68c614d438e23240e28c77f04d62899a4c03353
This is a whitepaper called On WebSockets in Penetration Testing. It goes into detail discussing the vulnerability attack surface with WebSockets and the complications involved for penetration testing.
a8b8492359ecd117e96f3ad36d86915bffba40beab8909428765442c3848ab6b
This papers discusses a new way to attack Android applications for bypassing password authentication.
4132d9e71ac1fd9c393ea9bc250f95b0a17cdfbbd0646e28fbc5128e126e40e9
This paper summarizes the findings from NCC's research into Akamai while providing advice to companies wishing to gain the maximum security when leveraging their solutions.
87bf6bdbd4a217dca83340b5158fe1ee1bc60e71894efd187434a3521fc29c37
Whitepaper called From Patched to Pwned - Attacking Xerox's Multifunction Printers Patch Process. In this paper the author discusses the step by step process around how to gain root level access to high end Xerox MFP devices, how the firmware signing process works, and how to protect yourself from this attack.
3688be93b27c1a23060fa014deca9150f7f3ac8484e3acd5427b36fec7c66906
This article discusses how to use Metasploit for scanning, crawling, and attacking web applications.
f1cc7c7ac8d8fc3a74105e7d8d02584bf9e083b1aa1fc066326798f75e73ec12