IRIS citations management tool (post auth) Remote Command Execution
Some time ago I did some source code auditing in public repositories and came across this bug. However this was not useful enough to keep 0day (post authenticated and not nearly as widely deployed as I would like). I built this exploit to use the new version of the webstrike framework that I have developed. … Continue reading
phpwcms remote code execution and PHP PCRE filter evasion bypasses (zeroday)
Understanding dangerous php PCRE exploitability Well, I was bored one night so I decided to develop a number of regex expressions for finding remote code execution vulnerabilities within google’s project code archive (http://code.google.com/codesearch). One of the techniques I used was matching on potentially exploitable preg_replace calls. Now, I cant share my regex pattern but I … Continue reading
PHP unserialize and class magic method manipulation
Some time ago Stefan Esser wrote about an interesting technique that can be used to reliably execute php code against vulnerabile applications. (http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf). Besides being used for DoS attacks against a specific environment (http://www.php-security.org/MOPB/MOPB-05-2007.html), or using unserialize for a information leak in heap memory (http://www.php-security.org/MOPB/MOPB-29-2007.html) often we want to target an applications class structure and … Continue reading
webstrike – a web infiltration platform
We here is my brief introduction regarding webstrike. The idea is to develop a framework that can be used to plugin web attack modules that use both client and server attack techniques and will hopefully encourage more people to weaponize web vulnerabilities. Right now I am just focusing on getting the core up and running and am … Continue reading
echo “Hello World”;
This will be my new blog were I will discuss various vulnerabilities, opinions and general write-ups. If you see a zero-day disclosed here. deal with it. Its probably because its no use to me.
infosec absurdity 