Archive

今回は今年一番ハマったPDFについて書きます。 先ずは軽い構造の説明から！ 上記はJavaScriptが実行できる最小限のPDFの例です。 上記の例では、ル ートオブジェクト(1 0 obj)内にPDFのページおよびPDFを開いた際に実行するアクション(/...

Note: I’ve done some more work since this was written. You can find updates here, and a complete compromise here. This weekend, I spent some time continuing my investigation of a Huawei E5573…

Printers. They are everywhere. In big businesses. In small businesses. In our homes. In our schools. Wherever you go, there they are.

### Summary The fix for https://hackerone.com/reports/242831 can be easily bypassed. It looks like you've banned `file://` substring, which is not enough. ### Repro steps 1. Download `gen_avi.py`...

"Connect all the things!" is, for some time now, the main theme when talking about IoT devices, solutions and products. Our eagerness to find new, at times - i…

Contribute to ffmpeg-avi-m3u-xbin development by creating an account on GitHub.

Attacks on video converters: a year later Emil Lerner Pavel Cheremushkin

There are a lot of tutorials out there about exploitation of memory corruption bugs, but I struggled to find step-by-step ones, that would s...

Background If you have followed my research on the infamous CVE-2017-0199 zero-day attack, you may know we (w/ my colleague Bing) did a p...

by Isoroku Yamamoto Wall Street Journal ended its practice of allowing special access for search engines. This means that a human visitor can no longer bypass the paywall by spoofing Google’s HTTP …

Execute a DLL via .xll files and the Excel.Application object's RegisterXLL() method · GitHub

CVE-2017-0190 is a recently patched vulnerability related to Windows metafiles (WMFs), a portable image format mainly used by 16-bit Windows applications. Recently we have seen an increase in the number of vulnerabilities related to WMFs and EMFs (enhanced metafiles) in the GDI32 library. Most often, these

Many have seen the video where vexal modifies his Porsche 911 to run DOOM. It is the same guy who used a toaster to control a PC game a few years ago. How technically accurate these videos are can be discussed, but the underlying creativity is hard to question. Naturally, when we saw the video, we did not want to lag behind, but what is the best way to respond to something like this? Inventing the DOM DOOM XSS, of course!

wtfjs - A list of funny and tricky JavaScript examples

Security Blog

В мае этого года исследователи Check Point Software Technologies обнаружили совершенно новый вектор атак — атаки через субтитры. Злоумышленники могут использовать файлы субтитров для получения контроля над компьютерами пользователей, при этом избегая обнаружения. В этой статье мы расскажем, как это у них получилось (обязательно запасись кофе – статья вышла большая :) – прим. ред.)

Doyensec's Blog :: Doyensec is an independent security research and development company focused on vulnerability discovery and remediation.

Познакомился с World of Warcraft очень давно и люблю его весь, но одна вещь больше всего не давала мне покоя — рыбная ловля. Это нудное повторяющееся действие,...

CVE-2017-0059 Internet Explorer “There is an use-after-free bug in IE which can lead to info leak / memory disclosure. The bug was confirmed on Internet Explorer version 11.0.9600.18537 (update version 11.0.38). [...] The root cause of a bug is actually a use-after-free on the textarea text value,

CVE-2017-[0037 and 0059] Internet Explorer 11 Following the last 2 blog posts for both CVE-2017-0037 and CVE-2017-0059 here's a full working exploit for IE11 <= 11.0.37 for Windows 7 (32 and 64 bit). I tested it only on two (not too) different machines so please if you

This presentation illustrates a number of techniques to smuggle and reshape HTTP requests using features such as HTTP Pipelining that are not normally used by …

On internal engagements, poisoning name resolution requests on the local network (à la Responder) is one of the tried and true methods of obtaining that coveted set of initial Domain credentials.  While this approach has worked on many clients, what if Link Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NTB-NS) protocols are configured securely or disabled?  Or, what if Responder was so successful that you now want to prove other means of gaining that initial foothold? There are a multitude of attacks a penetration tester can leverage when conducting physical walkthrough...