Hacking Tutorials

While this may be 1-2-3 for web application programmers, it is quite revealing for those not involved with web application security on a daily basis. This is…

How Healthcare.gov Could Be Hacked Security experts say the federal health insurance website is vulnerable to a common technique that hackers use to steal personal information.

With Healthcare.gov plagued by technical difficulties, the Obama administration is bringing in heavyweight coders and private companies like Verizon to fix the federal health exchange, pronto. But web security experts say the Obamacare tech team should add another pressing cyber issue to its to-do list: eliminating a security flaw that could make sensitive user information, including Social Security numbers, vulnerable to hackers.

New Vulnerability Found in Apps Using Wi-Fi

New Vulnerability Found in Apps Using Wi-Fi

http://www.solutionssquad.com/blog/index.php/british-man-arrested-over-hacking-into-us-military-systems/

British man arrested over hacking into US military systems

É muito comum encontrarmos sites com Vúlnerabilidades, seja XSS (Cross-Site Scripting), SQL Injection, XSRF, só esperando para que um l33t0 tenha acesso.

Toda vez que desenvolvo um site e/ou sistema, tomo cuidados com o tratamento das variáveis. E, depois de finalizado, realizo alguns testes ou peço para o Rodrigo tentar invadir :P

PHP.net resets passwords after malware-flinging HACK FLAP

PHP.net resets passwords after malware-flinging HACK FLAP

Th3Wall: Revokes SSL cert as Java vuln…

Edward Snowden

Just so you know.

(Excerpt from the full article by Danny O’Brien at the EFF.)

(This is part of my series on program vulnerability exploitation.)

So far, our method of code execution has been to write a shellcode on the stack, and execute it from there. Since there is normally no reason why a program should need to execute anything on the stack, an obvious countermeasure was to make the stack non-executable. Indeed, if you omit the -z execstack compilation flag on the programs of the previous two posts, the attacks will fail with a segmentation fault.

So executing code on the stack is no longer possible. A new method, now referred to as return-to-libc (or ret2libc for short), was introduced by Solar Designer in 1997. As its name implies, instead of overwriting the return address of our vulnerable function with an address on the stack, we will overwrite it with the address of a libc function. The libc library contains all the standard functions such as printf() and exit(), so there is almost surely a function in it that does what we need.