Exploitation

Q: What is an exploit?

Exploitation

Some theory by Halvar Flake/Thomas Dullien

Exploitation

Sometimes an exploit it as easy as:

for i in `seq 1 9999` 
do 
  curl https://the.right.url/some/public/path?id=${i}
done

Exploitation

Advantage of most exploits against managed code:

• Reliability

Verification

Creation of working PoC exploits Practical exercises Final practical exercises on real-world code bases

HelloFile.java

String filename = request.getParameter("image");
String sendfile = "./images/".concat(filename).concat(".gif");
File f = new File(sendfile);
[...]

HelloFile.java

⚰️ RIP

PHP

<?php
// include autoloader
require_once 'dompdf/autoload.inc.php';

// reference the Dompdf namespace
use Dompdf\Dompdf;
use Dompdf\Options;

if ($_POST['html']) {

  $options = new Options();
  $options->setIsPhpEnabled(true);

  // instantiate and use the dompdf class
  $dompdf = new Dompdf($options);

  // e.g.:

  $dompdf->loadHtml($_POST['html']);

  // (Optional) Setup the paper size and orientation
  //$dompdf->setPaper('A3', 'landscape');

  // Render the HTML as PDF
  $dompdf->render();

  // Output the generated PDF to Browser
  $dompdf->stream('pdfservice');
}
?>

PHP

<?php
$in = 'Somewhere, something incredible is waiting to be known';
echo preg_replace($_GET['replace'], $_GET['with'], $in);
?>

Ruby on Rails

# PasswordController

def reset
  user = User.find_by_token(params[:user][:token])
  if user
    #reset password here
  end
end

MySQL

> SELECT 123 FROM dual WHERE 1=1;
+-----+
| 123 |
+-----+
| 123 |
+-----+
1 row in set (0.00 sec)

MySQL

mysql> SELECT 123 FROM dual WHERE 1="1";
+-----+
| 123 |
+-----+
| 123 |
+-----+
1 row in set (0.00 sec)

MySQL

mysql> SELECT 123 FROM dual WHERE 1="1somestring";
+-----+
| 123 |
+-----+
| 123 |
+-----+
1 row in set, 1 warning (0.00 sec)

MySQL

mysql> SELECT 123 FROM dual WHERE 1="somestring";
Empty set, 1 warning (0.00 sec)

MySQL

mysql> SELECT 123 FROM dual WHERE 0="somestring";
+-----+
| 123 |
+-----+
| 123 |
+-----+
1 row in set, 1 warning (0.00 sec)