51CTO博客开发
最近碰到一个MSSQL的注入，有一段时间没真正搞过注入了，就拿它找回一下手感。其实本身注入没什么特别的地方，就是带会话的SQL注入，有点简单的防护（用sqlmap秒之），然后就没然后了~~之所以拿出来分享是后续考虑到脱库的效率性【本人只是秉着程序猿提高算法效率的思想去思考这个问题】有注入，其实相当于一个数据库shell摆在你面前了，盲注应该不在这队列，要脱那就直接select了，但问题是通常网站只
7·17中午刚刚午睡醒来就看到几个熟悉字眼——Struts2，远程执行代码。施特！难道继上回<s:a>标签后又新曝一个？本来还没睡醒的一下子清醒了。一看果断，紧接着某云就被刷屏了~~~一场腥风血雨画面即将上演。。。据报道，受影响版本是2.0.0-2.3.15，CVE编号：CVE-2013-2251。原因是因为参数action的值redirect以及redirectAction没有正
Protostar heap2AboutThis level examines what can happen when heap pointers are stale.This level is completed when you see the "you have logged in already!" messageThis level is at /opt/protostar/bin/h
经过半个多月的时间把Protostar完成了，休息了几天，继续做Fusion。*********题外话开始**********在大学期间就在纠结是否选择程序猿的道路，结果因长时间高负荷写代码会引发不适而放弃了，不得不赞一下调好一个BUG时那种feel。如今，当完成一道题目也会有这种feel~~~~*********题外话结束**********level00源码：#include "../comm
Core files will be in /tmp.<div style="margin-bottom: 10px; color: rgb(153, 153, 153); font-family: "Droid Sans', sans-serif; font-size: 14px; line-height: 20px; background-color: rgb(18, 20, 23);"
When you are exploiting this and you don't necessarily know your IP address and port number (proxy, NAT / DNAT, etc), you can determine that the string is properly aligned by seeing if it crashes or n
Hints: depending on where you are returning to, you may wish to use a toupper() proof shellcode.Source code#include "../common/common.c"#define NAME "final0"#define UID 0#define GID 0#define PORT 2995
This level is at /opt/protostar/bin/net3<h2 style="margin: 10px 0px; font-family: "Droid Sans', sans-serif; font-weight: normal; line-height: 40px; color: rgb(255, 255, 255); text-rendering: optimi
This level is at /opt/protostar/bin/net2<h2 style="margin: 10px 0px; font-family: "Droid Sans', sans-serif; font-weight: normal; line-height: 40px; color: rgb(255, 255, 255); text-rendering: optimi
This level is at /opt/protostar/bin/net1<h2 style="margin: 10px 0px; font-family: "Droid Sans', sans-serif; font-weight: normal; line-height: 40px; color: rgb(255, 255, 255); text-rendering: optimi
This level is at /opt/protostar/bin/net0
This level is at /opt/protostar/bin/heap1
Hints: objdump -TR is your friend
This level is at /opt/protostar/bin/format3
This level is at /opt/protostar/bin/heap0
This level is at /opt/protostar/bin/format2
Hints: objdump -t is your friend, and your input string lies far up the stack :)
Hints:This level is at /opt/protostar/bin/format0
The metasploit tool "msfelfscan" can make searching for suitable instructions very easy, otherwise looking through objdump output will suffice.objdump来定位。这里采用前者：然后再准备定位一下。。。
This level can be done in a couple of ways, such as finding the duplicate of the payload ( objdump -s will help with this), or ret2libc , or even return orientated programming.Sour
Hints:This level is at /opt/protostar/bin/stack5objdump -d shell.o user@protostar:~/stack5$ cat pwn5.py #!/usr/bin/env pythonoffset = 72shellcode = "\xb8\x2f\x73\x68\xf0\x25\xff\xff\xff\x0f\x50\x
Hints:This level is at /opt/protostar/bin/stack4
Hints:This level is at /opt/protostar/bin/stack3
Hints:This level is at /opt/protostar/bin/stack1
This level is at /opt/protostar/bin/stack2
This level is at /opt/protostar/bin/stack0
一次偶然的机会得知#知道创宇#的网站上存在着这样一道Python的题目→http://blog.knownsec.com/2012/02/knownsec-recruitment/←在各种激励下开始有了完成该题目的欲望。 由于当年的毕业设计是用C#写的爬虫，对爬虫有一定的了解。当初需求是抓取Sina博客进行判断并归类，加入一点智能算法进去勉强算是实现了类似电商那种“猜您可能喜欢”的功能。言归正传
写shellcode时的压栈指令方法相信大家使用得不少，只要懂得程序在调用函数时参数进栈的特点便很容易明白。如果执行“net user user password /add&&net localgroup administrators user /add”这语句的话，要让大家逐个字母的进栈肯定会给效率打个大大的折扣，这过程没技术含量纯苦力活，像这类活应该交给自动化工具来完成。。。
UPnP简述： UPnP是通用即插即用（Universal Plug and Play）的缩写，它主要用于实现设备的智能互联互通。使用UPnP协议不需要设备驱动程序，因此使用UPnP建立的网络是介质无关的，它可以运行在几乎所有的操作系统平台之上，可以使用C，C++，JAVA和VB等开发语言，使得在办公室、家庭和其他公共场所方便地构建设备相互联通的网络环境。 随着越来越多的设备联入网络，对于共享
Copyright © 2005-2024 51CTO.COM 版权所有 京ICP证060544号
