Archivos del blog

Remote Code Execution in framework

Several months ago I happened to be looking at‘s source code when I found an old-style (as in basic) remote code execution in the database module. Fortunately for most users of, the database module is pretty simple and

Tagged with: , , , ,
Publicado en hacking, Programming, web hacking

How Effective is ASLR on Linux Systems?

Address Space Layout Randomization (ASLR) is an exploit mitigation technique implemented in the majority of modern operating systems. In a nutshell, the idea behind ASLR is randomizing the process’ memory space in order to prevent the attacker from finding the

Tagged with: , , ,
Publicado en exploiting, hacking, Linux

XSS killed the anti-CSRF star

This entry hopes to be a quick consideration about how one attack vector can at times dismantle the security of a different area of the application that was otherwise deemed secure. Truth is, security threats many times work like this,

Tagged with: , , ,
Publicado en web hacking

SANS HolidayHack Write Up

During this Christmas break, although I went back to Spain to stay with family and friends I still was able to get some time to look at the SANS HolidayHack 2012 CTF. I must say it has been great fun,

Tagged with: , , ,
Publicado en CTF, hacking, wargame

Solución Nebula Nivel 18

Como nos indican en las instrucciones de este nivel, existen tres formas de solucionarlo: fácil, media y difícil. Voy a contar cuales son y cómo resolverlo a través de una de ellas. Difícil: Si os fijáis con detenimiento, veréis que

Tagged with: , , , ,
Publicado en exploiting, hacking

Soluciones Nebula Niveles 17,19

Nivel 17: Tenemos un pequeño programa en python que acepta una entrada y la procesa. He de admitir que a priori no tenía ni idea de por dónde coger este programa, así que me fui a mirar la documentación de

Tagged with: , , , ,
Publicado en exploiting, hacking

Soluciones Nebula Niveles 15,16

Nivel 15: Debo decir que éste nivel ha sido, para mí, el más complicado de los veinte. Identificar el problema no fue complicado, pero conseguir que la solución funcionara ha sido una pesadilla. El nivel nos sugiere que realicemos strace

Tagged with: , , , ,
Publicado en exploiting, hacking
  • RT @gremisch: "Your tweet has reached 100 likes. Please wait, an out of context weirdo will be assigned to you shortly." 2 days ago
  • RT @campuscodi: A website that generates random data breach excuses Plz share with your CEO. He/she needs to be prepared.… 1 week ago
  • RT @TaliaShadwell: Been debating whether I should share this - but think it’s a revealing - and somewhat creepy - insight into how big tech… 1 week ago
  • RT @jomaoppa: I saw a software engineer today No company swag hoodie. No stickers on their laptop. No mechanical keyboard. He just sat th… 1 week ago