Skip to content

Instantly share code, notes, and snippets.

@artem-smotrakov
artem-smotrakov / App.java
Created March 23, 2017 22:51
Getting a caller's class name in Java with SecurityManager.getClassContext()
public class App {
public static void main(String[] args) throws Throwable {
Logger.INSTANCE.log("main() started");
Logger.INSTANCE.log("hello");
Logger.INSTANCE.log("main() finished");
}
private static class Logger extends SecurityManager {
@artem-smotrakov
artem-smotrakov / DHKeyExchange.java
Last active September 18, 2017 09:23
An example of Diffie-Hellman key exchange with Java. For more details see https://codeandsolder.blogspot.com/2017/09/diffie-hellman-key-exchange-in-java.html
package security.keyexchange;
import java.io.InputStream;
import java.io.OutputStream;
import java.math.BigInteger;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.util.HashMap;
import java.util.Map;
public class CommandLine {
public static Parameters parse(String[] args) {
Parameters params = new Parameters();
int i = 0;
while (i < args.length) {
@artem-smotrakov
artem-smotrakov / attack.sh
Last active September 18, 2017 09:27
An example of LDAP injection in Java. For more details see https://blog.gypsyengineer.com/fun/security/ldap-injections.html
#!/bin/bash
# we just assume that it's that simple
alphabet="qwertyuiopasdfghjklzxcvbnm"
password=""
found=1
# stop when all guesses failed
while [ ${found} -eq 1 ];
@artem-smotrakov
artem-smotrakov / LDAPInfo.java
Last active September 18, 2017 09:27
An example of an LDAP client which is vulnerable to blind LDAP injection attack. For more details see An example of LDAP injection in Java. For more details see https://blog.gypsyengineer.com/fun/security/ldap-injections.html
import javax.naming.NamingEnumeration;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import java.util.Hashtable;
public class LDAPInfo {
public static void main(String[] args) throws Exception {
if (args.length < 1) {
@artem-smotrakov
artem-smotrakov / dht22.py
Last active October 24, 2017 06:03
Measuring temperature and humidity with DHT22 and MicroPython. See details on https://blog.gypsyengineer.com/fun/diy-electronics/micropython-esp8266-sending-data-to-thingspeak.html
import time
import dht
import machine
def mesure_temperature_and_humidity():
d = dht.DHT22(machine.Pin(DHT22_PIN))
d.measure()
t = d.temperature()
h = d.humidity()
print('temperature = %.2f' % t)
import network
nic = network.WLAN(network.STA_IF)
nic.active(True)
nic.connect(ssid, password)
@artem-smotrakov
artem-smotrakov / main.c
Created December 31, 2017 15:13
Here is a very simple example of a global buffer overflow. See more on https://blog.gypsyengineer.com/fun/security/global-buffer-overflows.html
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char buffer[16];
int main(int argc, char **argv) {
if(argc < 2) {
printf("no parameters specified\n");
exit(-1);
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
char buffer[16];
int main(int argc, char **argv) {
if(argc < 2) {
printf("no parameters specified\n");
exit(-1);
@artem-smotrakov
artem-smotrakov / gbo.c
Created December 31, 2017 15:21
Overwriting a function pointer in global memory, see detail on https://blog.gypsyengineer.com/fun/security/global-buffer-overflows.html
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
void do_something(void) {
printf("this is not a secret\n");
}
void print_secret(void) {
printf("this is a secret\n");