table of contents - cloudinary · pdf filezef cekaj 9 ... criminals are getting smarter:...

0

1

1.1

1.2

1.3

1.4

1.5

2

3

TableofContentsIntroduction

SoftwareExploitation

AnalysisandExploitation(unprivileged)

AnalysisandExploitation(privileged)

ShellcodeDevelopment

Mitigations

Research

Malware

VariousStuff

ITSecurityCatalog

2

ITSecurityCatalogv.2.0

Previouslyprojectwaslocatedhere:https://code.google.com/p/it-sec-catalog/,butasGoogleCodehostingisgoingtoshutdown,allstuffhasbeenmigratedhere.Manychangestocontenthavebeenmadetoo:

rearrangedandsplitintomoreappropriatesections;removedsectiononanalysisofthebugsandmergedwith"BugAnalysisandExploitation";fixedlinksandinformation,restoredmanydeadlinks;replaced"Type"columnwith"Author"column;addedmeta-informationalongwithCVE,i.e.bugname.

AboutprojectThisprojecthasappearedasanattempttoindexandsummarizelinkstocomputersecurityrelatedstuff.Slides(thereisotherprojectcollectingthem),copy-pastes,wronganderroneousarticlesarenotincluded.Mainfocusissoftwareexploitation—memorycorruptionbugsandnon-corruptionbugsleadingtoremotecodeexecution(excludingweb),privilegeescalation,dataexfiltration,DoS.Malwaresectionisindevelopment.

Highlighteditems:

vulnerabilitydevelopment,softwareexploitation-sortedbytypeofvulnerability;malwareanalysis;

DisclaimerIfyounoticelinkpointingtoanarticlewithpotentiallypromotionalcharacter,pleasebeawarethatIamnotaffiliatedinanywaywithanyrelatedcompanies.LinkspostedherearepostedonlybecauseImayfindcontentinteresting.Iamnotpaidtorunthisproject,orpublishlinks.

Errorsmayoccur,soplease,don'thesitatetocontactmeifyouencounterone.

Thankstoeveryonewhocontributedtotheproject.

ITSecurityCatalog

3Introduction

https://code.google.com/p/it-sec-catalog/

SoftwareexploitationHereyoucanfindlinkstoarticlesonsoftwareexploitation,vulnerabilitydevelopment,exploitanalysis,sourcecodeanalysis,differentresearches,andotherstuff.

Followingheadingscorrespondtotheclassificationofvulnerabilitiesandrelatedtopics.

ITSecurityCatalog

4SoftwareExploitation

Buganalysisandexploitation(unprivileged)Bugandexploitanalysisanddevelopmentinuser-land.

Bufferoverflows

Stack-basedbufferoverrun

StructuredExceptionHandler

ITSecurityCatalog

5AnalysisandExploitation(unprivileged)

Nr URL Description Date Author

1 https://web.archive.org/web/2012072413294...

UnderstandingSEH(StructuredExceptionHandler)Exploitation

06-07-2009

DonnyHubener

2 http://www.corelan.be/index.php/2009...

Exploitwritingtutorialpart3:SEHBasedExploits

25-07-2009

corelanc0d3r


Exploitwritingtutorialpart3b:SEHBasedExploits–justanotherexample

28-07-2009

corelanc0d3r

4 http://grey-corner.blogspot.com/2010/01/...

SEHStackBasedBufferOverflowTutorial

07-01-2010

StephenBradshaw

5 http://www.ethicalhacker.net/content/vie...

Tutorial:SEHBasedExploitsandtheDevelopmentProcess

04-05-2010

Mark(n1p)Nicholls

6 https://docs.google.com/viewer?a=v&pid=e... DebugginganSEH0day

29-05-2010

mr_me

7 http://resources.infosecinstitute.com/se...

SEHBasedOverflowExploitTutorial

28-04-2011

StephenBradshaw

Stackbufferoverrun


1 http://blogs.securiteam.com/index.php/ar...

HeapSpraying:ExploitingInternetExplorerVML0-day

23-09-2006

TriratKiraP

Exploit

ITSecurityCatalog


https://web.archive.org/web/20120724132946/http://www.i-hacked.com/freefiles/EasyChat_SEH_exploit_v1.3.pdf

http://www.corelan.be/index.php/2009/07/25/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-3-seh/

http://www.corelan.be/index.php/2009/07/28/seh-based-exploit-writing-tutorial-continued-just-another-example-part-3b/

http://grey-corner.blogspot.com/2010/01/seh-stack-based-windows-buffer-overflow.html

http://www.ethicalhacker.net/content/view/309/2/

https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=1tioiVT1jjM-xCzYc-2EPTcATOZ07gUcMshqKf8GHNp47vLvn5yT7wprAUpkb&hl=en

http://resources.infosecinstitute.com/seh-exploit/

http://blogs.securiteam.com/index.php/archives/638

2 http://www.corelan.be/index.php/200...writingtutorialpart1:StackBasedOverflows

19-07-2009

corelanc0d3r


Exploitwritingtutorialpart2:StackBasedOverflows–jumpingtoshellcode

23-07-2009

corelanc0d3r


StackBasedBufferOverflowTutorial

07-01-2010

StephenBradshaw

5 http://www.phreedom.org/research/vulnera...WindowsANIheaderbufferoverflow

29-03-2010

AlexanderSotirov

6 http://www.offensive-security.com/vulnde...

EvocamRemoteBufferOverflowonOSX

04-06-2010

Paul(d1dn0t)Harrington

7 http://turkeyland.net/projects/overflow/...BufferOverflowsandYou

04-08-2010

JeffreyA.Turkstra

8 http://dvlabs.tippingpoint.com/blog/2010...

SecurityAdvisoryforNetWare6.5OpenSSH

01-09-2010

ZefCekaj

9 http://www.vupen.com/blog/20100909.Adobe...

CriminalsAreGettingSmarter:AnalysisoftheAdobeAcrobat/Reader0-DayExploit

09-09-2010

NicolasJoly

10 http://www.exploit-db.com/bypassing-uac-...

BypassingUACwithUserPrivilegeunderWindowsVista/7–

26-11-2010

muts

ITSecurityCatalog


http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2466

http://www.exploit-db.com/exploits/9298/

http://osvdb.org/show/osvdb/61386


http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-0688


http://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/

http://www.corelan.be/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/

http://grey-corner.blogspot.com/2010/01/beginning-stack-based-buffer-overflow.html

http://www.phreedom.org/research/vulnerabilities/ani-header/

http://www.offensive-security.com/vulndev/evocam-remote-buffer-overflow-on-osx/

http://turkeyland.net/projects/overflow/index.php

http://dvlabs.tippingpoint.com/blog/2010/09/01/zdi-10-169-on-exploitability

http://www.vupen.com/blog/20100909.Adobe_Acrobat_Reader_0_Day_Exploit_CVE-2010-2883_Technical_Analysis.php

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/

Mirror

11 http://www.exploit-db.com/docs/16030.pdf...

Non-ExecutableStackARMExploitation

23-01-2011

Itzhak(Zuk)Avraham

12 http://0x1byte.blogspot.co.il/2011/02/cv...

AnalysisofCVE2010-3333MicrosoftOfficeRTFFileStackBufferOverflowVulnerability

20-02-2011

AlexanderGavrun

13 http://resources.infosecinstitute.com/st...

StackBasedBufferOverflowTutorial,part1—Introduction

09-03-2011

StephenBradshaw


StackBasedBufferOverflowTutorial,part2—Exploitingthestackoverflow

09-03-2011

StephenBradshaw


StackBasedBufferOverflowTutorial,part3—Addingshellcode

09-03-2011

StephenBradshaw

16 https://web.archive.org/web/201310071419...SmashingthestackinWindows8

xx-09-2011

DavideQuarta

17 http://research.reversingcode.com/index....

AppleQuickTimePlayerH.264issues

01-09-2011

rmallof

18 http://blogs.securiteam.com/index.php/ar...VMwareUDFStackBufferOverflow

10-10-2011

SecventureGroup

19 http://www.greyhathacker.net/?p=380

RemoteExecComputersListBuffer

06-11- Parvez

ITSecurityCatalog


http://www.exploit-db.com/exploits/9177/




http://www.zerodayinitiative.com/advisories/ZDI-10-169/



http://www.exploit-db.com/docs/16030.pdf

http://0x1byte.blogspot.co.il/2011/02/cve-2010-3333-microsoft-office-rtf-file.html

http://resources.infosecinstitute.com/stack-based-buffer-overflow-tutorial-part-1-%E2%80%94-introduction/

http://resources.infosecinstitute.com/stack-based-buffer-overflow-tutorial-part-2-%E2%80%94-exploiting-the-stack-overflow/

http://resources.infosecinstitute.com/stack-based-buffer-overflow-tutorial-part-3-%E2%80%94-adding-shellcode/

https://web.archive.org/web/20131007141933/http://inseclab.org/papers/smashing_w8_stack.pdf

http://research.reversingcode.com/index.php/advisories/75-apple-quicktime-player-h264-issues

http://blogs.securiteam.com/index.php/archives/1558

http://www.greyhathacker.net/?p=380

OverflowROPExploit

2011


ATextbookBufferOverflow:ALookattheFreeBSDtelnetdCode

25-12-2011

DustinSchultz

21 http://www.poppopret.org/?p=40

AnatomyofaSCADAExploit:Part1–FromOverflowtoEIP

07-01-2012

MichaelCoppola


HeapsprayinginInternetExplorerwithropnops

19-06-2012

Parvez

23 http://www.poppopret.org/?p=141

AnatomyofaSCADAExploit:Part2–FromEIPtoShell

21-08-2012

MichaelCoppola

24 https://community.rapid7.com/community/m...

NewMetapsloitExploit:SAPNetWeaverCVE-2012-2611

06-09-2012

JuanVasquez

25 http://www.devttys0.com/2012/10/exploiti...ExploitingaMIPSStackOverflow

08-10-2012

Craig

26 http://www.cyvera.com/how-to-exploit-cve...

HOWTOEXPLOITCVE-2010-3333

28-11-2012

GalBadishi

27 http://shar33f12.blogspot.com.es/2012/10... ROP01-11-2012

shareef12

28 http://www.exploit-db.com/papers/24085/

StackSmashingOnAModernLinuxSystem

21-12-2012

jip

29 http://blog.exodusintel.com/2013/01/07/w...DoS?ThenWhoWas

07-01- exodusintel.com

ITSecurityCatalog





https://web.archive.org/web/20131207185058/http://thexploit.com/secdev/a-textbook-buffer-overflow-a-look-at-the-freebsd-telnetd-code/

http://www.poppopret.org/?p=40


http://www.poppopret.org/?p=141

https://community.rapid7.com/community/metasploit/blog/2012/09/06/cve-2012-2611-the-walk-to-the-shell

http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/

http://www.cyvera.com/how-to-exploit-cve-2010-3333/

http://shar33f12.blogspot.com.es/2012/10/rop.html

http://www.exploit-db.com/papers/24085/

Phone? 2013

30 http://sitsec.net/blog/2013/04/22/stack-...

Stack-basedBufferOverflowintheVPNSoftwaretincforAuthenticatedPeers

22-04-2013

MartinSchobert


Analysisofnginx1.3.9/1.4.0stackbufferoverflowandx64exploitation(CVE-2013-2028)

21-05-2013

w00d


Smashingthestack,anexamplefrom2013

17-08-2013

BenjaminRandazzo

33 http://csmatt.com/notes/?p=96

MIPSBufferOverflowswithBowcaster

13-10-2013

MattDefenthaler

34 http://funoverip.net/2013/10/watchguard-...

WatchGuard–CVE-2013-6021–StackBasedBufferOverflowExploit

27-10-2013

foip

35 http://dl.packetstormsecurity.net/papers...

64BitsLinuxStackBasedBufferOverflow

09-06-2014

Mr.Un1k0d3r

36 https://hatriot.github.io/blog/2015/01/0...NtpdcLocalBufferOverflow

06-01-2015

BryanAlexander

37 http://blog.techorganic.com/2015/04/10/64...

64-bitLinuxStackSmashingTutorial:Part1

10-04-2015

superkojiman

38 http://blog.techorganic.com/2015/04/21/64...

64-bitLinuxStackSmashing

21-04- superkojiman

ITSecurityCatalog






http://blog.exodusintel.com/2013/01/07/who-was-phone/


http://sitsec.net/blog/2013/04/22/stack-based-buffer-overflow-in-the-vpn-software-tinc-for-authenticated-peers/

https://web.archive.org/web/20130708073635/http://www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028


http://csmatt.com/notes/?p=96

http://funoverip.net/2013/10/watchguard-cve-2013-6021-stack-based-buffer-overflow-exploit/

http://dl.packetstormsecurity.net/papers/attack/64bit-overflow.pdf

https://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/

http://blog.techorganic.com/2015/04/10/64-bit-linux-stack-smashing-tutorial-part-1/

38 http://blog.techorganic.com/2015/04/21/64... StackSmashingTutorial:Part2

21-04-2015

superkojiman

39 http://5d4a.wordpress.com/2010/10/13/my-... Smashingthestackin2010

xx-09-2015

MarianoGraziano,AndreaCugliari

40 http://googleprojectzero.blogspot.de/201...

Kaspersky:MoUnpackers,MoProblems.

22-09-2015

TavisOrmandy

UnicodeStackBufferOverrun

Nr URL Description Date Author OS/Arch

1 http://newsoft-tech.blogspot.com/2012/01...

MS11-014:thisisnotthebugyourarelookingfor…

10-01-2012

newsoft Windows,x86-32

CVE-2011-0039

2 http://www.floyd.ch/?p=629

AutomatedgenerationofcodealignmentcodeforUnicodebufferoverflowexploitation

17-01-2012

floyd Windows,x86-32 N/A

Heap-basedbufferoverrun

Out-of-boundsread/write

Off-by-oneerrors

ITSecurityCatalog





http://blog.techorganic.com/2015/04/21/64-bit-linux-stack-smashing-tutorial-part-2/

http://5d4a.wordpress.com/2010/10/13/my-smashing-improved/

http://googleprojectzero.blogspot.de/2015/09/kaspersky-mo-unpackers-mo-problems.html

http://newsoft-tech.blogspot.com/2012/01/ms11-014-this-is-not-bug-your-are.html


http://www.floyd.ch/?p=629


1 http://site.pi3.com.pl/adv/libopie-adv.t...

libopie__readrec()off-byone(FreeBSDftpdremotePoC)

27-05-2010

MaksymilianArciemowicz,Adam(pi3)Zabrocki

2 https://drive.google.com/file/d/0B6P-iHu...

Skypev5.9.0.123andBelowRemoteDefaultUnauthenticatedOff-By-One

06-10-2012

KostyaKortchinsky

3 http://doar-e.github.io/blog/2013/09/09/...

PinpointingHeap-relatedIssues:OllyDbg2Off-by-oneStory

09-09-2013

Axel(0vercl0k)Souchet

4 http://googleprojectzero.blogspot.de/201...ThepoisonedNULbyte,2014edition

25-08-2014

ChrisEvans

Heapbufferoverrun

Nr URL Description Date

1 http://www.cgsecurity.org/exploit/heaptu... w00w00onHeapOverflows xx-01-1999

2 http://immunitysec.com/downloads/msrpche...,http://immunitysec.com/downloads/msrpche

ExploitingtheMSRPCHeapOverflow

11-09-2003

3 https://web.archive.org/web/201205211422...WindowsHeapOverflowExploitation

02-02-2004


WindowsHeapOverflowsusingtheProcessEnvironmentBlock(PEB)

31-05-2006

5 http://www.h-online.com/security/feature...

Aheapofrisk:Bufferoverflowsontheheapandhowtheyareexploited

28-06-2006

Engineering

ITSecurityCatalog




http://site.pi3.com.pl/adv/libopie-adv.txt

https://drive.google.com/file/d/0B6P-iHujNOX2dmluYW1wZmpCZW8/view

http://doar-e.github.io/blog/2013/09/09/pinpointing-heap-related-issues-ollydbg2-off-by-one-story/

http://googleprojectzero.blogspot.de/2014/08/the-poisoned-nul-byte-2014-edition.html

http://www.cgsecurity.org/exploit/heaptut.txt

http://immunitysec.com/downloads/msrpcheap.pdf

http://immunitysec.com/downloads/msrpcheap2.pdf

https://web.archive.org/web/20120521142247/http://lists.virus.org/darklab-0402/msg00000.html


http://www.h-online.com/security/features/A-Heap-of-Risk-747161.html

6 https://web.archive.org/web/201309030849... HeapOverowExploitswithJavaScript

08-09-2008

7 http://www.blackhat.com/presentations/bh...

PracticalWindowsXP/2003HeapExploitation

xx-07-09


0x41-weeklyexploitationmatters-Heapoverflowfundamentals

23-03-2010

9 http://blogs.cisco.com/security/comments...

ExploringHeap-BasedBufferOverflowswiththeApplicationVerifier

29-03-2010


TheDifferenceBetweenHeapOverflowandUseAfterFreeVulnerabilities

31-03-2010

11 http://index-of.es/Misc/HeapCacheExploi...

HeapCacheExploitation-WhitePaperbyIBMInternetSecuritySystems

xx-07-2010

12 https://web.archive.org/web/201110070918...HeapOverflowsForHumans–101

24-10-2010

13 https://web.archive.org/web/201112310609... WhenADoSIsn'tADoS 16-12-2010

14 http://www.vupen.com/blog/20101221.Exim_...

TechnicalAnalysisofExim"string_vformat()"BufferOverflowVulnerability

21-12-2010


FromPatchtoProof-of-Concept:MS10-081

10-01-2011

16 http://vreugdenhilresearch.nl/ms11-002-p...MS11-002Pwn2Ownheapoverflow

12-01-2011

ITSecurityCatalog





https://web.archive.org/web/20130903084923/http://securityevaluators.com/files/papers/isewoot08.pdf

http://www.blackhat.com/presentations/bh-usa-09/MCDONALD/BHUSA09-McDonald-WindowsHeap-PAPER.pdf

https://web.archive.org/web/20100327111150/http://www.crazylazy.info/blog/content/0x41-weekly-exploitation-matters-heap-overflow-fundamentals

http://blogs.cisco.com/security/comments/exploring_heap-based_buffer_overflows_with_the_application_verifier/

http://grey-corner.blogspot.com/2010/03/difference-between-heap-overflow-and.html

http://index-of.es/Misc/HeapCacheExploitation.pdf

https://web.archive.org/web/20111007091829/http://net-ninja.net/blog/?p=293

https://web.archive.org/web/20111231060956/http://www.breakingpointsystems.com/community/blog/ie-vulnerability

http://www.vupen.com/blog/20101221.Exim_string_vformat_Remote_Overflow_Analysis_CVE-2010-4344.php

https://web.archive.org/web/20111109031724/http://www.breakingpointsystems.com/community/blog/microsoft-vulnerability-proof-of-concept/

http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/

17 http://www.skullsecurity.org/blog/2011/a... Adeeperlookatms11-058 23-08-2011

18 https://web.archive.org/web/201110070919...HeapOverflowsForHumans–102

02-09-2011

19 http://www.vupen.com/blog/20120117.Advan...

Analysis&AdvancedExploitationofWindowsMultimediaLibraryHeapOverflow(MS12-004)

17-01-2012

20 https://web.archive.org/web/201502190758... HeapOverflowsForHumans104 11-03-2012


AdvancedExploitationofInternetExplorerHeapOverflow(Pwn2Own2012Exploit)

10-07-2012


New0dayExploits:NovellFileReporterVulnerabilities

16-11-2012


NewMetasploitExploit:CrystalReportsViewerCVE-2010-2590

19-12-2012

24 https://www.corelan.be/index.php/2013/02...

RootCauseAnalysis–MemoryCorruptionVulnerabilities

26-02-2013

25 http://blog.binamuse.com/2013/05/readerb...

AdobeReaderBMP/RLEheapcorruption-CVE-2013-2729

14-05-2013

26 http://blog.stalkr.net/2013/06/golang-he...

Golangheapcorruptionduringgarbagecollection

04-06-2013

TheDualUseExploit:CVE-2013-3906Used

ITSecurityCatalog







http://www.skullsecurity.org/blog/2011/a-deeper-look-at-ms11-058

https://web.archive.org/web/20111007091919/http://net-ninja.net/blog/?p=674

http://www.vupen.com/blog/20120117.Advanced_Exploitation_of_Windows_MS12-004_CVE-2012-0003.php

https://web.archive.org/web/20150219075803/http://net-ninja.net/article/2012/Mar/1/heap-overflows-for-humans-104/

http://www.vupen.com/blog/20120710.Advanced_Exploitation_of_Internet_Explorer_HeapOv_CVE-2012-1876.php

https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959

https://community.rapid7.com/community/metasploit/blog/2012/12/19/new-metasploit-exploit-crystal-reports-viewer-cve-2010-2590

https://www.corelan.be/index.php/2013/02/26/root-cause-analysis-memory-corruption-vulnerabilities/

http://blog.binamuse.com/2013/05/readerbmprle.html

http://blog.stalkr.net/2013/06/golang-heap-corruption-during-garbage.html

27 https://www.fireeye.com/blog/threat-rese... inBothTargetedAttacksandCrimewareCampaigns

07-11-2013

28 http://www.crowdstrike.com/blog/analysis...AnalysisofaCVE-2013-3906Exploit

09-12-2013

29 https://hackerone.com/reports/1356

PHPHeapOverflowVulnerabilityinimagecrop()

06-02-2014

30 http://h30499.www3.hp.com/t5/HP-Security...

TechnicalAnalysisofCVE-2014-1761RTFVulnerability

07-04-2014

31 http://radare.today/technical-analysis-o...

TechnicalAnalysisOfTheGnuTLSHelloVulnerability

01-06-2014


ZDI-14-173/CVE-2014-0195-OpenSSLDTLSFragmentOut-of-BoundsWrite:Breakingupishardtodo

05-06-2014

33 http://googleprojectzero.blogspot.de/201...pwn4funSpring2014-Safari-PartI

24-07-2014


AdvancedExploitationofVirtualBox3DAccelerationVMEscapeVulnerability(CVE-2014-0983)

25-07-2014

35 https://fail0verflow.com/blog/2014/hubca...HubCap:pwningtheChromeCastpt.1

29-08-2014

36 https://fail0verflow.com/blog/2014/hubca...HubCap:pwningtheChromeCastpt.2

04-09-2014


ExploitingCVE-2014-0556inFlash 23-09-2014

ITSecurityCatalog








https://www.fireeye.com/blog/threat-research/2013/11/the-dual-use-exploit-cve-2013-3906-used-in-both-targeted-attacks-and-crimeware-campaigns.html


http://www.crowdstrike.com/blog/analysis-cve-2013-3906-exploit/index.html

https://hackerone.com/reports/1356

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Technical-Analysis-of-CVE-2014-1761-RTF-Vulnerability/ba-p/6440048#.U0MYW_ldV8F

http://radare.today/technical-analysis-of-the-gnutls-hello-vulnerability/

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002

http://googleprojectzero.blogspot.de/2014/07/pwn4fun-spring-2014-safari-part-i_24.html

http://www.vupen.com/blog/20140725.Advanced_Exploitation_VirtualBox_VM_Escape.php

https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt1.html

https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt2.html

http://googleprojectzero.blogspot.de/2014/09/exploiting-cve-2014-0556-in-flash.html

Flash

38 http://acez.re/ps-vita-level-1-webkittie... PSVitaLevel1:Webkitties 31-10-2014

39 https://labs.integrity.pt/articles/from-...

FROM0-DAYTOEXPLOIT–BUFFEROVERFLOWINBELKINN750(CVE-2014-1635)

06-11-2014

40 http://blog.beyondtrust.com/cve-2014-182...

CVE-2014-1824–ANewWindowsFuzzingTarget

25-11-2014

41 http://www.openwall.com/lists/oss-securi...GHOST:glibcgethostbynamebufferoverflow

27-05-2015

42 http://www.isightpartners.com/2015/07/mi...

MicrosoftOfficeZero-DayCVE-2015-2424LeveragedByTsarTeam

15-07-2015

43 http://blogs.cisco.com/security/talos/ap...

VulnerabilitySpotlight:AppleQuicktimeCorruptstblAtomRemoteCodeExecution

30-07-2015

44 http://blog.trendmicro.com/trendlabs-sec...

MediaServerTakesAnotherHitwithLatestAndroidVulnerability

17-08-2015

45 https://blog.exodusintel.com/2015/08/13/... 13-08-2015 JordanGruskovnjak

46 http://googleprojectzero.blogspot.de/201... 16-09-2015 MarkBrand

47 http://blog.fortinet.com/post/windows-jo...

WindowsJournalVulnerabilityDisclosedPlusAWeekendBonus

18-09-2015

ExploitingHeapCorruptiondueto

ITSecurityCatalog









http://acez.re/ps-vita-level-1-webkitties-3/

https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/

http://blog.beyondtrust.com/cve-2014-1824-searching-for-windows-attack-surface

http://www.openwall.com/lists/oss-security/2015/01/27/9

http://www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/

http://blogs.cisco.com/security/talos/apple-stbl-atom

http://blog.trendmicro.com/trendlabs-security-intelligence/mediaserver-takes-another-hit-with-latest-android-vulnerability/

https://blog.exodusintel.com/2015/08/13/stagefright-mission-accomplished/

http://googleprojectzero.blogspot.de/2015/09/stagefrightened.html

http://blog.fortinet.com/post/windows-journal-vulnerability-disclosed-plus-a-weekend-bonus

https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege-wp.pdf

inAndroidlibcutils

Global,staticdataoverrun,and.bssoverrun

Datasegmentcontainsinitializedstaticlocalandglobaldata.BSS(BlockStartedbySymbol)segmentcontainsuninitializedstaticlocalandglobaldata.


1 http://roeehay.blogspot.com/2008/10/grap...

GraphvizBufferOverflowCodeExecution

08-10-2008

RoeeHay -

Formatstringinjection

ITSecurityCatalog











http://roeehay.blogspot.com/2008/10/graphviz-buffer-overflow-code-execution.html


1 https://docs.google.com/viewer?a=v&pid=e...

Windows2000FormatStringVulnerabilities

01-05-2001

DavidLitchfield

2 http://crypto.stanford.edu/cs155old/cs15...ExploitingFormatStringVulnerabilities

01-09-2001

scut/teamteso

3 https://web.archive.org/web/201012121658...Formatstringexploitationonwindows

02-02-2009

AbyssecInc

4 http://infond.blogspot.com/2010/07/tutor...Tutorialexploitationformatstring

30-07-2010

infond

5 https://docs.google.com/viewer?a=v&pid=e...Formatstrings,from%xtocalc

24-10-2010

mr_me

6 http://www.exploit-monday.com/2011/06/le...

LeveragingformatstringvulnerabilitiestointerrogateWin32processmemory

20-06-2011

MattGraeber

7 http://www.viva64.com/en/b/0129/

Wadenotinunknownwaters.Parttwo

01-02-2012

AndreyKarpov

8 http://www.vnsecurity.net/research/2012/...

ExploitingSudoformatstringvunerability

16-02-2012

longlg


EIP-2012-0001:Whenwrappingitupgoeswrong…

29-08-2012

exodusintel

IntegerVulnerabilitiesIncludesintegeroverflows,underflows,signednessissues,truncationerrors.


ITSecurityCatalog


https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B64ViR5GhSKIYWFmODIyY2UtMGNjOS00MGIyLWFhZDAtNWVmNjFlMjJhZjg2&hl=en

http://crypto.stanford.edu/cs155old/cs155-spring08/papers/formatstring-1.2.pdf

https://web.archive.org/web/20101212165804/http://abysssec.com/blog/wp-content/uploads/2009/02/fstring-exploit.pdf

http://infond.blogspot.com/2010/07/tutorial-exploitation-format-string.html

https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=1kS09rUfzbUduLk6GLj16J3FsKoHRZDE84vAXxw_1G5T_hV2-1Chq6k9LYkV5&hl=en

http://www.exploit-monday.com/2011/06/leveraging-format-string.html

http://www.viva64.com/en/b/0129/

http://www.vnsecurity.net/research/2012/02/16/exploiting-sudo-format-string-vunerability.html

https://web.archive.org/web/20121103112002/http://blog.exodusintel.com/2012/08/29/when-wrapping-it-up-goes-wrong

1 http://blogs.msdn.com/b/oldnewthing/arch... Integeroverflowinthenew[]operator

01-29-2004

2 http://www.fefe.de/intof.html CatchingIntegerOverflowsinC

01-26-2007

3 http://dividead.wordpress.com/2009/06/01... glibctimezoneintegeroverflow

01-06-2009

4 http://roeehay.blogspot.com/2009/06/appl...

AppleQuickTimeImageDescriptionAtomSignExtensionMemoryCorruption

02-06-2009

5 http://site.pi3.com.pl/adv/xpdf.txt

Xpdf-IntegeroverflowwhichcausesheapoverflowandNULLpointerderefernce

06-07-2009

6 http://roeehay.blogspot.com/2009/08/advi...

Advisory:AdobeFlashPlayerandAIRAVM2intf_countIntegerOverflow

02-08-2009

7 https://code.google.com/p/em386/download... CVE-2009-3608-explained

01-10-2009

8 http://site.pi3.com.pl/adv/mod_proxy.txt

Mod_proxyfromapache1.3-Integeroverflowwhichcausesheapoverflow

27-01-2010

9 http://projects.webappsec.org/Integer-Ov... IntegerOverflowsxx-01-2010


Adelicious,yetslightlycoldbanquettepreparedonthe(jump)table

xx-03-2010(?)

11 https://www.securecoding.cert.org/conflu...

INT32-C.Ensurethatoperationsonsignedintegersdonotresultinoverflow

09-09-2010

12 http://cissrt.blogspot.com/2011/02/cve-2...

CVE-2011-0045:MSWindowsXPWmiTraceMessageVaIntegerTruncationVulnerability

26-02-2011

ITSecurityCatalog


http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0809

http://blogs.msdn.com/b/oldnewthing/archive/2004/01/29/64389.aspx

http://www.fefe.de/intof.html

http://dividead.wordpress.com/2009/06/01/glibc-timezone-integer-overflow/

http://roeehay.blogspot.com/2009/06/apple-quicktime-image-description-atom.html

http://site.pi3.com.pl/adv/xpdf.txt

http://roeehay.blogspot.com/2009/08/advisory-adobe-flash-player-avm2.html

https://code.google.com/p/em386/downloads/detail?name=CVE-2009-3608-explained.txt&can=2&q=

http://site.pi3.com.pl/adv/mod_proxy.txt

http://projects.webappsec.org/Integer-Overflows

https://web.archive.org/web/20110722113700/http://www.nodefense.org/eglibc.txt

https://www.securecoding.cert.org/confluence/display/c/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow

http://cissrt.blogspot.com/2011/02/cve-2011-0045-ms-windows-xp.html

13 http://scarybeastsecurity.blogspot.de/20...libxmlvulnerabilityandinterestingintegerissues

27-05-2011

14 https://bugzilla.mozilla.org/show_bug.cg...MozillaFirefox4.0.1Array.reduceRight()Vulnerability

14-06-2011


Exploitingglibc__tzfile_readintegeroverflowtobufferoverflowandvsftpd

13-12-2011


Moreonexploitingglibc__tzfile_readintegeroverflowtobufferoverflowandvsftpd

15-12-2011

17 http://kqueue.org/blog/2012/01/10/cve-20...CVE-2012-0038:XFSACLcountintegeroverflow

10-01-2012

18 http://www.halfdog.net/Security/2011/Apa... ApacheModSetEnvIfIntegerOverflow

11-01-2012

19 http://gdtr.wordpress.com/2012/02/22/exp...

ExploitingCVE-2011-2371(FFreduceRight)withoutnon-ASLRmodules

22-02-2012

20 http://kqueue.org/blog/2012/04/12/cve-20... CVE-2012-2100:afixtofixafixinext4

12-04-2012

21 http://axtaxt.wordpress.com/2012/07/08/a...AnalysisofCVE-2011-3545(ZDI-11-307)

08-07-2012

22 http://labs.mwrinfosecurity.com/blog/201...

MWRLabsPwn2Own2013Write-up-WebkitExploit

19-04-2013


AdvancedExploitationofInternetExplorer10/Windows8Overflow(Pwn2Own2013)

22-05-2013

24 https://www.corelan.be/index.php/2013/07... RootCauseAnalysis–IntegerOverflows

02-07-2013

25 http://secunia.com/blog/in-memory-of-a-z...Inmemoryofazero-day–MS13-051

01-11-

ITSecurityCatalog






http://scarybeastsecurity.blogspot.de/2011/05/libxml-vulnerability-and-interesting.html

https://bugzilla.mozilla.org/show_bug.cgi?id=664009

https://web.archive.org/web/20120108091405/http://rcvalle.com/post/14169476482/exploiting-glibc-tzfile-read-integer-overflow-to

https://web.archive.org/web/20120108091453/http://rcvalle.com/post/14261796328/more-on-exploiting-glibc-tzfile-read-integer-overflow

http://kqueue.org/blog/2012/01/10/cve-2012-0038-xfs-acl-count-integer-overflow/

http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/

http://gdtr.wordpress.com/2012/02/22/exploiting-cve-2011-2371-without-non-aslr-modules/

http://kqueue.org/blog/2012/04/12/cve-2012-2100-a-fix-to-fix-a-fix-in-ext4/

http://axtaxt.wordpress.com/2012/07/08/analysis-of-cve-2011-3545/

http://labs.mwrinfosecurity.com/blog/2013/04/19/mwr-labs-pwn2own-2013-write-up---webkit-exploit/

http://www.vupen.com/blog/20130522.Advanced_Exploitation_of_IE10_Windows8_Pwn2Own_2013.php

https://www.corelan.be/index.php/2013/07/02/root-cause-analysis-integer-overflows/

day–MS13-051 2013

26 http://blog.securitymouse.com/2014/06/ra...RaisingLazarus-The20YearOldBugthatWenttoMars

26-06-2014

27 http://blog.lekkertech.net/blog/2014/07/...LZO,onintegeroverflowsandauditing

02-07-2014

28 http://googleprojectzero.blogspot.de/201...AnalysisandExploitationofanESETVulnerability

23-06-2015

29 http://googleprojectzero.blogspot.fr/201... When‘int’isthenew‘short’

07-07-2015

30 http://blogs.flexerasoftware.com/vulnera...

VulnerabilityinMicrosoft'sUnicodeScriptsProcessorallowsexecutionofarbitrarycode

11-12-2015

NULLpointerissues

ITSecurityCatalog












http://secunia.com/blog/in-memory-of-a-zero-day--ms13-051-385/


http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html

http://blog.lekkertech.net/blog/2014/07/02/LZO-on-integer-overflows-and-auditing/

http://googleprojectzero.blogspot.de/2015/06/analysis-and-exploitation-of-eset.html

http://googleprojectzero.blogspot.fr/2015/07/when-int-is-new-short.html

http://blogs.flexerasoftware.com/vulnerability-management/2015/12/vulnerability-in-microsofts-unicode-scripts-processor-allows-execution-of-arbitrary-code.html

Nr URL Description

1 http://www.theregister.co.uk/2007/06/13/...

Embeddedproblems:exploitingNULLpointerdereferences

2 http://searchsecurity.techtarget.com.au/...

Q&A:MarkDowdonNULLpointerdereferencebugs

3 https://web.archive.org/web/20090706021311/http://blogs.iss.net/archive/cve-2008-0017.html...

WhatYouMayHaveMissedAboutCVE-2008-0017:AFirefoxNULLDereferenceBug

4 http://j00ru.vexillium.org/?p=932

CVE-2011-1282:User-ModeNULLPointerDereference&co.

Datatypeconfusion

Nr URL Description

1 http://em386.blogspot.com/2010/12/webkit... WebKitCSSTypeConfusion

2 http://www.vupen.com/blog/20110326.Techn...

TechnicalAnalysisandAdvancedExploitationofAdobeFlash0-Day(CVE-2011-0609)

3 http://blogs.technet.com/b/mmpc/archive/...AnalysisoftheCVE-2011-0611AdobeFlashPlayervulnerabilityexploitation

4 http://secunia.com/blog/210

AdobeFlashPlayer0-dayExploitAnalysis(CVE-2011-

ITSecurityCatalog



http://www.theregister.co.uk/2007/06/13/null_exploit_interview/

http://searchsecurity.techtarget.com.au/news/2240019328/QA-Mark-Dowd-on-NULL-pointer-dereference-bugs

https://web.archive.org/web/20090706021311/http://blogs.iss.net/archive/cve-2008-0017.html

http://j00ru.vexillium.org/?p=932

http://em386.blogspot.com/2010/12/webkit-css-type-confusion.html

http://www.vupen.com/blog/20110326.Technical_Analysis_and_Win7_Exploitation_Adobe_Flash_0Day_CVE-2011-0609.php

http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx

http://secunia.com/blog/210

0611)

5 http://www.offensive-security.com/vulnde... CAARCserveCVE-2012-2971

6 http://blogs.technet.com/b/srd/archive/2...ThestoryofMS13-002:Howincorrectlycastingfatpointerscanmakeyourcodeexplode

7 https://www.sektioneins.de/en/blog/14-08...

SPLArrayObject/SPLObjectStorageUnserializationTypeConfusionVulnerabilities

7 http://blog.azimuthsecurity.com/2015/01/...Bl8ckPwn:BlackPhoneSilentTextTypeConfusionVulnerability

9 http://googleprojectzero.blogspot.de/201... ATaleofTwoExploits

10 http://blogs.technet.com/b/mmpc/archive/... Understandingtypeconfusionvulnerabilities:CVE-2015-0336

11 http://googleprojectzero.blogspot.com/20... OnePerfectBug:ExploitingTypeConfusioninFlash

12 http://googleprojectzero.blogspot.de/201... AttackingECMAScriptEngineswithRedefinition

ITSecurityCatalog








http://www.offensive-security.com/vulndev/ca-arcserve-rwslist-remote-code-execution/

http://blogs.technet.com/b/srd/archive/2013/08/06/the-story-of-ms13-002-how-incorrectly-casting-fat-pointers-can-make-your-code-explode.aspx

https://www.sektioneins.de/en/blog/14-08-27-unserialize-typeconfusion.html

http://blog.azimuthsecurity.com/2015/01/blackpwn-blackphone-silenttext-type.html

http://googleprojectzero.blogspot.de/2015/04/a-tale-of-two-exploits.html

http://blogs.technet.com/b/mmpc/archive/2015/06/18/understanding-type-confusion-vulnerabilities-cve-2015-0336.aspx

http://googleprojectzero.blogspot.com/2015/07/one-perfect-bug-exploiting-type_20.html

http://googleprojectzero.blogspot.de/2015/08/attacking-ecmascript-engines-with.html

Objectlifetimeissues

Use-after-free

Nr URL Description

1 https://www.blackhat.com/presentations/b... DanglingPointer-SmashingthePointerforFunandProfit

2 http://grey-corner.blogspot.com/2010/01/...HeapSprayExploitTutorial:InternetExplorerUseAfterFreeAuroraVulnerability

3 http://d0cs4vage.blogspot.com/2011/06/in...Insecticidesdon'tkillbugs,PatchTuesdaysdo(use-after-free)

4 http://www.exploit-monday.com/2011/07/po...Post-mortemAnalysisofaUse-After-FreeVulnerability(CVE-2011-1260)

5 http://blogs.norman.com/2011/malware-det... DragandDropVulnerabilityinMS11-050

6 http://picturoku.blogspot.com/2011/08/di... Diariesofavulnerability:UnderstandingCVE-2011-1260

7 http://picturoku.blogspot.com/2011/09/di...Diariesofavulnerability-take2:Stage1exploit-ControllingEIP

8 http://picturoku.blogspot.com/2011/11/di...Diariesofavulnerability-take3:Prayafterfreeanduseafterpray

9 https://community.qualys.com/blogs/secur... MS11-077:FromPatchtoProof-of-Concept

10 http://www.vupen.com/blog/20120110.Techn...

TechnicalAnalysisofProFTPDResponsePoolRemoteUse-after-free(CVE-2011-4130)-PartI


AdvancedExploitationofProFTPDResponsePoolUse-after-free(CVE-2011-4130)-PartII

12 http://ifsec.blogspot.com/2012/02/reliab...,PoC

ReliableWindows7Exploitation:ACaseStudy

ITSecurityCatalog














https://www.blackhat.com/presentations/bh-usa-07/Afek/Whitepaper/bh-usa-07-afek-WP.pdf

http://grey-corner.blogspot.com/2010/01/heap-spray-exploit-tutorial-internet.html

http://d0cs4vage.blogspot.com/2011/06/insecticides-dont-kill-bugs-patch.html

http://www.exploit-monday.com/2011/07/post-mortem-analysis-of-use-after-free_07.html

http://blogs.norman.com/2011/malware-detection-team/drag-and-drop-vulnerability-in-ms11-050

http://picturoku.blogspot.com/2011/08/diaries-of-vulnerability.html

http://picturoku.blogspot.com/2011/09/diaries-of-vulnerability-take-2.html

http://picturoku.blogspot.com/2011/11/diaries-of-vulnerability-take-3.html

https://community.qualys.com/blogs/securitylabs/2011/12/02/ms11-077-from-patch-to-proof-of-concept

http://www.vupen.com/blog/20120110.Technical_Analysis_of_ProFTPD_Remote_Use_after_free_CVE-2011-4130_Part_I.php

http://www.vupen.com/blog/20120116.Advanced_Exploitation_of_ProFTPD_Remote_Use_after_free_CVE-2011-4130_Part_II.php

http://ifsec.blogspot.com/2012/02/reliable-windows-7-exploitation-case.html

http://seclists.org/bugtraq/2012/Feb/178

13 http://dvlabs.tippingpoint.com/blog/2012... Pwn2OwnChallenges:Heapspraysareforthe99%

14 http://www.vupen.com/blog/20120625.Advan...AdvancedExploitationofMozillaFirefoxUse-after-freeVulnerability(MFSA2012-22)

15 http://blog.exodusintel.com/2013/01/02/h... HappyNewYearAnalysisofCVE-2012-4792

16 http://scarybeastsecurity.blogspot.de/20... Exploiting64-bitLinuxlikeaboss

17 http://securityintelligence.com/use-afte...Use-after-frees:Thatpointermaybepointingtosomethingbad

18 http://blog.trailofbits.com/2013/05/20/w... WritingExploitswiththeElderwoodKit(Part2)

19 https://securityintelligence.com/cve-201...

CVE-2013-1347:MicrosoftInternetExplorerCGenericElementobjectUse-After-FreeVulnerability

20 http://blogs.technet.com/b/srd/archive/2...ThestoryofMS13-002:Howincorrectlycastingfatpointerscanmakeyourcodeexplode

21 http://h30499.www3.hp.com/t5/blogs/bloga...CVE-2013-3112:FromNULLtoControl-Persistencepaysoffwithcrashes

22 http://cyvera.com/cve-2013-3893-analysis... CVE-2013-3893–ANALYSISOFTHENEWIE0-DAY

23 http://cyvera.com/cve-2013-3897-analysis... CVE-2013-3897–ANALYSISOFYETANOTHERIE0-DAY

24 http://blog.spiderlabs.com/2013/10/anoth... AnotherDay,SpiderLabsDiscoversAnotherIEZero-Day

25 http://blog.spiderlabs.com/2013/10/ie-ze...TheTechnicalAspectsofExploitingIEZero-DayCVE-2013-3897

26 http://nakedsecurity.sophos.com/2013/10/...Anatomyofanexploit-insidetheCVE-2013-3893Internet

ITSecurityCatalog














http://dvlabs.tippingpoint.com/blog/2012/03/15/pwn2own-2012-challenge-writeup

http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php

http://blog.exodusintel.com/2013/01/02/happy-new-year-analysis-of-cve-2012-4792/

http://scarybeastsecurity.blogspot.de/2013/02/exploiting-64-bit-linux-like-boss.html

http://securityintelligence.com/use-after-frees-that-pointer-may-be-pointing-to-something-bad/

http://blog.trailofbits.com/2013/05/20/writing-exploits-with-the-elderwood-kit-part-2/

https://securityintelligence.com/cve-2013-1347-microsoft-internet-explorer-cgenericelement-object-use-after-free-vulnerability/

http://blogs.technet.com/b/srd/archive/2013/08/06/the-story-of-ms13-002-how-incorrectly-casting-fat-pointers-can-make-your-code-explode.aspx

http://h30499.www3.hp.com/t5/blogs/blogarticleprintpage/blog-id/off-by-on-software-security-blog/article-id/97

http://cyvera.com/cve-2013-3893-analysis-of-the-new-ie-0-day/

http://cyvera.com/cve-2013-3897-analysis-of-yet-another-ie-0-day/

http://blog.spiderlabs.com/2013/10/another-day-another-ie-zero-day.html

http://blog.spiderlabs.com/2013/10/ie-zero-day-cve-2013-3897-technical-aspects.html

http://nakedsecurity.sophos.com/2013/10/11/anatomy-of-an-exploit-ie-zero-day-part-1/

Explorerzero-day-Part1

27 http://nakedsecurity.sophos.com/2013/10/...Anatomyofanexploit-insidetheCVE-2013-3893InternetExplorerzero-day-Part2

28 http://blog.exodusintel.com/2013/11/26/b... Abrowserisonlyasstrongasitsweakestbyte

29 http://www.fireeye.com/blog/technical/cy... CVE-2013-3346/5065TechnicalAnalysis

30 http://blog.exodusintel.com/2013/12/09/a... Abrowserisonlyasstrongasitsweakestbyte-Part2

31 http://carterjones.logdown.com/posts/201... CVE-2014-0301Analysis

32 http://vrt-blog.snort.org/2014/05/anatom... Anatomyofanexploit:CVE2014-1776

33 http://www.cyphort.com/blog/dig-deeper-i...DigdeeperintotheIEVulnerability(CVE-2014-1776)exploit

34 http://h30499.www3.hp.com/t5/HP-Security...Double-Dip:UsingthelatestIE0-daytogetRCEandanASLRBypass

35 http://h30499.www3.hp.com/t5/HP-Security...ThemechanismbehindInternetExplorerCVE-2014-1776exploits

36 http://www.vupen.com/blog/20140520.Advan...AdvancedExploitationofMozillaFirefoxUse-After-FreeVulnerability(Pwn2Own2014)

37 http://blog.trendmicro.com/trendlabs-sec...“Gifts”FromHackingTeamContinue,IEZero-DayAddedtoMix

RootCauseAnalysisofCVE-

ITSecurityCatalog














http://nakedsecurity.sophos.com/2013/10/25/anatomy-of-an-exploit-inside-the-cve-2013-3893-internet-explorer-zero-day-part-2/

http://blog.exodusintel.com/2013/11/26/browser-weakest-byte/

http://www.fireeye.com/blog/technical/cyber-exploits/2013/12/cve-2013-33465065-technical-analysis.html

http://blog.exodusintel.com/2013/12/09/a-browser-is-only-as-strong-as-its-weakest-byte-part-2/

http://carterjones.logdown.com/posts/2014/03/14/cve-2014-0301-analysis

http://vrt-blog.snort.org/2014/05/anatomy-of-exploit-cve-2014-1776.html

http://www.cyphort.com/blog/dig-deeper-ie-vulnerability-cve-2014-1776-exploit/

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Double-Dip-Using-the-latest-IE-0-day-to-get-RCE-and-an-ASLR/ba-p/6466280

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/The-mechanism-behind-Internet-Explorer-CVE-2014-1776-exploits/ba-p/6476220

http://www.vupen.com/blog/20140520.Advanced_Exploitation_Firefox_UaF_Pwn2Own_2014.php

http://blog.trendmicro.com/trendlabs-security-intelligence/gifts-from-hacking-team-continue-ie-zero-day-added-to-mix/

38 http://blog.trendmicro.com/trendlabs-sec... 2014-1772–AnInternetExplorerUseAfterFreeVulnerability

39 http://googleprojectzero.blogspot.de/201...ExploitingNVMAPtoescapetheChromesandbox-CVE-2014-5332

40 https://www.trustwave.com/Resources/Spid...ANewZero-DayofAdobeFlashCVE-2015-0313ExploitedintheWild

41 http://blog.trendmicro.com/trendlabs-sec... AnalyzingCVE-2015-0313:TheNewFlashPlayerZeroDay

42 https://blog.coresecurity.com/2015/04/13...AnalysisofAdobeFlashPlayersharedByteArrayUse-After-FreeVulnerability

43 http://labs.bromium.com/2015/07/07/adobe... AdobeFlashZeroDayVulnerabilityExposedtoPublic

44 http://blog.vectranetworks.com/blog/micr... MicrosoftInternetExplorer11Zero-day

45 http://blog.ropchain.com/2015/07/27/anal... AnalyzingVUPEN’sCVE-2012-1856

46 http://www.securityfocus.com/archive/1/5...

BFS-SA-2015-001:InternetExplorerCTreeNode::GetCascadedLangUse-After-FreeVulnerability

47 https://cxsecurity.com/issue/WLB-2015080... OpenSSH6.9p1AuthenticationBypass/Use-After-Free

48 https://labs.portcullis.co.uk/blog/cve-2...CVE-2015-5119FlashByteArrayUaF:Abeginner’swalkthrough

49 https://www.nccgroup.trust/uk/our-resear...ExploitingCVE-2015-1642MicrosoftOfficeCTaskSymbolUse-After-FreeVulnerability

50 https://www.nccgroup.trust/uk/our-resear... ExploitingCVE-2014-0282

51https://www.fireeye.com/blog/threat-rese...,https://www.fireeye.com/content/dam/... TheEPSAwakens

ITSecurityCatalog













http://blog.trendmicro.com/trendlabs-security-intelligence/root-cause-analysis-of-cve-2014-1772-an-internet-explorer-use-after-free-vulnerability/

http://googleprojectzero.blogspot.de/2015/01/exploiting-nvmap-to-escape-chrome.html

https://www.trustwave.com/Resources/SpiderLabs-Blog/A-New-Zero-Day-of-Adobe-Flash-CVE-2015-0313-Exploited-in-the-Wild/

http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2015-0313-the-new-flash-player-zero-day/

https://blog.coresecurity.com/2015/04/13/analysis-of-adobe-flash-player-shared-bytearray-use-after-free-vulnerability/

http://labs.bromium.com/2015/07/07/adobe-flash-zero-day-vulnerability-exposed-to-public/

http://blog.vectranetworks.com/blog/microsoft-internet-explorer-11-zero-day

http://blog.ropchain.com/2015/07/27/analyzing-vupens-cve-2012-1856/

http://www.securityfocus.com/archive/1/536187/30/0/threaded

https://cxsecurity.com/issue/WLB-2015080072

https://labs.portcullis.co.uk/blog/cve-2015-5119-flash-bytearray-uaf-a-beginners-walkthrough/

https://www.nccgroup.trust/uk/our-research/understanding-microsoft-word-ole-exploit-primitives/

https://www.nccgroup.trust/uk/our-research/exploiting-cve-2014-0282/

https://www.fireeye.com/blog/threat-research/2015/12/the_eps_awakens.html

https://www.fireeye.com/content/dam/...

Double-free


1 http://www.symantec.com/connect/blogs/do...,http://www.symantec.com/connect/blogs/do...

DoubleFreeVulnerabilities

19/22-01-2007

Article

2 http://blog.spiderlabs.com/2014/03/deep-...

DeepAnalysisofCVE-2014-0502–ADoubleFreeStory

12-03-2014

BenHayak

Raceconditions


1 http://cecs.wright.edu/~pmateti/Internet...RaceConditionExploits

xx-xx-2012

PrabhakerMateti

Non-memory-corruptionissues

Accesscontrolandpermissionproblems

ITSecurityCatalog













https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/twoforonefinal.pdf


https://web.archive.org/web/20100421054849/http://www.symantec.com/connect/blogs/double-free-vulnerabilities-part-1

https://web.archive.org/web/20100421054849/http://www.symantec.com/connect/blogs/double-free-vulnerabilities-part-2

http://blog.spiderlabs.com/2014/03/deep-analysis-of-cve-2014-0502-a-double-free-story.html

http://cecs.wright.edu/~pmateti/InternetSecurity/Lectures/RaceConditions/index.html


1 http://blog.zx2c4.com/749LinuxLocalPrivilegeEscalationviaSUID/proc/pid/memWrite

21-01-2012

2 http://googleprojectzero.blogspot.de/201... Didthe“ManWithNoName”FeelInsecure?

20-08-2014

3 http://googleprojectzero.blogspot.de/201...InternetExplorerEPMSandboxEscapeCVE-2014-6350

01-12-2014


EscapingtheInternetExplorerSandbox:AnalyzingCVE-2014-6349

03-12-2014

5 http://blog.trendmicro.com/trendlabs-sec...CVE-2015-0016:EscapingtheInternetExplorerSandbox

27-01-2015

6 https://truesecdev.wordpress.com/2015/07/... Exploitingrootpipeagain

01-07-2015

7 https://www.sektioneins.de/en/blog/15-07-...

OSX10.10DYLD_PRINT_TO_FILELocalPrivilegeEscalationVulnerability

07-07-2015

8 http://h30499.www3.hp.com/t5/HP-Security-...

Adobe'sCVE-2015-5090-UpdatingtheUpdatertobecomethebossman

16-07-2015

ImplementationErrors

ITSecurityCatalog



http://blog.zx2c4.com/749

http://googleprojectzero.blogspot.de/2014/10/did-man-with-no-name-feel-insecure.html

http://googleprojectzero.blogspot.de/2014/12/internet-explorer-epm-sandbox-escape.html

http://blog.trendmicro.com/trendlabs-security-intelligence/escaping-the-internet-explorer-sandbox-analyzing-cve-2014-6349/

http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-escaping-the-internet-explorer-sandbox/

https://truesecdev.wordpress.com/2015/07/01/exploiting-rootpipe-again/

https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Adobe-s-CVE-2015-5090-Updating-the-Updater-to-become-the-bossman/ba-p/6765412#.VafBNxNVikp


1 http://www.saurik.com/id/17Exploit(&Fix)Android"MasterKey"

xx-07-2013

JayFreeman(saurik)

2 http://www.contextis.com/resources/blog/...

EXPRESSINGYOURSELF:ANALYSISOFADOTNETELEVATIONOFPRIVILEGEVULNERABILITY

17-12-2013

JamesForshaw

3 http://security.coverity.com/blog/2014/N...

EricLippertDissectsCVE-2014-6332,a19year-oldMicrosoftbug

14-11-2014

EricLippert

4 http://researchcenter.paloaltonetworks.c...AddressingCVE-2014-6332SWFExploit

26-11-2014

AlonLivne

5 https://community.rapid7.com/community/me...

R7-2015-04Disclosure:MozillaFirefoxProxyPrototypeRCE(CVE-2014-8636)

23-03-2015

TodBeardsley

6 https://securityintelligence.com/one-clas...

OneClasstoRuleThemAll:NewAndroidSerializationVulnerabilityGivesUnderprivilegedAppsSuperStatus

10-08-2015

OrPeles,RoeeHay

7 http://rotlogix.com/2015/08/22/remote-cod...

RemoteCodeExecutioninDolphinBrowserforAndroid

22-08-2015

rotlogix


FireEyeExploitation:ProjectZero’sVulnerabilityoftheBeast

15-12-2015

TavisOrmandy

9 https://blog.coresecurity.com/2015/12/09/...ExploitingWindowsMediaCenter

09-12-2015

FranciscoFalcón

ITSecurityCatalog









http://www.saurik.com/id/17

http://www.contextis.com/resources/blog/expressing-yourself-analysis-dot-net-elevation/

http://security.coverity.com/blog/2014/Nov/eric-lippert-dissects-cve-2014-6332-a-19-year-old-microsoft-bug.html

http://researchcenter.paloaltonetworks.com/2014/11/addressing-cve-2014-6332-swf-exploit/

https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2015-04-disclosure-mozilla-firefox-proxy-prototype-rce-cve-2014-8636

https://securityintelligence.com/one-class-to-rule-them-all-new-android-serialization-vulnerability-gives-underprivileged-apps-super-status/

http://rotlogix.com/2015/08/22/remote-code-execution-in-dolphin-browser-for-android/

http://googleprojectzero.blogspot.de/2015/12/fireeye-exploitation-project-zeros.html

https://blog.coresecurity.com/2015/12/09/exploiting-windows-media-center/

Informationleakage


1 http://blog.binamuse.com/2014/09/coregra...

CoreGraphicsInformationDisclosure-CVE-2014-4378

18-09-2014

binamuse.com


EnablingQRcodesinInternetExplorer,orastoryofacross-platformmemorydisclosure

14-09-2015

Mateusz(j00ru)Jurczyk

Uninitializedmemory



AdvancedExploitationofIEMSXMLRemoteUninitializedMemory(MS12-043/CVE-2012-1889)

17-07-2012

NicolasJoly

2 http://immunityproducts.blogspot.de/2013...

AdobeXFAexploitsforall!FirstPart:TheInfo-leak

24-06-2013

NicoWaisman

3 http://labs.portcullis.co.uk/blog/cve-20...

CVE-2013-0640:AdobeReaderXFAoneOfChildUn-initializedmemory

26-09-2013

MTB

ITSecurityCatalog










http://blog.binamuse.com/2014/09/coregraphics-information-disclosure.html

http://googleprojectzero.blogspot.de/2015/09/enabling-qr-codes-in-internet-explorer.html

http://www.vupen.com/blog/20120717.Advanced_Exploitation_of_Internet_Explorer_XML_CVE-2012-1889_MS12-043.php

http://immunityproducts.blogspot.de/2013/06/adobe-xfa-exploits-for-all-first-part.html

http://labs.portcullis.co.uk/blog/cve-2013-0640-adobe-reader-xfa-oneofchild-un-initialized-memory-vulnerability-part-1/

vulnerability(part1)


CVE-2013-0640:AdobeReaderXFAoneOfChildUn-initializedmemoryvulnerability(part2)

15-10-2013

MTB

5 http://ifsec.blogspot.de/2013/11/exploit...

ExploitingInternetExplorer1164-bitonWindows8.1Preview

06-11-2013

IvanFratric

6 https://labs.mwrinfosecurity.com/system...

MicrosoftOfficeUninitialisedMemoryUseVulnerability

25-06-2015

YongChuan,Koh

7 http://sourceincite.com/2015/11/16/ms15-...

MS15-116–PARSETHE[POINT]EROFNORETURN

16-11-2015

Steven

8 https://www.blackhat.com/docs/eu-15/mate...

HeyMan,HaveYouForgottentoInitializeYourMemory?

xx-xx-2015

Qihoo360VulcanTeam

Logicerrors

ITSecurityCatalog










http://labs.portcullis.co.uk/blog/cve-2013-0640-adobe-reader-xfa-oneofchild-un-initialized-memory-vulnerability-part-2/

http://ifsec.blogspot.de/2013/11/exploiting-internet-explorer-11-64-bit.html

https://labs.mwrinfosecurity.com/system/assets/987/original/mwri_advisory_cve-2015-1770.pdf

http://sourceincite.com/2015/11/16/ms15-116-parse-the-pointer-of-no-return/

https://www.blackhat.com/docs/eu-15/materials/eu-15-Chen-Hey-Man-Have-You-Forgotten-To-Initialize-Your-Memory-wp.pdf


1 https://code.google.com/p/google-securit...

Flashlogicerrorinbytecodeverifier

15-09-2014

IanBerr -


TechnicalanalysisoftheSandWormVulnerability(CVE-2014-4114)

20-10-2014

MattOh Windows

3 https://blogs.mcafee.com/mcafee-labs/byp...

BypassingMicrosoft’sPatchfortheSandwormZeroDay:aDetailedLookattheRootCause

11-11-2014

HaifeiLi Windows

4 https://blogs.mcafee.com/mcafee-labs/byp...

BypassingMicrosoft’sPatchfortheSandwormZeroDay:Even‘Editing’CanCauseHarm

12-11-2014

HaifeiLi Windows

5 https://www.fireeye.com/blog/threat-rese...

CVE-2015-0097ExploitedintheWild

30-07-2015

SudeepSingh,KennethHsu

Windows

6 https://github.com/QubesOS/qubes-secpack...

CriticalXenbuginPVmemoryvirtualizationcode(XSA148)

29-10-2015

TheQubesSecurityTeam

XEN

Chainedandmultiplebugs

Chainedbugs

ITSecurityCatalog






https://code.google.com/p/google-security-research/issues/detail?id=106

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Technical-analysis-of-the-SandWorm-Vulnerability-CVE-2014-4114/ba-p/6649758?device-view=desktop#.VEUxOfl4rYi

https://blogs.mcafee.com/mcafee-labs/bypassing-microsofts-patch-sandworm-zero-day-root-cause

https://blogs.mcafee.com/mcafee-labs/bypassing-microsofts-patch-for-the-sandworm-zero-day-even-editing-can-cause-harm

https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-0097_exploi.html

https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-022-2015.txt


1 http://blog.chromium.org/2012/05/tale-of...ATaleofTwoPwnies(Part1)

22-05-2012

JorgeLucangeliObes,JustinSchuh

2 http://blog.chromium.org/2012/06/tale-of...ATaleOfTwoPwnies(Part2)

11-06-2012

KenBuchanan,ChrisEvans,CharlieReis,TomSepez

3 https://web.archive.org/web/201408191742... PostpwniumWriteup

11-06-2013

Ralf-PhilippWeinmann


HowImetFirefox:Ataleaboutchainedvulnerabilities

02-10-2013

Sebastian


AKillerCombo:CriticalVulnerabilityand‘Godmode’ExploitationonCVE-2014-6332

13-11-2014

WeiminWu

6 http://researchcenter.paloaltonetworks.c...

GoogleChromeExploitation–ACaseStudy

14-12-2014

AlonLivne

7 http://newosxbook.com/articles/28DaysLat...28DaysLater-TaiG2(Partthe1st)

23-07-2015

JonathanLevin

ITSecurityCatalog





http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.html

http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.html

https://web.archive.org/web/20140819174220/http://rpw.io/blog/2013/06/11/postpwnium_writeup

https://web.archive.org/web/20150209112120/https://www.nowsecure.com/blog/2013/10/02/chained-vulnerabilities-firefox-android-pimp-browser/

http://blog.trendmicro.com/trendlabs-security-intelligence/a-killer-combo-critical-vulnerability-and-godmode-exploitation-on-cve-2014-6332/

http://researchcenter.paloaltonetworks.com/2014/12/google-chrome-exploitation-case-study/

http://newosxbook.com/articles/28DaysLater.html

Multiplebugs


1 http://www.cis.syr.edu/~wedu/Teaching/Co...

Buffer-OverflowVulnerabilitiesandAttacks

??? KevinDu

2 https://lock.cmpxchg8b.com/sophailv2.pdf

Sophail:AppliedattacksagainstSophosAntivirus

xx-10-2012

TavisOrmandy

3 http://kqueue.org/blog/2012/03/05/memory...

Memoryallocatorsecurityrevisited

05-03-2012

XiWang

4 http://antid0te.com/syscan_2013/SyScan20...

MountainLion/iOSVulnerabilitiesGarageSale

24-04-2013

StefanEsser

5 http://blog.azimuthsecurity.com/2013/06/...

AttackingCryptoPhones:WeaknessesinZRTPCPP

27-06-2013

MarkDowd

6 http://seclists.org/fulldisclosure/2014/...

Informationonrecently-fixedOracleVMVirtualBoxvulnerabilities

07-02-2014

MatthewDaley


Findingandexploitingntpdvulnerabilities

02-0-1-2015

StephenRöttger

SAPLZC

ITSecurityCatalog











http://www.cis.syr.edu/~wedu/Teaching/CompSec/LectureNotes_New/Buffer_Overflow.pdf

https://lock.cmpxchg8b.com/sophailv2.pdf

http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/

http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf

http://blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html

http://seclists.org/fulldisclosure/2014/Feb/48

http://googleprojectzero.blogspot.de/2015/01/finding-and-exploiting-ntpd.html

8 http://www.coresecurity.com/advisories/s... CompressionMultipleVulnerabilities

05-2015

coresecurity


OwningInternetPrinting-ACaseStudyinModernSoftwareExploitation

19-06-2015

NeelMehta

10 https://docs.google.com/document/d/1sIYg...

EscapingVMwareWorkstationthroughCOM1

07-09-2015

KostyaKortchinsky

ArbitrarydatamanipulationSomeprimitivesdon'tnecessarilycomefromstackorheapoverrunsorwhatever--theremaybemoreexoticsituationswhichproduceunexpectedprogramflow.

ITSecurityCatalog








http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities


http://googleprojectzero.blogspot.de/2015/06/owning-internet-printing-case-study-in.html

https://docs.google.com/document/d/1sIYgqrytPK-CFWfqDntraA_Fwi2Ov-YBgMtl5hdrYd4/preview?pli=1&sle=true


1 http://dvlabs.tippingpoint.com/blog/2009...

ExploitingMSAdvisory971778:QuickTimeDirectShow

28-05-2009

AaronPortnoy

2 http://www.offensive-security.com/vulnde... MS11-080–AVoyageintoRingZero

06-12-2011

offensive-security.com

3 http://blog.azimuthsecurity.com/2013/02/... Re-visitingtheExynosMemoryMappingBug

14-02-2013

DanRosenberg

4 https://www.sektioneins.de/advisories/ad...

Advisory01/2013:PHPopenssl_x509_parse()MemoryCorruptionVulnerability

13-12-2013

StefanEsser


TechnicalAnalysisofCVE-2014-0515AdobeFlashPlayerExploit

21-05-2014

MattOh


Onefontvulnerabilitytorulethemall#1:IntroducingtheBLENDvulnerability

31-07-2015



Onefontvulnerabilitytorulethemall#2:AdobeReaderRCEexploitation

06-08-2015


GeneralArticles,blogs,commentsonvulnerabilitiesandtheirexploitationwhicharehardtofindcategoryfor.

ITSecurityCatalog










http://dvlabs.tippingpoint.com/blog/2009/06/30/exploiting-ms-advisory-971778---quicktime-directshow-vulnerability

http://www.offensive-security.com/vulndev/ms11-080-voyage-into-ring-zero/

http://blog.azimuthsecurity.com/2013/02/re-visiting-exynos-memory-mapping-bug.html

https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Technical-Analysis-of-CVE-2014-0515-Adobe-Flash-Player-Exploit/ba-p/6482744

http://googleprojectzero.blogspot.de/2015/07/one-font-vulnerability-to-rule-them-all.html

http://googleprojectzero.blogspot.de/2015/08/one-font-vulnerability-to-rule-them-all.html


1 https://www.sans.org/reading-room/whitep... BufferOverflowsforDummies

01-05-2002

2 http://www.viva64.com/en/a/0046/ Safetyof64-bitcode06-08-2009

3 http://www.matasano.com/research/NaCl_Su... NaClContest-Summaryoffindings

xx-xx-2009

4 http://code.google.com/p/chromium/issues...Pwnium1.3-anexploitforanintegeroverflowinWebGLUnsignedIntArray.

01-03-2010

5 http://www.exploit-db.com/wp-content/themes/exploit/docs/16151.pdf

ExploitingARMLinuxSystems

31-01-2011

6 https://www.virusbtn.com/virusbulletin/a...

VB2014paper:UbiquitousFlash,ubiquitousexploits,ubiquitousmitigation

01-01-2015

7 http://www.ma.rhul.ac.uk/static/techrep/20...BufferOverflowsintheMicrosoftWindows®Environment

16-02-2015

8 http://matthias.vallentin.net/course-work/... OntheEvolutionofBufferOverows

20-05-2015

9 http://googleprojectzero.blogspot.de/201...Whatisa"good"memorycorruptionvulnerability?(Part1/4)

26-06-2015

10 http://blogs.technet.com/b/srd/archive/20... TriagingtheexploitabilityofIE/EDGEcrashes

12-01-2016

ITSecurityCatalog










https://www.sans.org/reading-room/whitepapers/threats/buffer-overflows-dummies-481

http://www.viva64.com/en/a/0046/

http://www.matasano.com/research/NaCl_Summary-Team-CJETM.pdf

http://code.google.com/p/chromium/issues/attachmentText?id=35724&aid=126993484832405244&name=Pwnium-1.3.html&token=feb53c401c565218ebbb4e57977988f2

http://www.exploit-db.com/wp-content/themes/exploit/docs/16151.pdf

https://www.virusbtn.com/virusbulletin/archive/2015/01/vb201501-ubiquitous



http://www.ma.rhul.ac.uk/static/techrep/2009/RHUL-MA-2009-06.pdf

http://matthias.vallentin.net/course-work/buffer_overflows.pdf

http://googleprojectzero.blogspot.de/2015/06/what-is-good-memory-corruption.html

http://blogs.technet.com/b/srd/archive/2016/01/12/triaging-the-exploitability-of-ie-edge-crashes.aspx

Buganalysisandexploitation(privileged)Bugandexploitanalysisanddevelopmentforsoftwarerunninginring0.

Bufferoverflows

Stack-basedbufferoverrun

Stackbufferoverrun


1 http://sysc.tl/2009/07/04/cve-2008-3531-...

CVE-2008-3531:FreeBSDkernelstackoverflowexploitdevelopment

04-07-2009

Patroklos(argp)Argyroudis

FreeBSD

2 http://blog.0x80.org/kernel-stack-overfl...

Kernelstackoverflows(basics)

18-01-2013

EssaAlkuwari Linux

Stackoverflow


1 http://jon.oberheide.org/blog/2010/11/29...

ExploitingStackOverflowsintheLinuxKernel

29-11-2010

JonOberheide

Heap/Pool-basedbufferoverrun

Out-of-boundsread/write

ITSecurityCatalog

39AnalysisandExploitation(privileged)

http://sysc.tl/2009/07/04/cve-2008-3531-exploit/

http://blog.0x80.org/kernel-stack-overflows-basics/

http://jon.oberheide.org/blog/2010/11/29/exploiting-stack-overflows-in-the-linux-kernel/


1 http://blog.coresecurity.com/2011/08/24/...

Lookingbehindthecurtain:Makingexploitsworkliketheydointhemovies...

24-08-2011

NicolasEconomou


CVE-2013-5065:NDProxyarrayindexingerrorunpatchedvulnerability

06-12-2013

MTB

3 http://blog.includesecurity.com/2014/03/...

Howtoexploitthex32recvmmsg()kernelvulnerabilityCVE2014-0038

06-03-2014

?

4 http://blog.talosintel.com/2015/10/dange...

DANGEROUSCLIPBOARD:ANALYSISOFTHEMS15-072PATCH

20-10-2015

MarcinNoga,JaesonSchultz

Off-by-oneerrors



THEBIGTRICKBEHINDEXPLOITMS12-034

10-05-2012

NicolasEconomou

2 http://poppopret.org/2013/11/20/csaw-ctf...

CSAWCTF2013KernelExploitationChallenge

20-11-2013

MichaelCoppola

Heap/Poolbufferoverrun


Linux04-

ITSecurityCatalog



http://blog.coresecurity.com/2011/08/24/looking-behind-the-curtain-making-exploits-work-like-they-do-in-the-movies/

http://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/

http://blog.includesecurity.com/2014/03/exploit-CVE-2014-0038-x32-recvmmsg-kernel-vulnerablity.html

http://blog.talosintel.com/2015/10/dangerous-clipboard.html

http://blog.coresecurity.com/2012/05/10/the-big-trick-behind-exploit-ms12-034/

http://poppopret.org/2013/11/20/csaw-ctf-2013-kernel-exploitation-challenge/

1 http://isec.pl/papers/linux_kernel_do_br... Kerneldo_brk()Vulnerability

12-2003

http://isec.pl/


Thestoryofexploitingkmalloc()overflows

20-09-2005

Sebastian(qobaiashi)Haase

3 http://jon.oberheide.org/blog/2010/09/10...

LinuxKernelCANSLUBOverflow

27-11-2010

JonOberheide

4 http://vsecurity.com/download/papers/slo...

AHeapofTrouble:BreakingtheLinuxKernelSLOBAllocator

22-01-2012

DanRosenberg

5 http://blog.ptsecurity.com/2013/02/surpr...

SurpriseforNetworkResourcesfromkernel32(MS12-081,DetailedAnalysisofVulnerabilityinMicrosoftFileHandlingComponent)

11-02-2013

KirillNesterov

6 https://labs.mwrinfosecurity.com/blog/20...

MWRLabsPwn2Own2013Write-up-KernelExploit

06-09-2013

mwrinfosecurity.com

7 http://resources.infosecinstitute.com/ex...

ExploitingLinuxKernelHeapCorruptions(SLUBAllocator)

19-11-2013

MohammedGhannam

8 http://doar-e.github.io/blog/2014/03/11/...

FirstDipIntotheKernelPool:MS10-058

11-03-2014

Jeremy(__x86)Fetiveau

ITSecurityCatalog







http://isec.pl/papers/linux_kernel_do_brk.pdf

http://isec.pl/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0961

https://web.archive.org/web/20120516032047/http://home.bn-paf.de/sebastian.haase/kmalloc_exploitation.pdf

http://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/

http://vsecurity.com/download/papers/slob-exploitation.pdf

http://blog.ptsecurity.com/2013/02/surprise-for-network-resources-from.html

https://labs.mwrinfosecurity.com/blog/2013/09/06/mwr-labs-pwn2own-2013-write-up---kernel-exploit/

http://resources.infosecinstitute.com/exploiting-linux-kernel-heap-corruptions-slub-allocator/

http://doar-e.github.io/blog/2014/03/11/first-dip-into-the-kernel-pool-ms10-058/

9 http://blogs.flexerasoftware.com/vulnera... YetAnotherWindowsGDIStory

22-04-2015

HosseinLotfi

Integerissues


1 https://media.blackhat.com/bh-us-11/Esse... ExploitingtheiOSKernel

13-07-2011

StefanEsser

2 http://esec-lab.sogeti.com/post/Analysis...Analysisofthejailbreakmev3fontexploit

18-07-2011

jean

3 https://web.archive.org/web/201402090016... CVE-2012-0148:ADeepDiveIntoAFD

17-02-2012

Tarjei(kernelpool)Mandt


[email protected]'ssemtex.c:LocalLinuxrootexploit,2.6.37-3.8.8inclusive(and2.6.32onCentOS)0-day

15-05-2013

spender

5 http://timetobleed.com/a-closer-look-at-...

AcloserlookatarecentprivilegeescalationbuginLinux(CVE-2013-2094)

20-05-2013

JoeDamato

6 https://www.blackhat.com/docs/us-14/mate...

QSEETrustZoneKernelIntegerOverflowVulnerability

01-07-2014

DanRosenberg

7 http://randomthoughts.greyhats.it/2014/1...MacOSXlocalprivilegeescalation(IOBluetoothFamily)

30-10-2014

RobertoPaleari,joystick

8 http://blog.beyondtrust.com/the-delicate...

TheDelicateArtofRemoteChecks–AGlanceIntoMS15-034

15-04-2015

BillFinlayson

9 https://blog.sucuri.net/2015/04/website-...CriticalMicrosoftIISVulnerabilityLeadstoRCE(MS15-034)

16-04-2015

RafaelCapovilla

ITSecurityCatalog





http://blogs.flexerasoftware.com/vulnerability-management/2015/04/yet-another-windows-gdi-story.html

https://media.blackhat.com/bh-us-11/Esser/BH_US_11_Esser_Exploiting_The_iOS_Kernel_WP.pdf

http://esec-lab.sogeti.com/post/Analysis-of-the-jailbreakme-v3-font-exploit

https://web.archive.org/web/20140209001620/http://mista.nu/blog/2012/02/17/cve-2012-0148-a-deep-dive-into-afd

https://web.archive.org/web/20130817113402/http://www.reddit.com/r/netsec/comments/1eb9iw/sdfucksheeporgs_semtexc_local_linux_root_exploit/c9ykrck

http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/

https://www.blackhat.com/docs/us-14/materials/us-14-Rosenberg-Reflections-On-Trusting-TrustZone-WP.pdf

http://randomthoughts.greyhats.it/2014/10/osx-local-privilege-escalation.html

http://blog.beyondtrust.com/the-delicate-art-of-remote-checks-a-glance-into-ms15-034

https://blog.sucuri.net/2015/04/website-firewall-critical-microsoft-iis-vulnerability-ms15-034.html

10 http://www.securitysift.com/an-analysis-... AnAnalysisOfMS15-0341

18-04-2015

MikeCzumak

11 https://community.qualys.com/blogs/secur...MS15-034AnalysisAndRemoteDetection

20-04-2015

SesWang

12 https://blog.coresecurity.com/2015/09/17...

MS15-083–MicrosoftWindowsSMBMemoryCorruptionVulnerability

17-09-2015

NicolasEconomou

13 http://theroot.ninja/disclosures/TRUSTNO... TRUSTNONE28-11-2015

SeanBeaupre

14 http://hmarco.org/bugs/CVE-2015-8370-Gru...

Backto28:Grub2Authentication0-Day

14-12-2015

HectorMarco,IsmaelRipoll

NULLpointerissues


1 http://blog.ksplice.com/2010/04/exploiti...

MuchadoaboutNULL:ExploitingakernelNULLdereference

13-04-2010

nelhage


IntroducingtheUSBStickofDeath

21-10-2012


3 http://endgame.com/news/microsoft-win32k...

MicrosoftWin32kNULLPageVulnerabilityTechnicalAnalysis

xx-10-2013

DanZentner

4 http://immunityproducts.blogspot.de/2013...

ExploitingCVE-2013-3881:AWin32kNULLPageVulnerability

04-11-2013

NicolasWaisman

ITSecurityCatalog










http://www.securitysift.com/an-analysis-of-ms15-034/

https://community.qualys.com/blogs/securitylabs/2015/04/20/ms15-034-analyze-and-remote-detection

https://blog.coresecurity.com/2015/09/17/ms15-083-microsoft-windows-smb-memory-corruption-vulnerability/

http://theroot.ninja/disclosures/TRUSTNONE_1.0-11282015.pdf

http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html

http://blog.ksplice.com/2010/04/exploiting-kernel-null-dereferences/


http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html

http://immunityproducts.blogspot.de/2013/11/exploiting-cve-2013-3881-win32k-null.html

5 http://blog.spiderlabs.com/2013/12/the-k...

TheKerneliscallingazero(day)pointer–CVE-2013-5065–RingRing

11-12-2013

BenHayak


AnAnalysisofAWindowsKernel-ModeVulnerability(CVE-2014-4113)

19-10-2014

WeiminWu

7 https://www.codeandsec.com/CVE-2014-4113...

CVE-2014-4113DetailedVulnerabilityandPatchAnalysis

24-10-2014

?


AnalysisofCVE-2014-4113

xx-10-2014

RonnieJohndas

9 http://www.jodeit.org/research/Exploitin...

ExploitingCVE-2014-4113onWindows8.1

31-10-2014

MoritzJodeit

10 http://blog.qwertyoruiop.com/?p=69

Aboutthe“tpwn”LocalPrivilegeEscalation

01-09-2015

Adam(@jk9357)

11 http://istuarysec.blogspot.ca/2015/09/cve...

CVE-2015-5275(WhiteheatUSB-SerialDrivervulnerability)

17-09-2015

MoeinGhasemzadeh

Datatypeconfusion

ITSecurityCatalog








http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-cve-2013-5065-ring-ring.html

http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/

https://www.codeandsec.com/CVE-2014-4113-Detailed-Vulnerability-and-Patch-Analysis


http://www.jodeit.org/research/Exploiting_CVE-2014-4113_on_Windows_8.1.pdf

http://blog.qwertyoruiop.com/?p=69

http://istuarysec.blogspot.ca/2015/09/cve-2015-5275-whiteheat-usb-serial_17.html


1 https://code.google.com/p/google-securit...

Windows:NtCreateTransactionManagerTypeConfusionElevationofPrivilege

30-01-2015

JamesForshaw

Objectlifetimeissues

Use-after-free

Nr URL Description

1 http://www.vupen.com/blog/20101018.Stuxn...TechnicalAnalysisoftheWindowsWin32K.sysKeyboardLayoutStuxnetExploit

2 http://j00ru.vexillium.org/?p=893CVE-2011-1281:AstoryofaWindowsCSRSSPrivilegeEscalationvulnerability

3 http://j00ru.vexillium.org/?p=1479CVE-2012-2553:WindowsKernelVDMuse-after-freeinwin32k.sys

4 https://www.nccgroup.trust/uk/about-us/n...

Exploitingthewin32k!xxxEnableWndSBArrowsuse-after-free(CVE-2015-0057)bugonboth32-bitand64-bit

5 http://breakingmalware.com/vulnerabilitie... ClassDismissed:4Use-After-FreeVulnerabilitiesinWindows

6 https://www.nccgroup.trust/us/about-us/ne...ExploitingMS15-061Use-After-FreeWindowsKernelVulnerability

7 http://hdwsec.fr/blog/CVE-2015-0057.html [MS15-010/CVE-2015-0057]Exploitation

8 https://www.fireeye.com/content/dam/firee...

CVE-2015-2546–tagPOPUPMENUUse-After-Free(UAF)PrivilegeEscalationExploit

9 https://cyseclabs.com/page?n=02012016 CVE-2014-2851group_infoUAFExploitation

ITSecurityCatalog








https://code.google.com/p/google-security-research/issues/detail?id=245

http://www.vupen.com/blog/20101018.Stuxnet_Win32k_Windows_Kernel_0Day_Exploit_CVE-2010-2743.php



https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/july/exploiting-the-win32kxxxenablewndsbarrows-use-after-free-cve-2015-0057-bug-on-both-32-bit-and-64-bit-tldr/

http://breakingmalware.com/vulnerabilities/class-dismissed-4-use-after-free-vulnerabilities-in-windows/

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/august/exploiting-ms15-061-use-after-free-windows-kernel-vulnerability/

http://hdwsec.fr/blog/CVE-2015-0057.html

https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/twoforonefinal.pdf

https://cyseclabs.com/page?n=02012016

Double-free


1 http://www.siberas.de/papers/Pwn2Own_201...

Pwn2Own2014-AFD.SYSDANGLINGPOINTERVULNERABILITY

11-07-2014

SebastianApelt


CVE-2014-1767Afd.sysdouble-freevulnerabilityAnalysisandExploit

19-11-2014

0x710DDDD

Raceconditions


1 http://blog.includesecurity.com/2014/06/...

ExploitingCVE-2014-0196awalk-throughoftheLinuxptyraceconditionPoC

03-06-2014

SamuelGroß


CVE-2014-4699:LinuxKernelptrace/sysretvulnerabilityanalysis

21-07-2014

VitalyNikolenko

3 https://www.insinuator.net/2015/12/xen-x...

XenXSA155:Doublefetchesinparavirtualizeddevices

17-12-2015

FelixWilhelm

Non-memory-corruptionissues

AccessControl/PermissonIssues

ITSecurityCatalog












http://www.siberas.de/papers/Pwn2Own_2014_AFD.sys_privilege_escalation.pdf

hhttps://web.archive.org/web/20141121210506/http://www.secniu.com/englishversioncve-2014-1767-afd-sys-double-free-vulnerability-analysis-and-exploit

http://blog.includesecurity.com/2014/06/exploit-walkthrough-cve-2014-0196-pty-kernel-race-condition.html

https://web.archive.org/web/20150328011630/https://hashcrack.org/page?n=21072014

https://www.insinuator.net/2015/12/xen-xsa-155-double-fetches-in-paravirtualized-devices/


1 http://labs.portcullis.co.uk/blog/in-the...

Inthelab,poppingCVE-2013-2171forFreeBSD9.0…

11-12-2013

TMB

2 https://github.com/stealth/troubleshooter troubleshooter02-04-2015

stealth

3 http://googleprojectzero.blogspot.de/201... In-Console-Able

04-05-2015

JamesForshaw

4 http://googleprojectzero.blogspot.de/201...BetweenaRockandaHardLink

04-12-2015

JamesForshaw

ImplementationErrors

I.e.failingtoperformsufficientvalidation,improperdatahandling,etc.

ITSecurityCatalog






http://labs.portcullis.co.uk/blog/in-the-lab-popping-cve-2013-2171-for-freebsd-9-0/

https://github.com/stealth/troubleshooter

http://googleprojectzero.blogspot.de/2015/05/in-console-able.html

http://googleprojectzero.blogspot.de/2015/12/between-rock-and-hard-link.html



FromUSRtoSVC:Dissectingthe'evasi0n'KernelExploit

13-02-2013

TarjeiMandt iOS


CVE-2014-7911–ADeepDiveAnalysisofAndroidSystemServiceVulnerabilityandExploitation

06-01-2015

YaronLavi,NadavMarkus

Android


ExploringCVE-2015-1701—AWin32kElevationofPrivilegeVulnerabilityUsedinTargetedAttacks

22-05-2015

JackTang Windows

4 http://googleprojectzero.blogspot.co.uk/...

WindowsDriversareTrue’lyTricky

15-10-2015

JamesForshaw Windows

Informationleakage


1 http://sysexit.wordpress.com/2014/11/12/...

ANALYSISOFCVE-2014-8476:AFREEBSDKERNELMEMORYDISCLOSUREVULNERABILITY

12-11-2014

fdfalcon

Uninitializedmemory

ITSecurityCatalog




http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html

http://researchcenter.paloaltonetworks.com/2015/01/cve-2014-7911-deep-dive-analysis-android-system-service-vulnerability-exploitation/

http://blog.trendmicro.com/trendlabs-security-intelligence/exploring-cve-2015-1701-a-win32k-elevation-of-privilege-vulnerability-used-in-targeted-attacks/

http://googleprojectzero.blogspot.co.uk/2015/10/windows-drivers-are-truely-tricky.html

http://sysexit.wordpress.com/2014/11/12/analysis-of-cve-2014-8476-a-freebsd-kernel-memory-disclosure-vulnerability/


1 http://esec-lab.sogeti.com/posts/2010/12...

CVE-2010-3830-iOS<4.2.1packetfilterlocalkernelvulnerability

18-12-2010

Jean iOS<4.2.1

2 http://j00ru.vexillium.org/blog/20_05_12...

ThestoryofCVE-2011-2018exploitation

xx-04-2012


Windows,x86-32


exploitationideasundermemorypressure

17-05-2013

TavisOrmandy Windows

SpecificbugsHardwarebugsoronesthatdonotfallintoothercategories.


1 http://fail0verflow.com/blog/2012/cve-20...

CVE-2012-0217:Intel'ssysretKernelPrivilegeEscalation(onFreeBSD)

05-07-2012

iZsh

2 https://media.blackhat.com/bh-us-12/Brie...

StitchInTimeSavesNine:AStitchInTimeSavesNine:ACaseOfMultipleOSVulnerability

25-07-2012

RafalWojtczuk


AdvancedExploitationofWindowsKernelIntel64-BitModeSysretVulnerability(MS12-042)

06-08-2012

JordanGruskovnjak


AdvancedExploitationofXenHypervisorSysretVMEscape

04-09-2012

MatthieuBonetti

ITSecurityCatalog






http://esec-lab.sogeti.com/posts/2010/12/09/cve-2010-3830-ios-421-packet-filter-local-kernel-vulnerability.html

http://j00ru.vexillium.org/blog/20_05_12/cve_2011_2018.pdf

http://seclists.org/fulldisclosure/2013/May/91

http://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd.html#Xdblfault

https://media.blackhat.com/bh-us-12/Briefings/Wojtczuk/BH_US_12_Wojtczuk_A_Stitch_In_Time_WP.pdf

http://www.vupen.com/blog/20120806.Advanced_Exploitation_of_Windows_Kernel_x64_Sysret_EoP_MS12-042_CVE-2012-0217.php

http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php

Vulnerability


MS13-017–THEHARMLESSSILENTPATCH…

01-04-2013

NicolasEconomou

6 http://blog.azimuthsecurity.com/2013/04/...UnlockingtheMotorolaBootloader

08-04-2013

DanRosenberg

7 https://web.archive.org/web/201411081027... DisARMingtheiOSkernel

30-05-2014

winocm

8 https://hackerone.com/reports/13388 LinuxPIfutexself-requeuebug

19-06-2014

comex

9 http://tinyhack.com/2014/07/07/exploitin...

ExploitingtheFutexBuganduncoveringTowelroot

07-07-2014

YohanesNugroho

10 http://blog.nativeflow.com/the-futex-vul... TheFutexVulnerability

11-09-2014

DanyZatuchna

11 http://www.icewall.pl/?p=680&lang=en StoryaboutMS14-063

25-10-2014

icewall

12 http://googleprojectzero.blogspot.de/201...pwn4funSpring2014-Safari-PartII

24-11-2014

IanBerr

13 http://labs.bromium.com/2015/02/02/explo...

Exploiting“BadIRET”vulnerability(CVE-2014-9322,Linuxkernelprivilegeescalation)

02-02-2015

RafalWojtczuk

14 http://blog.cr4.sh/2015/02/exploiting-ue...ExploitingUEFIbootscripttablevulnerability

06-02-2015

Dmytro(Cr4sh)Oleksiuk

14 http://bits-please.blogspot.gr/2015/08/a...

Androidlinuxkernelprivilegeescalationvulnerabilityandexploit(CVE-

16-08-2015

laginimaineb

ITSecurityCatalog









http://blog.coresecurity.com/2013/04/01/ms13-017-the-harmless-silent-patch/

http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html

https://web.archive.org/web/20141108102710/http://winocm.com/technical/2014/05/30/disarming-the-ios-kernel

https://hackerone.com/reports/13388

http://tinyhack.com/2014/07/07/exploiting-the-futex-bug-and-uncovering-towelroot/

http://blog.nativeflow.com/the-futex-vulnerability

http://www.icewall.pl/?p=680&lang=en

http://googleprojectzero.blogspot.de/2014/11/pwn4fun-spring-2014-safari-part-ii.html

http://labs.bromium.com/2015/02/02/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/

http://blog.cr4.sh/2015/02/exploiting-uefi-boot-script-table.html

http://bits-please.blogspot.gr/2015/08/android-linux-kernel-privilege.html

2014-4322)

15 http://perception-point.io/2016/01/14/an...

ANALYSISANDEXPLOITATIONOFALINUXKERNELVULNERABILITY(CVE-2016-0728)

14-01-2016

PerceptionPointResearchTeam

ChainedandMultipleBugs


1 http://sill0t3.blogspot.in/2015/06/window...

WindowsKernelExploitationUsingHackSys

03-06-2015

sill0t3

2 http://blog.quarkslab.com/kernel-vulnerab...

KernelVulnerabilitiesintheSamsungS4

21-09-2015

JonathanSalwan

ArbitrarydatamanipulationSomeprimitivesdon'tnecessarilycomefromstackorheapoverrunsorwhatever--theremaybemoreexoticsituationswhichproduceunexpectedprogramflow.

ITSecurityCatalog









http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/

http://sill0t3.blogspot.in/2015/06/windows-kernel-exploitation-using.html

http://blog.quarkslab.com/kernel-vulnerabilities-in-the-samsung-s4.html



Onefontvulnerabilitytorulethemall#3:Windows8.132-bitsandboxescapeexploitation

13-08-2015


2 http://bits-please.blogspot.gr/2015/08/f...

FullTrustZoneexploitforMSM8974

10-08-2015

laginimaineb


Onefontvulnerabilitytorulethemall#4:Windows8.164-bitsandboxescapeexploitation

21-08-2015


4 http://bits-please.blogspot.de/2015/08/a...

Androidlinuxkernelprivilegeescalation(CVE-2014-4323)

26-08-2015

laginimaineb

General

ITSecurityCatalog





http://googleprojectzero.blogspot.de/2015/08/one-font-vulnerability-to-rule-them-all_13.html

http://bits-please.blogspot.gr/2015/08/full-trustzone-exploit-for-msm8974.html

http://googleprojectzero.blogspot.de/2015/08/one-font-vulnerability-to-rule-them-all_21.html

http://bits-please.blogspot.de/2015/08/android-linux-kernel-privilege_26.html


1 http://phrack.org/issues/64/6.html

AttackingtheCore:KernelExploitingNotes

27-05-2005

sgrakkyu,twiz

2 http://www.blackhat.com/presentations/bh... KernelWarsxx-08-2007

KarlJanmar

3 http://rikiji.it/2013/05/10/CVE-2013-209...CVE-2013-2094porttox86

10-05-2013

Riccardo

4 http://blog.cmpxchg8b.com/2013/05/introd...

IntroductiontoWindowsKernelSecurityResearch

15-05-2013

TavisOrmandy

5 http://labs.lastline.com/unmasking-kerne...UnmaskingKernelExploits

07-07-2015

RomanVasilenko

ITSecurityCatalog






http://phrack.org/issues/64/6.html

http://www.blackhat.com/presentations/bh-europe-07/Eriksson-Janmar/Whitepaper/bh-eu-07-eriksson-WP.pdf

http://rikiji.it/2013/05/10/CVE-2013-2094-x86.html


http://blog.cmpxchg8b.com/2013/05/introduction-to-windows-kernel-security.html

http://labs.lastline.com/unmasking-kernel-exploits

Shell-codedevelopment

Egg-hunters

ITSecurityCatalog

54ShellcodeDevelopment



Exploitwritingtutorialpart8:Windows,x86-32EggHunting

09-01-2010

corelanc0d3r


WindowsBufferOverflowTutorial:AnEgghunterandaConditionalJump

13-02-2010

StephenBradshaw


Exploitnotes–win32eggs-to-omelet

22-08-2010

corelanc0d3r

4 http://www.exploit-db.com/foxit-reader-s...

FoxitReaderStackOverflowExploit–EgghunterEdition

14-11-2010

dookie2000ca

5 http://www.corelan.be/index.php/2011/05/...

HackNotes:Roppingeggsforbreakfast

12-05-2011

corelanc0d3r


AnexampleofEggHuntingtoexploitCVE-2012-0124

06-07-2012

JuanVazquez

7 http://www.bigendiansmalls.com/creating-...

Buildingshellcode,egghuntersanddecoders.

23-07-2015

bigendiansmalls

Ingeneral

ITSecurityCatalog


http://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/

http://grey-corner.blogspot.com/2010/02/windows-buffer-overflow-tutorial.html

http://www.corelan.be/index.php/2010/08/22/exploit-notes-win32-eggs-to-omelet/

http://www.exploit-db.com/foxit-reader-stack-overflow-exploit-egghunter/

http://www.corelan.be/index.php/2011/05/12/hack-notes-ropping-eggs-for-breakfast/

https://community.rapid7.com/community/metasploit/blog/2012/07/06/an-example-of-egghunting-to-exploit-cve-2012-0124

http://www.bigendiansmalls.com/creating-shellcode-to-run-in-uss/


1 http://hick.org/code/skape/papers/win32-...UnderstandingWindowsShellcode

12-06-2003

Matt(skape)Miller

2 http://www.vividmachines.com/shellcode/s...

ShellcodingforLinuxandWindowsTutorial

xx-06-2007

SteveHanna

3 http://blog.harmonysecurity.com/2009/08/... CallingAPIFunctions

05-08-2009

StephenFewer

4 http://blog.harmonysecurity.com/search/l...

ImplementingaWindows,x86-32KernelShellcode

05-11-2009

StephenFewer


Exploitwritingtutorialpart9:IntroductiontoWindows,x86-32shellcoding

25-02-2010

corelanc0d3r


HowtoCreateaShellcodeonARMArchitecture

25-11-2010

JonathanSalwan

7 http://mcdermottcybersecurity.com/articl... Windowsx64shellcode

11-01-2011

McDermott


StackBasedBufferOverflowTutorial,part3—Addingshellcode

09-03-2011

StephenBradshaw

9 http://gdtr.wordpress.com/2011/07/23/uni...

UniversalROPshellcodeforOSXx64

23-07-2011

pa_kt

10 http://www.vnsecurity.net/2011/07/yet-an...

YetanotheruniversalOSXx86_64dyldROPshellcode

30-07-2011

longld

11 http://www.codeproject.com/Articles/3257...TheArtofWin32

06-02- AmrThabet

ITSecurityCatalog






http://hick.org/code/skape/papers/win32-shellcode.pdf

http://www.vividmachines.com/shellcode/shellcode.html

http://blog.harmonysecurity.com/2009/08/calling-api-functions.html

http://blog.harmonysecurity.com/search/label/Shellcode

http://www.corelan.be/index.php/2010/02/25/exploit-writing-tutorial-part-9-introduction-to-win32-shellcoding/


http://mcdermottcybersecurity.com/articles/windows-x64-shellcode

http://resources.infosecinstitute.com/stack-based-buffer-overflow-tutorial-part-3-%E2%80%94-adding-shellcode/

http://gdtr.wordpress.com/2011/07/23/universal-rop-shellcode-for-os-x-x64/

http://www.vnsecurity.net/research/2011/07/30/yet-another-universal-osx-x86_64-dyld-rop-shellcode/

http://www.codeproject.com/Articles/325776/The-Art-of-Win32-Shellcoding

Shellcoding 2012

12 https://web.archive.org/web/201402262333... 64-bitLinuxShellcode

10-06-2012

MarkLoiseau

13 https://www.offensive-security.com/vulnd...FunwithAIXShellcodeandMetasploit

20-11-2012

?

14 http://www.exploit-monday.com/2013/08/wr...

WritingOptimizedWindowsShellcodeinC

16-08-2013

MattGraeber

ITSecurityCatalog


https://web.archive.org/web/20140226233336/http://blog.markloiseau.com/2012/06/64-bit-linux-shellcode

https://www.offensive-security.com/vulndev/aix-shellcode-metasploit/

http://www.exploit-monday.com/2013/08/writing-optimized-windows-shellcode-in-c.html

BugsandtheirmitigationsThissectionisallaboutbugclassesandimplementedmitigationsagainstthem.

StackoverrunsCWE-121:Stack-basedBufferOverflow

Userand



SafeSEH+SEHOPall-at-oncebypassexplotationmethodprinciples

10-01-2012

x90c

2 http://blogs.msdn.com/b/sdl/archive/2012...Enhancementsto/GSinVisualStudio11

26-01-2012

DaveLadd


StackSmashing:WhenCodeExecutionBecomesaNightmare

06-07-2012

WeiChen


TheStackCookiesBypassonCVE-2012-0549

15-08-2012

JuanVazquez

Kernelmode

Nr URL Description Date Author OS/Arch Info


Exploitingtheotherwisenon-exploitable:WindowsKernel-modeGScookiessubverted

11-01-2011

Mateusz‘j00ru’Jurczyk

Windows,x86-32

CVE-2010-4398

ITSecurityCatalog

58Mitigations

https://cwe.mitre.org/data/definitions/121.html

http://seclists.org/fulldisclosure/2012/Jan/124

http://blogs.msdn.com/b/sdl/archive/2012/01/26/enhancements-to-gs-in-visual-studio-11.aspx

https://community.rapid7.com/community/metasploit/blog/2012/07/06/stack-smashing-when-code-execution-becomes-a-nightmare

https://community.rapid7.com/community/metasploit/blog/2012/08/15/the-stack-cookies-bypass-on-cve-2012-0549



General


1 http://site.pi3.com.pl/papers/ASSP.pdf

AdventurewithStackSmashingProtector(SSP)

11-11-2013

Adam'pi3'Zabrocki

2 http://wiki.osdev.org/Stack_Smashing_Protec...StackSmashingProtector

22-10-2014

(osdev.org)

Heapoverrunshttps://cwe.mitre.org/data/definitions/122.html

Userland


1 http://www.symantec.com/connect/articles...

AnewwaytobypassWindowsheapprotections

31-08-2005

NicolasFalliere

2 http://blogs.technet.com/b/srd/archive/2...

Preventingtheexploitationofusermodeheapcorruptionvulnerabilities

04-08-2009

swiat


SoftwareDefense:mitigatingheapcorruptionvulnerabilities

29-10-2013

swiat

4 http://blog.lse.epita.fr/articles/74-get...

GettingbackdeterminismintheLowFragmentationHeap

02-11-2014

BrunoPujos

Kernelmode

ITSecurityCatalog

59Mitigations



http://site.pi3.com.pl/papers/ASSP.pdf

http://wiki.osdev.org/Stack_Smashing_Protector


http://www.symantec.com/connect/articles/new-way-bypass-windows-heap-protections

http://blogs.technet.com/b/srd/archive/2009/08/04/preventing-the-exploitation-of-user-mode-heap-corruption-vulnerabilities.aspx

http://blogs.technet.com/b/srd/archive/2013/10/29/software-defense-mitigation-heap-corruption-vulnerabilities.aspx

http://blog.lse.epita.fr/articles/74-getting-back-determinism-in-the-lfh.html



SafeUnlinkingintheKernelPool

26-05-2012

swiat Windows

2 http://www.inertiawar.com/unlink/

Windows8andSafeUnlinkinginNTDLL

14-07-2012

Note Windows

Staticbufferoverflows


1 http://em386.blogspot.com/2008/05/self-p...

SelfProtectingGlobalOffsetTable(GOT)

24-04-2008

ChrisRohlf -

2 http://isisblogs.poly.edu/2011/06/01/rel...RELRO:RELocationRead-Only

01-06-2011

JulianCohen Linux

Uninitializeddatahttps://cwe.mitre.org/data/definitions/824.html


1 http://blogs.msdn.com/b/sdl/archive/2012...

Guardingagainstuninitializedclassmemberpointers

08-03-2012

ThomasGarnier Windows

Lifetimeissueshttps://cwe.mitre.org/data/definitions/416.htmlhttps://cwe.mitre.org/data/definitions/415.html

Use-after-free,double-freebugs.


ITSecurityCatalog

60Mitigations

http://blogs.technet.com/b/srd/archive/2009/05/26/safe-unlinking-in-the-kernel-pool.aspx

http://www.inertiawar.com/unlink/

http://em386.blogspot.com/2008/05/self-protecting-got.html

http://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/


http://blogs.msdn.com/b/sdl/archive/2012/03/08/guarding-against-uninitialized-class-member-pointers.aspx



1 http://blog.fortinet.com/post/is-use-aft...

Isuse-after-freeexploitationdead?ThenewIEmemoryprotectorwilltellyou

16-06-2014

Zhenhua'Eric'Liu


IsIttheBeginningoftheEndForUse-After-FreeExploitation?

16-06-2014

TaoYan,BoQu,RoyceLu


MitigatingUAFExploitswithDelayFreeforInternetExplorer

17-06-2014

JackTang


IsolatedHeap&Friends-ObjectAllocationHardeninginWebBrowsers

20-06-2014

mwrinfosecurity.com


IsolatedHeapforInternetExplorerHelpsMitigateUAFExploits

01-07-2014

JackTang


EfficacyofMemoryProtectionagainstuse-after-freevulnerabilities

28-07-2014

SimonZuckerbraun

7 http://securityintelligence.com/understa...

UnderstandingIE’sNewExploitMitigations:TheMemoryProtectorandtheIsolatedHeap

29-08-2014

MarkYason


USE-AFTER-FREENOTDEADININTERNETEXPLORER:PART1

13-10-2014

k33nteam

9 http://h30499.www3.hp.com/hpeb/attachmen...Newdirectionsinuse-after-freemitigations

18-10-2014

HPSecurity


Windows10SharpensBrowserSecurityWithMicrosoftEdge

21-07-2015

Henryli

ITSecurityCatalog

61Mitigations

http://blog.fortinet.com/post/is-use-after-free-exploitation-dead-the-new-ie-memory-protector-will-tell-you

http://researchcenter.paloaltonetworks.com/2014/07/beginning-end-use-free-exploitation/

http://blog.trendmicro.com/trendlabs-security-intelligence/mitigating-uaf-exploits-with-delay-free-for-internet-explorer/

https://labs.mwrinfosecurity.com/blog/2014/06/20/isolated-heap-friends---object-allocation-hardening-in-web-browsers/

http://blog.trendmicro.com/trendlabs-security-intelligence/isolated-heap-for-internet-explorer-helps-mitigate-uaf-exploits/

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Efficacy-of-MemoryProtection-against-use-after-free/ba-p/6556134

http://securityintelligence.com/understanding-ies-new-exploit-mitigations-the-memory-protector-and-the-isolated-heap/#.VGoE8ZPoGu7

https://web.archive.org/web/20141102002013/http://k33nteam.org/blog-4-use-after-free-not-dead-in-internet-explorer-part-1.htm

http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/444/2/SecurityBriefing_Episode18_UAFs_20141030-FINAL.pdf

http://blog.trendmicro.com/trendlabs-security-intelligence/windows-10-sharpens-browser-security-with-microsoft-edge/

NULL-pointerhttps://cwe.mitre.org/data/definitions/476.html



LockingDowntheWindowsKernel:MitigatingNullPointerExploitation

07-07-2011


Integerbugshttps://cwe.mitre.org/data/definitions/189.html


1 http://forums.grsecurity.net/viewtopic.p...

InsidetheSizeOverflowPlugin

28-08-2012

ephox -

Hardeningsandtheirbypasses

AddressSpaceLayoutRandomiztion(ASLR)

Userland


1 https://web.archive.org/web/201001020008...AttackingASLRonLinux2.6

27-05-2009

drraid

2 http://recxltd.blogspot.com/2011/12/curi...

TheCuriousCaseofVirtualAlloc,ASLRandanSDL

13-12-2011

Ollie

3 http://blog.duosecurity.com/2012/02/a-lo...

AlookatASLRinAndroidIceCream

17-02-2012

JonOberheide

ITSecurityCatalog

62Mitigations


https://web.archive.org/web/20120913191024/http://www.mista.nu/research/nullpage.pdf


http://forums.grsecurity.net/viewtopic.php?f=7&t=3043

https://web.archive.org/web/20100102000802/http://sophsec.com/research/aslr_research.html

http://recxltd.blogspot.com/2011/12/curious-case-of-virtualalloc-aslr-and.html

http://blog.duosecurity.com/2012/02/a-look-at-aslr-in-android-ice-cream-sandwich-4-0/

Sandwich4.0

4 http://recxltd.blogspot.com/2012/03/part...

APartialTechniqueAgainstASLR-MultipleO/Ss

02-03-2012

Ollie

5 http://blog.ptsecurity.com/2012/12/windo...Windows8ASLRInternals

04-12-2012

ArtemShishkin,IlyaSmith

6 http://kingcope.wordpress.com/2013/01/24...

AttackingtheWindows7/8AddressSpaceRandomization

24-01-2013

kingcope

7 http://www.fireeye.com/blog/technical/cy...

ASLRBypassApocalypseinRecentZero-DayExploits

15-10-2013

XiaboChen

8 https://www.cert.org/blogs/certcc/post.c...

DifferencesBetweenASLRonWindowsandLinux

10-02-2014

WillDormann


BypassingWindowsASLRinMicrosoftOfficeusingActiveXcontrols

04-12-2015

Parvez

Kernelmode(KASLR)

ITSecurityCatalog

63Mitigations

http://recxltd.blogspot.com/2012/03/partial-technique-against-aslr-multiple.html

http://blog.ptsecurity.com/2012/12/windows-8-aslr-internals.html

http://kingcope.wordpress.com/2013/01/24/attacking-the-windows-78-address-space-randomization/

http://www.fireeye.com/blog/technical/cyber-exploits/2013/10/aslr-bypass-apocalypse-in-lately-zero-day-exploits.html

https://www.cert.org/blogs/certcc/post.cfm?EntryID=191



1 https://dl.packetstormsecurity.net/pap...BypassingWindows7KernelASLR

11-10-2011

StefanLeBerre

2 http://shell-storm.org/blog/ASLR-impleme...

ASLRimplementationinLinuxKernel3.7

19-01-2013

JonathanSalwan


KASLR:AnExerciseinCargoCultSecurity

20-03-2013

spender

4 http://www.alex-ionescu.com/?p=82

KASLRBypassMitigationsinWindows8.1

17-11-2013

AlexIonescu

5 http://labs.bromium.com/2014/10/27/tsx-i...

TSXimprovestimingattacksagainstKASLR

27-10-2014

RafalWojtzcuk

6 https://copperhead.co/2015/05/11/aslr-an...

TheStateofASLRonAndroidLollipop

11-05-2015

DanielMicay

DataExecutionPrevention(DEP)


1 https://docs.google.com/viewer?a=v&pid=e...x86-64bufferoverflowexploitsandtheborrowedcodechunks

28-09-2005

2 http://www.uninformed.org/?v=2&a=4BypassingWindowsHardware-enforcedDataExecutionPrevention

02-10-2005

3 http://cseweb.ucsd.edu/~hovav/papers/s07...

TheGeometryofInnocentFleshontheBone:Return-into-libcwithoutFunctionCalls(onthex86)

xx-10-2007

4 http://www.packetstormsecurity.org/paper...BypassinghardwarebasedDEPonWindowsServer2003SP2

10-06-2009

DEPbypasswith09-

ITSecurityCatalog

64Mitigations






https://dl.packetstormsecurity.net/papers/bypass/NES-BypassWin7KernelAslr.pdf

http://shell-storm.org/blog/ASLR-implementation-in-Linux-Kernel-3.7


http://www.alex-ionescu.com/?p=82

http://labs.bromium.com/2014/10/27/tsx-improves-timing-attacks-against-kaslr/

https://copperhead.co/2015/05/11/aslr-android-zygote

https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B64ViR5GhSKINDcxZGM1YTItM2U0Ni00ZGZlLWFhNDgtZmY4YjE2Y2I1Y2Rk&hl=en

http://www.uninformed.org/?v=2&a=4

http://cseweb.ucsd.edu/~hovav/papers/s07.html

http://www.packetstormsecurity.org/papers/bypass/bypass-dep.pdf

5 http://bernardodamele.blogspot.com/2009/... DEPbypasswithSetProcessDEPPolicy()

12-2009

6 http://vrt-blog.snort.org/2009/12/dep-an... DEPandHeapSprays17-12-2009

7 http://blog.zynamics.com/2010/03/12/a-ge...Agentleintroductiontoreturn-orientedprogramming

12-03-2010

8 http://archives.neohapsis.com/archives/f...ExploitationWithWriteProcessMemory()/YetAnotherDEPTrick

xx-03-2010

9 http://blog.harmonysecurity.com/2010/04/...AlittlereturnorientedexploitationonWindowsx86(Part1)

12-04-2010

10 http://blog.harmonysecurity.com/2010/04/...AlittlereturnorientedexploitationonWindowsx86(Part2)

16-04-2010

11 https://web.archive.org/web/201207070114... AdvancedReturn-OrientedExploit

05-05-2010

12 http://www.corelan.be:8800/index.php/201...

Exploitwritingtutorialpart10:ChainingDEPwithROP–theRubik’s[TM]Cube

16-06-2010

13 http://eticanicomana.blogspot.com/2010/0... ThesocalledReturnOrientedProgramming...

21-06-2010

14 http://www.exploit-db.com/osx-rop-exploi... OSXROPExploit–EvoCamCaseStudy

06-07-2010

15 http://repository.root-me.org/Exploit... Payloadalreadyinside:datareuseforropexploits

28-07-2010

16 http://www.vnsecurity.net/research/2010/... SimpleMacOSXret2libcexploit(x86)

05-10-2010

17 http://vulnfactory.org/blog/2011/09/21/d... DefeatingWindows8ROPMitigation

21-09-2011

18 http://www.exploit-monday.com/2011/11/ma...Manvs.ROP-OvercomingAdversityOneGadgetataTime

14-11-2011

ITSecurityCatalog

65Mitigations


http://bernardodamele.blogspot.com/2009/12/dep-bypass-with-setprocessdeppolicy.html

http://vrt-blog.snort.org/2009/12/dep-and-heap-sprays.html

http://blog.zynamics.com/2010/03/12/a-gentle-introduction-to-return-oriented-programming/

http://archives.neohapsis.com/archives/fulldisclosure/2010-03/att-0553/Windows-DEP-WPM.txt

http://blog.harmonysecurity.com/2010/04/little-return-oriented-exploitation-on.html

http://blog.harmonysecurity.com/2010/04/little-return-oriented-exploitation-on_16.html

https://web.archive.org/web/20120707011407/http://divine-protection.com/wordpress/?p=20

http://www.corelan.be:8800/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/

http://eticanicomana.blogspot.com/2010/06/so-called-return-oriented-programming.html

http://www.exploit-db.com/osx-rop-exploits-evocam-case-study/

http://repository.root-me.org/Exploitation%20-%20Syst%C3%A8me/Unix/EN%20-%20Paper%20Payload%20already%20inside%20data%20reuse%20for%20ROP%20exploits.pdf

http://www.vnsecurity.net/research/2010/10/05/simple-mac-os-x-ret2libc-exploit-x86.html

http://vulnfactory.org/blog/2011/09/21/defeating-windows-8-rop-mitigation/

http://www.exploit-monday.com/2011/11/man-vs-rop-overcoming-adversity-one.html

19 https://web.archive.org/web/201201200400... AdvancedGenericROPchainforWindows8

11-2011

20 http://www.accuvant.com/blog/2011/12/01/... MeasureTwice,CutOnce01-12-2011

21 http://codearcana.com/posts/2013/05/28/i...Introductiontoreturnorientedprogramming(ROP)

28-05-2013

22 https://codeinsecurity.wordpress.com/201...

W^XpolicyviolationaffectingallWindowsdriverscompiledinVisualStudio2013andprevious

03-09-2015

Return-Oriented-Programming(ROP)mitigations


7 http://www.kryptoslogic.com/download/ROP...

SecurityMitigationsforReturn-OrientedProgrammingAttacks

20-08-2010

PiotrBania

39 http://c0decstuff.blogspot.com.es/2012/1...

DefeatingWindows8ROPMitigation

19-12-2012

c0decstuff

ExportAddressTableAccessFiltering(EAF)

ITSecurityCatalog

66Mitigations


http://osvdb.org/65043

https://web.archive.org/web/20120120040042/http://blog.bkis.com/en/advanced-generic-rop-chain-for-windows-8/


http://www.accuvant.com/blog/measure-twice-cut-once

http://codearcana.com/posts/2013/05/28/introduction-to-return-oriented-programming-rop.html

https://codeinsecurity.wordpress.com/2015/09/03/wx-policy-violation-affecting-all-windows-drivers-compiled-in-visual-studio-2013-and-previous/

http://www.kryptoslogic.com/download/ROP_Whitepaper.pdf

http://c0decstuff.blogspot.com.es/2012/12/defeating-windows-8-rop-mitigation.html



BypassingEMET’sEAFwithcustomshellcodeusingkernelpointer

19-12-2011

Parvez

33 http://piotrbania.com/all/articles/anti_...

BYPASSINGEMETExportAddressTableAccessFilteringfeature

19-01-2012

PiotrBania

44 http://scrammed.blogspot.de/2014/03/reve...

ReversingEMET'sEAF(andacoupleofcuriousfindings...)

20-03-2014

giulia

53 http://tekwizz123.blogspot.de/2015/01/by...

AnTheoreticalApproachtoGettingAroundEMET'sEAFProtection

18-01-2015

tekwizz

ControlFlowIntegrity/ControlFlowGuard

ITSecurityCatalog

67Mitigations


http://piotrbania.com/all/articles/anti_emet_eaf.txt

http://scrammed.blogspot.de/2014/03/reversing-emets-eaf-and-couple-of.html

http://tekwizz123.blogspot.de/2015/01/bypassing-emets-eaf-protection-slightly.html


1 http://blogs.msdn.com/b/vcblog/archive/2...

VisualStudio2015Preview:Work-in-ProgressSecurityFeature

08-12-2014


ExploringControlFlowGuardinWindows10

30-01-2015

3 https://blog.coresecurity.com/2015/03/25/...

ExploitingCVE-2015-0311,PartII:BypassingControlFlowGuardonWindows8.1Update3

25-03-2015

4 http://sjc1-te-ftp.trendmicro.com/assets/wp...

ExploringControlFlowGuardinWindows10

xx-05-2015

5 http://research.microsoft.com/pubs/64250/ccs05.pdf

Control-FlowIntegrity:Principles,Implementations,andApplications

11-07-2015

6 http://labs.bromium.com/2015/09/28/an-int...

AninterestingdetailaboutControlFlowGuard

28-09-2015

MitigationsAgainstUse-After-Free

ITSecurityCatalog

68Mitigations


http://blogs.msdn.com/b/vcblog/archive/2014/12/08/visual-studio-2015-preview-work-in-progress-security-feature.aspx

http://blog.trendmicro.com/trendlabs-security-intelligence/exploring-control-flow-guard-in-windows-10

https://blog.coresecurity.com/2015/03/25/exploiting-cve-2015-0311-part-ii-bypassing-control-flow-guard-on-windows-8-1-update-3/

http://sjc1-te-ftp.trendmicro.com/assets/wp/exploring-control-flow-guard-in-windows10.pdf

http://labs.bromium.com/2015/09/28/an-interesting-detail-about-control-flow-guard/


1 http://h30499.www3.hp.com/hpeb/attachments/...

AbusingSilentMitigations:UnderstandingweaknesseswithinInternetExplorer’sIsolatedHeapandMemoryProtection

19-06-2015

Abdul-AzizHariri,SimonZuckerbraun,BrianGorenc

2 http://googleprojectzero.blogspot.de/2015/0... Dude,where’smyheap?

15-06-2015

IvanFratric

Multiplemitigationsdiscussed

Userland


1 http://www.azimuthsecurity.com/resources/...

BypassingBrowserMemoryProtections

07-08-2008

AlexSotirov,MarkDowd

2 https://www.blackhat.com/presentations/b...Bufferoverflowsonlinux-x86-64

22-01-2009

HagenFritsch


Exploitwritingtutorialpart6:BypassingStackCookies,SafeSeh,SEHOP,HWDEPandASLR

12-09-2009

corelanc0d3r


BypassingASLRandDEPunderWindows

17-06-2010

mr_me


AssessingtheTuxStrength:Part1-UserspaceMemoryProtection

29-07-2010

?

ITSecurityCatalog

69Mitigations


http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/599/1/WP-Hariri-Zuckerbraun-Gorenc-Abusing_Silent_Mitigations.pdf

http://googleprojectzero.blogspot.de/2015/06/dude-wheres-my-heap.html

http://www.azimuthsecurity.com/resources/bh2008_dowd_sotirov.pdf

https://www.blackhat.com/presentations/bh-europe-09/Fritsch/Blackhat-Europe-2009-Fritsch-Buffer-Overflows-Linux-whitepaper.pdf

http://www.corelan.be/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/

https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=1g5FD5gjWAIu0iGf7gaF-DBfgya-u9kYX2KT9EgAdbpyjVzXI90imHI783LIF&hl=en

https://labs.mwrinfosecurity.com/blog/2010/06/29/assessing-the-tux-strength-part-1---userspace-memory-protection/


OntheeffectivenessofDEPandASLR

08-12-2010

swiat

7 http://msdn.microsoft.com/en-us/library/...

WindowsISVSoftwareSecurityDefenses

xx-12-2010

MichaelHoward,MattMiller,JohnLambert,MattThomlinson

8 http://www.secfence.com/whitepapers/Whit... BypassingASLR/DEP

25-09-2011

VinayKatoch

9 http://www.microsoft.com/download/en/det...MitigatingSoftwareVulnerabilities

12-07-2011

MattMiller,TimeBurrell,MichaelHoward


RecentAdvances:HowWeLearnFromExploits

15-02-2012

spender

11 http://blogs.msdn.com/b/ie/archive/2012/...

EnhancedMemoryProtectionsinIE10

13-03-2012

ForbesHigman

12 http://esec-lab.sogeti.com/post/Bypassin...

BypassingASLRandDEPonAdobeReaderX

22-06-2012

guillaume

13 http://security.stackexchange.com/questi...HowdoASLRandDEPwork?

12-08-2012

polynomial


Softwaredefense:safeunlinkingandreferencecounthardening

06-11-2013

swiat

15 http://bromiumlabs.files.wordpress.com/2... BYPASSINGEMET4.1

xx-02-2014

JaresDeMott

Bypassing

ITSecurityCatalog

70Mitigations


http://blogs.technet.com/b/srd/archive/2010/12/08/on-the-effectiveness-of-dep-and-aslr.aspx

http://msdn.microsoft.com/en-us/library/bb430720.aspx

http://www.secfence.com/whitepapers/Whitepaper-on-ASLR-DEP-Bypass-Secfence-Technologies.pdf

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26788

http://forums.grsecurity.net/viewtopic.php?t=2939&p=11669

http://blogs.msdn.com/b/ie/archive/2012/03/12/enhanced-memory-protections-in-ie10.aspx

http://esec-lab.sogeti.com/post/Bypassing-ASLR-and-DEP-on-Adobe-Reader-X

http://security.stackexchange.com/questions/18556/how-do-aslr-and-dep-work

http://blogs.technet.com/b/srd/archive/2013/11/06/software-defense-safe-unlinking-and-reference-count-hardening.aspx

http://bromiumlabs.files.wordpress.com/2014/02/bypassing-emet-4-1.pdf

16 http://www.contextis.com/resources/blog/... Windows8.1MitigationsusingUnsafeCOMObjects

15-06-2014

JamesForshaw

17 http://www.offensive-security.com/vulnde...

DisarmingEnhancedMitigationExperienceToolkit

01-07-2014


18 https://www.offensive-security.com/vulnd... DisarmingEMETv5.0

29-09-2014


19 https://www.offensive-security.com/vulnd...

DisarmingandBypassingEMET5.1

18-11-2014

Blogpost

20 http://casual-scrutiny.blogspot.in/2015/...DefeatingEMET5.2Protections

15-03-2015

r41p41

21 http://casual-scrutiny.blogspot.in/2015/...

DefeatingEMET5.2Protections(2)

21-03-2015

r41p41

22 http://int3pids.blogspot.de/2015/04/conf...

Confidence2015Teaser:QuarantineWrite-Up(pwn500)

30-04-2015

EloiSanfelix

23 http://googleprojectzero.blogspot.com/20...

SignificantFlashexploitmitigationsareliveinv18.0.0.209

16-07-2015

MarkBrand,ChrisEvans

24 https://www.endgame.com/blog/adobe-flash...

AdobeFlashVulnerabilityCVE-2015-7663andMitigatingExploits

xx-xx-2015

CodyPierce

25 https://duo.com/assets/pdf/WoW64-Bypassi...

WoW64andSoCanYou-BypassingEMETWithaSingleInstruction

xx-xx-2015

DarrenKemp,MikhailDavidov

BypassDEP

ITSecurityCatalog

71Mitigations


http://www.contextis.com/resources/blog/windows-mitigaton-bypass/

http://www.offensive-security.com/vulndev/disarming-enhanced-mitigation-experience-toolkit-emet/

https://www.offensive-security.com/vulndev/disarming-emet-v5-0/

https://www.offensive-security.com/vulndev/disarming-and-bypassing-emet-5-1/

http://casual-scrutiny.blogspot.in/2015/03/defeating-emet-52.html

http://casual-scrutiny.blogspot.in/2015/03/defeating-emet-52-protections-2.html

http://int3pids.blogspot.de/2015/04/confidence-2015-teaser-quarantine-write.html

http://googleprojectzero.blogspot.com/2015/07/significant-flash-exploit-mitigations_16.html

https://www.endgame.com/blog/adobe-flash-vulnerability-cve-2015-7663-and-mitigating-exploits

https://duo.com/assets/pdf/WoW64-Bypassing-EMET.pdf

26 http://xlab.tencent.com/en/2015/12/09/by...andCFGusingJITcompilerinChakraengine

09-12-2015

tombkeeper

Kernelmode


1 http://sysc.tl/2010/04/26/kernel-exploit...FreeBSDkernelexploitationmitigations

26-04-2010



AssessingtheTuxStrength:Part2-IntotheKernel

02-09-2010

RadoslawMadej

3 https://wiki.ubuntu.com/Security/Feature... Security/Features-UbuntuWiki

17-02-2011

ubuntu.com

4 http://census.gr/media/bheu-2011-wp.pdf

ProtectingtheCore:KernelExploitationMitigations

18-03-2011

Patroklos(argp)Argyroudis,DimitrisGlynos

5 http://blogs.msdn.com/b/sdl/archive/2012...Guardingagainstre-useofstaleobjectreferences

24-04-2012

DougCavit

6 https://blog.duosecurity.com/2012/07/exp...

ExploitMitigationsinAndroidJellyBean4.1

16-07-2012

JonOberheide

7 http://0xfeedface.org/blog/lattera/2012-...NewExploitProtectionsinAndroid4.1

19-07-2012

ShawnWebb


EMET3.5TechPreviewleveragessecuritymitigationsfromtheBlueHatPrize

24-07-2012

swiat


TechnicalAnalysisoftheTopBlueHatPrizeSubmissions

26-07-2012

swiat

ITSecurityCatalog

72Mitigations



http://xlab.tencent.com/en/2015/12/09/bypass-dep-and-cfg-using-jit-compiler-in-charkra-engine/

http://sysc.tl/2010/04/26/kernel-exploitation-mitigations/

https://web.archive.org/web/20111217143845/http://labs.mwrinfosecurity.com/notices/assessing_the_tux_strength_part_2_into_the_kernel/

https://wiki.ubuntu.com/Security/Features

http://census.gr/media/bheu-2011-wp.pdf

http://blogs.msdn.com/b/sdl/archive/2012/04/24/guarding-against-re-use-of-stale-object-references.aspx

https://blog.duosecurity.com/2012/07/exploit-mitigations-in-android-jelly-bean-4-1/

http://0xfeedface.org/2012/07/19/new-exploit-protections-in-android-4-1.html

http://blogs.technet.com/b/srd/archive/2012/07/24/emet-3-5-tech-preview-leverages-security-mitigations-from-the-bluehat-prize.aspx

http://blogs.technet.com/b/srd/archive/2012/07/26/technical-analysis-of-the-top-bluehat-prize-submissions.aspx

10 http://forums.grsecurity.net/viewtopic.p...RecentARMsecurityimprovements

18-02-2013

spender

11 http://0xdabbad00.com/wp-content/uploads...

EMET4.1Uncovered

18-11-2013

0xdabbad00


Softwaredefense:mitigatingcommonexploitationtechniques

11-12-2013

swiat


Windows8KernelMemoryProtectionsBypass

15-08-2014

Jérémy(__x86)Fetiveau

14 http://breakingmalware.com/vulnerabiliti...

One-BitToRuleThemAll:BypassingWindows’10ProtectionsusingaSingleBit

10-02-2015

UdiYavo

General

ITSecurityCatalog

73Mitigations


http://0xdabbad00.com/wp-content/uploads/2013/11/emet_4_1_uncovered.pdf

http://blogs.technet.com/b/srd/archive/2013/12/11/software-defense-mitigating-common-exploitation-techniques.aspx

https://labs.mwrinfosecurity.com/blog/2014/08/15/windows-8-kernel-memory-protections-bypass/

http://breakingmalware.com/vulnerabilities/one-bit-rule-bypassing-windows-10-protections-using-single-bit/


1 http://www.freeinfosociety.com/media/pdf/2708.pdf

ABufferOverflowStudy-Attacks&Defenses

2002

Pierre-AlainFAYOLLE,VincentGLAUME

2 https://static.googleusercontent.com/medi...

NativeClient:ASandboxforPortable,Untrustedx86NativeCode

2009

BennetYee,DavidSehr,GregoryDardyk,J.BradleyChen,RobertMuth,TavisOrmandy,ShikiOkasaka,NehaNarula,andNicholasFullagar

3 https://drive.google.com/file/d/0B5pT4hU_...

AnEvaluationoftheEffectivenessofEMET5.1AtProtectingEverydayApplicationsAgainstTargetedAttacks

2015 GrantWillcox

Hardware-basedmitigations

ITSecurityCatalog

74Mitigations


http://www.freeinfosociety.com/media/pdf/2708.pdf

https://static.googleusercontent.com/media/research.google.com/en/us/pubs/archive/34913.pdf

https://drive.google.com/file/d/0B5pT4hU_yYUWcUtsUWxxcFJjOVU/view

Nr URL Description

1 https://web.archive.org/web/20120120072718/http://falken.tuxfamily.org/?p=115

BeatSMEPonLinuxwithReturn-OrientedProgramming

2 http://forums.grsecurity.net/viewtopic.p...SupervisorModeAccessPrevention

3 http://blog.ptsecurity.com/2012/09/intel...

IntelSMEPoverviewandpartialbypassonWindows8

4 http://www.cyvera.com/the-case-for-smep-...

THECASEFORSMEP–EXPLOITINGAKERNELVULNERABILITY

5 http://atredispartners.blogspot.de/2014/...

HereBeDragons:VulnerabilitiesinTrustZone

6 https://www.nccgroup.com/en/blog/2015/01...

Intel®SoftwareGuardExtensions(SGX):AResearcher’sPrimer

7 https://www.nccgroup.trust/uk/about-us/n... XenSMEP(andSMAP)bypass

8 http://www.alex-ionescu.com/Enclave%20Su...

IntelSGXEnclaveSupportinWindows10FallUpdate(Threshold2)

Specificmitigations

ITSecurityCatalog

75Mitigations

https://web.archive.org/web/20120120072718/http://falken.tuxfamily.org/?p=115


http://blog.ptsecurity.com/2012/09/intel-smep-overview-and-partial-bypass.html

http://www.cyvera.com/the-case-for-smep-exploiting-a-kernel-vulnerability/

http://atredispartners.blogspot.de/2014/08/here-be-dragons-vulnerabilities-in.html

https://www.nccgroup.com/en/blog/2015/01/intel-software-guard-extensions-sgx-a-researchers-primer/

https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/april/xen-smep-and-smap-bypass/

http://www.alex-ionescu.com/Enclave%20Support%20In%20Windows%2010%20Fall%20Update.pdf


1 http://blog.ptsecurity.com/2014/09/micro...

MicrosoftWindows8.1KernelPatchProtectionAnalysis&AttackVectors

17-08-2014

MarkErmolov,ArtemShishkin

2 http://vrt-blog.snort.org/2014/08/the-wi...

TheWindows8.1KernelPatchProtection

24-08-2014

AndreaAllievi

3 http://scarybeastsecurity.blogspot.de/20...UsingASANasaprotection

25-09-2014

ChrisEvans

4 http://blogs.cisco.com/security/mitigati...

MitigationsAvailablefortheDRAMRowHammerVulnerability

09-03-2015

OmarSantos

5 http://googleprojectzero.blogspot.de/2015/08/three-bypasses-and-fix-for-one-of.html

ThreebypassesandafixforoneofFlash'sVector.<*>mitigations

19-08-2015

ChrisEvans

OtherexploitationobstaclesNon-compiler,OS,orhardwareenforcedexploitationdifficulties.



Exploitwritingtutorialpart7:Unicode–from0×00410041tocalc

06-11-2009

corelanc0d3r

WindowsBuffer

ITSecurityCatalog

76Mitigations

http://blog.ptsecurity.com/2014/09/microsoft-windows-81-kernel-patch.html?m=1

http://vrt-blog.snort.org/2014/08/the-windows-81-kernel-patch-protection.html

http://scarybeastsecurity.blogspot.de/2014/09/using-asan-as-protection.html

http://blogs.cisco.com/security/mitigations-available-for-the-dram-row-hammer-vulnerability

http://googleprojectzero.blogspot.de/2015/08/three-bypasses-and-fix-for-one-of.html

http://www.corelan.be/index.php/2009/11/06/exploit-writing-tutorial-part-7-unicode-from-0x00410041-to-calc/

2 http://grey-corner.blogspot.com/2010/01/...OverflowTutorial:DealingwithCharacterTranslation

17-01-2010

StephenBradshaw


KenWardZipperStackBOF0day–anotsotypicalSEHexploit

18-03-2010

corelanc0d3r


ExploitingKenWardZipper:Takingadvantageofpayloadconversion

27-03-2010

Tutorial


QuickZipStackBOF0day:aboxofchocolates(2parts)

27-03-2010

corelanc0d3r


Unicode,themagicofexploiting0×00410041

29-05-2010

mr_me

7 http://www.exploit-db.com/winamp-5-58-fr...

Winamp5.58fromDenialofServicetoCodeExecution

20-10-2010

muts

8 http://www.exploit-db.com/winamp-exploit...

Winamp5.58fromDenialofServicetoCodeExecutionPart2

02-11-2010

muts


MetasploitBounty–theGood,theBadandtheUgly

27-07-2011

Lincoln

ITSecurityCatalog

77Mitigations


http://grey-corner.blogspot.com/2010/01/windows-buffer-overflow-tutorial.html


https://web.archive.org/web/20110417071123/http://www.abysssec.com/blog/2010/03/ken-ward-zipper-stack-bof-0day-a-not-so-typical-seh-exploit/


http://www.corelan.be/index.php/2010/03/27/exploiting-ken-ward-zipper-taking-advantage-of-payload-conversion/

http://www.corelan.be/index.php/2010/03/27/quickzip-stack-bof-0day-a-box-of-chocolates/

https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=1U1cGztE8e08ALZuGjSFRemHW5dhZ01YT1ab-ShCKOd5E82X62T82l7eQt2fb&hl=en


http://www.exploit-db.com/winamp-5-58-from-dos-to-code-execution/


http://www.exploit-db.com/winamp-exploit-part-2/


https://www.corelan.be/index.php/2011/07/27/metasploit-bounty-the-good-the-bad-and-the-ugly/


ResearchFromhardwaretoapplications,frommitigationstoattacks.

Hardware-based



QSEETrustZoneKernelIntegerOverflowVulnerability

01-07-2014

DanRosenberg

1 http://atredispartners.blogspot.de/2014/...

HereBeDragons:VulnerabilitiesinTrustZone

14-08-2014

NathanKeltner


ExploitingTrustzoneonAndroid

xx-08-2015

DiShen

3 http://blog.invisiblethings.org/papers/2...Intelx86consideredharmful

xx-10-2015

JoannaRutkowska

4 http://blog.invisiblethings.org/papers/2...

Stateconsideredharmful-Aproposalforastatelesslaptop

xx-12-2015

JoannaRutkowska

CompilerOrLanguage-Specific


1 https://code.google.com/p/em386/download...

ExploringtheSTL:Owningerase()

20-07-2009

ChrisRohlf

ITSecurityCatalog

78Research

https://www.blackhat.com/docs/us-14/materials/us-14-Rosenberg-Reflections-On-Trusting-TrustZone-WP.pdf

http://atredispartners.blogspot.de/2014/08/here-be-dragons-vulnerabilities-in.html

https://www.blackhat.com/docs/us-15/materials/us-15-Shen-Attacking-Your-Trusted-Core-Exploiting-Trustzone-On-Android-wp.pdf

http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf

http://blog.invisiblethings.org/papers/2015/state_harmful.pdf

https://code.google.com/p/em386/downloads/detail?name=Exploring_the_STL_Owning_erase.pdf&can=2&q=

OperatingSystemInternals

Heap


1 https://www.blackhat.com/presentations/b...Understandingtheheapbybreakingit

xx-08-2007

JusintN.Ferguson

2 https://media.blackhat.com/eu-13/briefin...

AdvancedHeapManipulationinWindows8

15-03-2013

Zhenhua(Eric)Liu

Kernel


1 http://census-labs.com/media/bheu-2010-w...

BindingtheDaemon:FreeBSDKernelStackandHeapExploitation

22-04-2010


2 http://www.mista.nu/research/MANDT-kerne...

KernelPoolExploitationonWindows7

12-01-2011


3 http://sysc.tl/2012/01/03/linux-kernel-h...

TheLinuxkernelmemoryallocatorsfromanexploitationperspective

03-01-2012



iOSKernelHeapArmageddon

26-07-2012

StefanEsser


AttackingZonePageMetadatainiOS7andOSXMavericks

19-12-2013


ITSecurityCatalog

79Research



https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf

https://media.blackhat.com/eu-13/briefings/Liu/bh-eu-13-liu-advanced-heap-WP.pdf

http://census-labs.com/media/bheu-2010-wp.pdf

https://web.archive.org/web/20150323233115/http://www.mista.nu/research/MANDT-kernelpool-PAPER.pdf

http://sysc.tl/2012/01/03/linux-kernel-heap-exploitation/

https://media.blackhat.com/bh-us-12/Briefings/Esser/BH_US_12_Esser_iOS_Kernel_Heap_Armageddon_WP.pdf

http://blog.azimuthsecurity.com/2013/12/attacking-zone-page-metadata-in-ios-7.html

VariousMechanisms


1 https://labs.mwrinfosecurity.com/system/...

WindowsServices–AllroadsleadtoSYSTEM

31-10-2014

Article

2 http://census-labs.com/media/Fuzzing_Object...

FuzzingObjectsd’ART:DiggingIntotheNewAndroidLRuntimeInternals

18-06-2015

AnestisBechtsoudis


RevisitingAppleIPC:(1)DistributedObjects

28-09-2015

IanBeer

Application-Specific

Just-In-Time(JIT)andVirtualMachines(VM)

ITSecurityCatalog

80Research


https://labs.mwrinfosecurity.com/system/assets/760/original/Windows_Services_-_All_roads_lead_to_SYSTEM.pdf

http://census-labs.com/media/Fuzzing_Objects_d_ART_hitbsecconf2015ams_WP.pdf

http://googleprojectzero.blogspot.de/2015/09/revisiting-apple-ipc-1-distributed_28.html


1 http://www.inf.fu-berlin.de/groups/ag-si...

Application-SpecificAttacks:LeveragingtheActionScriptVirtualMachine

xx-04-2008

MarkDowd

2 http://dsecrg.com/files/pub/pdf/Writing%20J...

WritingJIT-SprayShellcodeforfunandprofit

05-03-2010

AlexeySintsov

3 http://www.matasano.com/research/Attacki...AttackingClientsideJITCompilers

07-08-2011

ChrisRohlf,YanIvnitsky

4 http://blog.cdleary.com/2011/08/understa... UnderstandingJITspray

29-08-2011

ChrisLeary


JITSprayingPrimerandCVE-2010-3654

26-05-2012

GalBadishi

6 http://mainisusuallyafunction.blogspot.d...

AttackinghardenedLinuxsystemswithkernelJITspraying

17-11-2012

keegan

7 http://zhodiac.hispahack.com/my-stuff/se...FlashJIT–Sprayinginfoleakgadgets

19-07-2013

FerminJ.Serna

8 https://xuanwulab.github.io/2015/06/09/R...

ResearchreportonusingJITtotriggerRowHammer

09-06-2015

R3dF09

CustomorApplicationSpecificHeaps

ITSecurityCatalog

81Research

http://www.inf.fu-berlin.de/groups/ag-si/compsec_assign/Dowd2008.pdf

http://dsecrg.com/files/pub/pdf/Writing%20JIT-Spray%20Shellcode%20for%20fun%20and%20profit.pdf

http://www.matasano.com/research/Attacking_Clientside_JIT_Compilers_Paper.pdf

http://blog.cdleary.com/2011/08/understanding-jit-spray/

https://web.archive.org/web/20150206081828/http://badishi.com/jit-spraying-primer-and-cve-2010-3654/

http://mainisusuallyafunction.blogspot.de/2012/11/attacking-hardened-linux-systems-with.html

http://zhodiac.hispahack.com/my-stuff/security/Flash_Jit_InfoLeak_Gadgets.pdf

https://xuanwulab.github.io/2015/06/09/Research-report-on-using-JIT-to-trigger-RowHammer/


1 https://sites.google.com/site/zerodayres...

AdobeReader'sCustomMemoryManagement:AHeapOfTrouble

22-04-2010

HaifeiLi,GuillaumeLovet


ExploitingthejemallocMemoryAllocator:OwningFirefox'sHeap

25-07-2012

Patroklos(argp)Argyroudis,Chariton(huku)Karamitas

3 https://communities.coverity.com/blogs/s...Windows8HeapInternals

31-07-2012

ChrisValasek

ApplicationInternalsAndAttacks


1 http://media.blackhat.com/bh-ad-11/Drake...

ExploitingMemoryCorruptionVulnerabilitiesintheJavaRuntime

15-12-2011

Joshua(jduck)J.Drake


GoogleNativeClient-AnalysisOfASecureBrowserPluginSandbox

25-07-2012

Whitepaper

3 https://sites.google.com/site/zerodayres...

SmashingtheHeapwithVector:AdvancedExploitationTechniqueinRecentFlashZero-dayAttack

xx-02-2013

HaifeiLi

4 http://www.slideshare.net/xiong120/explo...

ExploitIEUsingScriptableActiveXControls(versionEnglish)

22-03-2014

Yuki(guhe120)Chen

5 http://blog.fortinet.com/post/advanced-e...

AdvancedExploitTechniquesAttackingtheIE

16-06- Zhenhua

'Eric'Liu

ITSecurityCatalog

82Research


https://sites.google.com/site/zerodayresearch/Adobe_Readers_Custom_Memory_Management_a_Heap_of_Trouble.pdf?attredirects=0

https://media.blackhat.com/bh-us-12/Briefings/Argyoudis/BH_US_12_Argyroudis_Exploiting_the_%20jemalloc_Memory_%20Allocator_WP.pdf

https://communities.coverity.com/blogs/security/2012/07/31/windows-8-heap-internals-update

http://media.blackhat.com/bh-ad-11/Drake/bh-ad-11-Drake-Exploiting_Java_Memory_Corruption-WP.pdf

https://web.archive.org/web/20130119093444/http://www.trailofbits.com/threads/2012_LeafSR_NaCl_paper_BlackHat.pdf

https://sites.google.com/site/zerodayresearch/smashing_the_heap_with_vector_Li.pdf

http://www.slideshare.net/xiong120/exploit-ie-using-scriptable-active-x-controls-version-english

http://blog.fortinet.com/post/advanced-exploit-techniques-attacking-the-ie-script-engine

ScriptEngine 2014


Thinkingoutsidethesandbox-Violatingtrustboundariesinuncommonways

05-08-2014

BrianGorenc,JasielSpelman

7 http://seclists.org/bugtraq/2012/Sep/29

InternetExplorerScriptInterjectionCodeExecution(updated)

06-09-2012

DerekSoeder


UNDERSTANDINGTHEATTACKSURFACEANDATTACKRESILIENCEOFPROJECTSPARTAN'S(EDGE)NEWEDGEHTMLRENDERINGENGINE

xx-08-2015

MarkVincentYason

ExploitationTechniques


1 http://cansecwest.com/slides07/Vector-Re...

VectorRewriteAttack-ExploitableNULLPointerVulnerabilitiesonARMandXScaleArchitectures

xx-03-2007

BarnabyJack

2 http://ifsec.blogspot.com/2011/06/memory...

MemorydisclosuretechniqueforInternetExplorer

09-06-2011

IvanFratric

White

ITSecurityCatalog

83Research





https://www.blackhat.com/docs/us-14/materials/us-14-Gorenc-Thinking-Outside-The-Sandbox-Violating-Trust-Boundaries-In-Uncommon-Ways-WP.pdf

http://seclists.org/bugtraq/2012/Sep/29

https://www.blackhat.com/docs/us-15/materials/us-15-Yason-Understanding-The-Attack-Surface-And-Attack-Resilience-Of-Project-Spartans-New-EdgeHTML-Rendering-Engine-wp.pdf

http://cansecwest.com/slides07/Vector-Rewrite-Attack.pdf

http://ifsec.blogspot.com/2011/06/memory-disclosure-technique-for.html


PhosphorusExploitPackSayonaraASLRDEPBypassTechnique

21-06-2011

Note

4 https://media.blackhat.com/bh-us-11/Bros...

PostMemoryCorruptionMemoryAnalysis

03-08-2011

JonathanBrossard

5 http://zhodiac.hispahack.com/my-stuff/se...

CVE-2012-0769,thecaseoftheperfectinfoleak

09-04-2012

FerminJ.Serna

6 http://diyhpl.us/~bryan/papers2/security...

Androidexploitationprimers:liftingtheveilonmobileoffensivesecurity(Vol.I)

xx-08-2012

LarryH,BastianF


VerifyingWindowsKernelVulnerabilities

30-10-2013

Article


"HackAwayattheUnessential"withExpLib2inMetasploit

07-04-2014

WeiChen

9 https://doar-e.github.io/blog/2014/04/30...

CorruptingtheARMExceptionVectorTable

30-04-2014

Amat"acez"Cama

10 http://tfpwn.com/blog/turn-it-into-a-uaf... TurnitintoaUAF

11-01-2015

AlexanderEubanks

11 https://blog.coresecurity.com/2015/09/28...

AbusingGDIforring0exploitprimitives

28-09-2015

DiegoJuarez

12 https://www.nccgroup.trust/uk/our-resear... ExploitationAdvancements

07-10-2015

AaronAdams

#BadWinMail:The

ITSecurityCatalog

84Research





https://web.archive.org/web/20130524082925/http://www.whitephosphorus.org/sayonara.txt

https://media.blackhat.com/bh-us-11/Brossard/BH_US_11_Brossard_Post_Memory_WP.pdf

http://zhodiac.hispahack.com/my-stuff/security/Flash_ASLR_bypass.pdf

http://diyhpl.us/~bryan/papers2/security/android/droidleak_release.pdf

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Verifying-Windows-Kernel-Vulnerabilities/ba-p/6252649

https://community.rapid7.com/community/metasploit/blog/2014/04/07/hack-away-at-the-unessential-with-explib2-in-metasploit

https://doar-e.github.io/blog/2014/04/30/corrupting-arm-evt/

http://tfpwn.com/blog/turn-it-into-a-uaf.html

https://blog.coresecurity.com/2015/09/28/abusing-gdi-for-ring0-exploit-primitives/

https://www.nccgroup.trust/uk/our-research/research-insights-volume-7-exploitation-advancements/

13 https://0b3dcaf9-a-62cb3a1a-s-sites.goog..."EnterpriseKiller"AttackVectorinMicrosoftOutlook

xx-12-2015

HaifeiLi

Heap/Pool-spray


1 http://www.phreedom.org/presentations/he...HeapFengShuiinJavaScript

2007 AlexanderSotirov

2 http://www.exploit-monday.com/2011/08/ta...

TargetedHeapSpraying–0x0c0c0c0cisaThingofthePast

29-08-2011

MattGraeber


Exploitwritingtutorialpart11:HeapSprayingDemystified

31-12-2011

corelanc0d3r


DEPS–PreciseHeapSprayonFirefoxandIE10

19-02-2013

corelanc0d3r

5 http://blog.ptsecurity.com/2013/03/stars...

Starsaligner’show-to:kernelpoolsprayingandVMwareCVE-2013-1406

06-03-2013

Article

6 http://www.alex-ionescu.com/?p=231

SheepYearKernelHeapFengshui:SprayingintheBigKids’Pool

29-12-2014

AlexIonescu

ITSecurityCatalog

85Research



https://0b3dcaf9-a-62cb3a1a-s-sites.googlegroups.com/site/zerodayresearch/BadWinmail.pdf

http://www.phreedom.org/presentations/heap-feng-shui/

http://www.exploit-monday.com/2011/08/targeted-heap-spraying-0x0c0c0c0c-is.html

https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/

https://www.corelan.be/index.php/2013/02/19/deps-precise-heap-spray-on-firefox-and-ie10/

http://blog.ptsecurity.com/2013/03/stars-aligners-how-to-kernel-pool.html

http://www.alex-ionescu.com/?p=231

MitigationTechniques



WindowsKernelAddressProtection

xx-08-2011


2 http://www.vdalabs.com/tools/DeMott_Blue...

BlueHatPrizeSubmission(/ROP)

xx-03-2012

JaredDeMott

Bugfinding



SyScan2013,Bochspwnpaperandslides

24-04-2013

Mateusz(j00ru)Jurczyk,GynvaelColdwind

Windows N/A

General


1 http://reversing.it/thesis.pdf

SecuringApplicationSoftwareinModernAdversarialSettings

xx-07-2015

FelixSchuster - N/A

ITSecurityCatalog

86Research



http://www.vdalabs.com/tools/DeMott_BlueHat_Submission.pdf


http://reversing.it/thesis.pdf

Malware

BlogsThesearelinkstodifferentblogscontainingmalwareanalysis.

Nr URL Title/Description

1 http://www.inreverse.net/inREVERSE-malwareanalysisblog

2 http://blog.threatexpert.com/

Ablogaboutautomatedthreatanalysis...andthebadguysittargets

3 http://www.secureworks.com/research/threats/ Threatanalyses

4 http://xylibox.blogspot.com/

"AnotherBlog,AnotherBox"-malwareanalysisblog

5 http://contagiodump.blogspot.com/

Contagioisacollectionofthelatestmalwaresamples,threats,observations,andanalyses.

6 http://www.avertlabs.com/research/blog/index.php/category/malware-research/

McAfee-Archiveforthe'MalwareResearch'Category

7 http://evilcodecave.blogspot.com/

ITSecurityResearchBlog:ReverseEngineering-MalwareAnalysis-Cryptography-SoftwareEngineering-SoftwareSecurity/Audit

8 http://extraexploit.blogspot.com/"EVERYTHINGORNOTHING"-malwareanalysisblog

9 http://ddanchev.blogspot.com/

DanchoDanchev'sBlog-MindStreamsofInformationSecurityKnowledge

ITSecurityCatalog

87Malware

http://www.inreverse.net/

http://blog.threatexpert.com/

http://www.secureworks.com/research/threats/

http://xylibox.blogspot.com/

http://contagiodump.blogspot.com/

http://www.avertlabs.com/research/blog/index.php/category/malware-research/

http://evilcodecave.blogspot.com/

http://extraexploit.blogspot.com/

http://ddanchev.blogspot.com/

10 http://blog.armorize.com/"ArmorizeBlog"-malwareanalysisblog

11 http://securityblog.s21sec.com/ S21secSecurityBlog

12 http://blog.malwaretracker.com/ malwaretracker

13 http://www.abuse.ch/ TheSwissSecurityBlog

14 http://blogs.paretologic.com/malwarediaries/ MalwareDiaries

15 http://perpetualhorizon.blogspot.com/ PerpetualHorizon

16 http://mnin.blogspot.com/ Coding,Reversing,Exploiting

17 http://blog.eset.com/ ESETThreatBlog

18 http://code.google.com/p/malware-lu/Malwarestechnicalanalysisfromhttp://www.malware.lu

19 http://stratsec.blogspot.de/BAESystemssecurityresearchblog

20 http://fumalwareanalysis.blogspot.com.au/p/malware-analysis-tutorials-reverse.html

MalwareAnalysisTutorials:aReverseEngineeringApproach

Articles

Malwareanalysis

Nr URL

1 http://mtc.sri.com/Conficker/

2 http://www.eset.com/resources/white-papers/Stuxnet_Under_the_Microscope.pdf

3 http://www.aall86.altervista.org/TDLRootkit/TDL4_Analysis_Paper.pdf

4 http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4

ITSecurityCatalog

88Malware

http://blog.armorize.com/

http://securityblog.s21sec.com/

http://blog.malwaretracker.com/

http://www.abuse.ch/

http://blogs.paretologic.com/malwarediaries/

http://perpetualhorizon.blogspot.com/

http://mnin.blogspot.com/

http://blog.eset.com/

http://code.google.com/p/malware-lu/

http://www.malware.lu

http://stratsec.blogspot.de/

http://fumalwareanalysis.blogspot.com.au/p/malware-analysis-tutorials-reverse.html

http://mtc.sri.com/Conficker/

http://www.eset.com/resources/white-papers/Stuxnet_Under_the_Microscope.pdf

http://www.aall86.altervista.org/TDLRootkit/TDL4_Analysis_Paper.pdf

http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4

http://blog.fireeye.com/research/2011/03/an-overview-of-rustock.html

5 http://blog.fireeye.com/research/2011/03/an-overview-of-rustock.html

6 http://www.eset.com/us/resources/white-papers/The_Evolution_of_TDL.pdf

7 http://www.prevxresearch.com/zeroaccess_analysis.pdf

8 http://sophosnews.files.wordpress.com/2012/03/blackhole_paper_mar2012.pdf

9 http://www.crysys.hu/skywiper/skywiper.pdf

10 http://reverse.put.as/2012/08/06/tales-from-crisis-chapter-1-the-droppers-box-of-tricks/

11 https://community.rapid7.com/community/infosec/blog/2012/08/08/finfisher

12 http://reverse.put.as/2012/08/20/tales-from-crisis-chapter-2-backdoors-first-steps/

13 http://reverse.put.as/2012/08/21/tales-from-crisis-chapter-3-the-italian-rootkit-job/

14 https://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers

15 http://www.ikarus.at/fileadmin/user_upload/Download/Report_MarionMarschalek.pdf

16 http://oweng.myweb.port.ac.uk/fbi-tor-malware-analysis/

17 http://www.welivesecurity.com/2013/08/27/the-powerloader-64-bit-update-based-on-leaked-exploits/

18 https://www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf

19 https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf

20 https://www.virusbtn.com/pdf/conference/vb2014/VB2014-Wardle.pdf

ITSecurityCatalog

89Malware

http://www.eset.com/us/resources/white-papers/The_Evolution_of_TDL.pdf

http://www.prevxresearch.com/zeroaccess_analysis.pdf

http://sophosnews.files.wordpress.com/2012/03/blackhole_paper_mar2012.pdf

http://www.crysys.hu/skywiper/skywiper.pdf

http://reverse.put.as/2012/08/06/tales-from-crisis-chapter-1-the-droppers-box-of-tricks/

https://community.rapid7.com/community/infosec/blog/2012/08/08/finfisher

http://reverse.put.as/2012/08/20/tales-from-crisis-chapter-2-backdoors-first-steps/

http://reverse.put.as/2012/08/21/tales-from-crisis-chapter-3-the-italian-rootkit-job/

https://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers

http://www.ikarus.at/fileadmin/user_upload/Download/Report_MarionMarschalek.pdf

http://oweng.myweb.port.ac.uk/fbi-tor-malware-analysis/

http://www.welivesecurity.com/2013/08/27/the-powerloader-64-bit-update-based-on-leaked-exploits/

https://www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf

https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf

https://www.virusbtn.com/pdf/conference/vb2014/VB2014-Wardle.pdf

General

Nr URL Title/Description Date Author

1 http://www.dfrws.org/2015/procee...AdvancingMacOSXrootkitdetection

2015

AndrewCase,GoldenG.RichardIII

Malwaretrackers


1 http://www.malwaredomainlist.com/mdl.php MalwareDomainList

2 https://zeustracker.abuse.ch/ ZeuSTracker

3 https://spyeyetracker.abuse.ch/ SpyEyeTracker

4 http://www.malwareurl.com/listing-urls.php?urls=on

MalwareURL-Websitestatusverification

5 http://hosts-file.net/?s=Browse hpHostsOnline-Simple,Searchable&FREE!

6 http://virustracker.info/ VirusTracker

Onlinemalwareanalysis

ITSecurityCatalog

90Malware

http://www.dfrws.org/2015/proceedings/DFRWS2015-5.pdf

http://www.malwaredomainlist.com/mdl.php

https://zeustracker.abuse.ch/

https://spyeyetracker.abuse.ch/

http://www.malwareurl.com/listing-urls.php?urls=on

http://hosts-file.net/?s=Browse

http://virustracker.info/


1 http://wepawet.iseclab.org/ Wepawet(JavaScriptandFlash)

2 http://www.urlvoid.com/CheckReputationofDomainsandSubdomains

3 http://anubis.iseclab.org/ Anubisisaserviceforanalyzingmalware

4 http://eureka.cyber-ta.org/ AnAutomatedMalwareBinaryAnalysisService

5 http://camas.comodo.com/ ComodoInstantMalwareAnalysis

6 http://ether.gtisc.gatech.edu/web_unpack/

Ether:MalwareAnalysisviaHardwareVirtualizationExtensions

7 http://www.ipvoid.com/ ScanURLformaliciousactivities

8 http://www.norman.com/security_center/security_tools/SubmitaSuspiciousFileforaFREEMalwareAnalysis

9 http://www.threatexpert.com/submit.aspx SubmitYourSampleToThreatExpert

10 http://www.malwaretracker.com/pdf.php ExaminePDFonline

11 http://mwanalysis.org/?site=1&page=submit MalwareAnalysisSystem

12 https://new.virustotal.com/

VirusTotalisafreeservicethatanalyzessuspiciousfilesandURLs

Tools&Projects

ITSecurityCatalog

91Malware

http://wepawet.iseclab.org/

http://www.urlvoid.com/

http://anubis.iseclab.org/

http://eureka.cyber-ta.org/

http://camas.comodo.com/

http://ether.gtisc.gatech.edu/web_unpack/

http://www.ipvoid.com/

http://www.norman.com/security_center/security_tools/

http://www.threatexpert.com/submit.aspx

http://www.malwaretracker.com/pdf.php

http://mwanalysis.org/?site=1&page=submit

https://new.virustotal.com/


1 http://malzilla.sourceforge.net/index.html Malwarehuntingtool

2 http://code.mwcollect.org/ Malwareandattacktracecollectiondaemon

3 http://code.google.com/p/phoneyc/ Purepythonhoneyclientimplementation

4 http://www.mlsec.org/malheur/ AutomaticAnalysisofMalwareBehavior

5 http://www.team-cymru.org/Services/MHR/WinMHR/

WinMHR-FreeMalwareDetector-TeamCymru

6 https://addons.mozilla.org/en-US/firefox/addon/team-cymrus-mhr/

QuicklycheckdownloadedfilesagainstTeamCymru'smalwaredatabasewithjustoneclick!

7 http://www.stoned-vienna.com/ StonedBootkit-TheofficialsiteofStonedBootkit

8 http://sarvam.ece.ucsb.edu/submit.html SARVAM:SearchAndRetrieVAlofMalware

9 http://code.google.com/p/malwasm/ Malwasmwasdesignedtohelppeoplethatdoreverseengineering

10 http://www.cuckoosandbox.org/ CuckooSandboxisamalwareanalysissystem

11 http://rehints.com/ Sharingreverseengineeringknowledge

12 https://objective-see.com/products.html FreeOSXSecurityTools

Onlineself-check


1 http://www.dcwg.org/ TheDNSChangerWorkingGroup(DCWG)

Uncategorized

ITSecurityCatalog

92Malware

http://malzilla.sourceforge.net/index.html

http://code.mwcollect.org/

http://code.google.com/p/phoneyc/

http://www.mlsec.org/malheur/

http://www.team-cymru.org/Services/MHR/WinMHR/

https://addons.mozilla.org/en-US/firefox/addon/team-cymrus-mhr/

http://www.stoned-vienna.com/

http://sarvam.ece.ucsb.edu/submit.html

http://code.google.com/p/malwasm/

http://www.cuckoosandbox.org/

http://rehints.com/

https://objective-see.com/products.html

http://www.dcwg.org/


1 http://zeltser.com/reverse-malware/reverse-malware-cheat-sheet.html

Reverse-EngineeringMalwareCheatSheet

2 http://www.malwaredomainlist.com/forums/index.php?board=2.0 Hugelistofblogs

3 http://www.prevx.com/malwarecenter.aspVerylatesthotfilenamesusedbymalware

4 http://blogs.technet.com/b/markrussinovich/archive/2011/02/27/3390475.aspxTheCaseoftheMaliciousAutostart

ITSecurityCatalog

93Malware

http://zeltser.com/reverse-malware/reverse-malware-cheat-sheet.html

http://www.malwaredomainlist.com/forums/index.php?board=2.0

http://www.prevx.com/malwarecenter.asp

http://blogs.technet.com/b/markrussinovich/archive/2011/02/27/3390475.aspx

VariousStuffHereyoucanfindotherstuffrelatedtosecurity--tools,notesondebugging,blogs,wikis,etc.

Onlinetoolsandservices

Nr URL Description

1 http://skypher.com/SkyLined/heap_spray/small_heap_spray_generator.html Heapspraygenerator

2 http://gorope.me/

FREEOnlineROPGadgetsSearch

3 https://www.corelan.be/index.php/security/corelan-ropdb/ CorelanROPdb

Toolsanddevelopment

Nr URL

1 http://reverse.put.as/wp-content/uploads/2011/06/hackingleopard.pdf

HackingLeopard:ToolsandTechniquesforAttackingtheNewestMacOSX

2 http://www.corelan.be/index.php/2010/01/26/starting-to-write-immunity-debugger-pycommands-my-cheatsheet/

StartingtowriteImmunityDebuggerPyCommands:mycheatsheet

3 http://www.corelan.be/index.php/2009/08/12/exploit-writing-tutorials-part-4-from-exploit-to-metasploit-the-basics/

Exploitwritingtutorialpart4:FromExploittoMetasploit–Thebasics

ITSecurityCatalog

94VariousStuff

http://skypher.com/SkyLined/heap_spray/small_heap_spray_generator.html

http://gorope.me/

https://www.corelan.be/index.php/security/corelan-ropdb/

http://reverse.put.as/wp-content/uploads/2011/06/hackingleopard.pdf

http://www.corelan.be/index.php/2010/01/26/starting-to-write-immunity-debugger-pycommands-my-cheatsheet/

http://www.corelan.be/index.php/2009/08/12/exploit-writing-tutorials-part-4-from-exploit-to-metasploit-the-basics/

4 http://www.corelan.be/index.php/2009/09/05/exploit-writing-tutorial-part-5-how-debugger-modules-plugins-can-speed-up-basic-exploit-development

Exploitwritingtutorialpart5:Howdebuggermodules&pluginscanspeedupbasicexploitdevelopment

5 https://blog.mandiant.com/archives/1899

ExploringArtifactsinHeapMemorywithHeapInspector

6 http://redmine.corelan.be/projects/mona

CorelanTeamprojectpagefor'mona',aPyCommandforImmunityDebugger

7 http://blog.metasploit.com/2008/08/byakugan-windbg-plugin-released.html

SetofextensionsforexploitdevelopmentunderWinDbg

8 https://github.com/djrbliss/libplayground

AsimpleframeworkfordevelopingLinuxkernelheapexploittechniques

9 http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Heappie

Heappie!isanexploit-writing-orientedmemoryanalysistool

10 http://www.hsc.fr/ressources/outils/skyrack/index.html.en ROPgadgetsearchtool

11 https://github.com/neuromancer/seaSymbolicExploitAssistant

12 https://www.corelan.be/index.php/2012/12/31/jingle-bofs-jingle-rops-sploiting-all-the-things-with-mona-v2/

JingleBOFs,JingleROPs,Sploitingallthethings…

ITSecurityCatalog

95VariousStuff

http://www.corelan.be/index.php/2009/09/05/exploit-writing-tutorial-part-5-how-debugger-modules-plugins-can-speed-up-basic-exploit-development

https://blog.mandiant.com/archives/1899

http://redmine.corelan.be/projects/mona

http://blog.metasploit.com/2008/08/byakugan-windbg-plugin-released.html

https://github.com/djrbliss/libplayground

http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Heappie

http://www.hsc.fr/ressources/outils/skyrack/index.html.en

https://github.com/neuromancer/sea

https://www.corelan.be/index.php/2012/12/31/jingle-bofs-jingle-rops-sploiting-all-the-things-with-mona-v2/

withMonav2!!

13 https://community.rapid7.com/community/metasploit/blog/2011/10/11/monasploit MonaSploit

14 https://wapiflapi.github.io/2015/04/22/single-null-byte-heap-overflow/

Visualizingasinglenull-byteheapoverflowexploitation

15 https://blog.skullsecurity.org/2015/how-i-nearly-almost-saved-the-internet-starring-afl-fuzz-and-dnsmasq

HowInearlyalmostsavedtheInternet,starringafl-fuzzanddnsmasq

16 http://googleprojectzero.blogspot.de/2015/11/windows-sandbox-attack-surface-analysis.html

WindowsSandboxAttackSurfaceAnalysis

Blogsbysecuritypeopleorteams

ITSecurityCatalog

96VariousStuff

https://community.rapid7.com/community/metasploit/blog/2011/10/11/monasploit

https://wapiflapi.github.io/2015/04/22/single-null-byte-heap-overflow/

https://blog.skullsecurity.org/2015/how-i-nearly-almost-saved-the-internet-starring-afl-fuzz-and-dnsmasq

http://googleprojectzero.blogspot.de/2015/11/windows-sandbox-attack-surface-analysis.html

Nr URL Description

1 http://sysc.tl/ Patroklos(argp)Argyroudisblog

2 http://jon.oberheide.org/ JonOberheideBlog

3 http://blog.cr0.org/ JulienTinnesblog(Kernel-levelbugs)

4 http://xorl.wordpress.com/category/bugs/ VulnerabilitiesdescriptionsmappedtoCVE

5 http://www.abysssec.com/blog/tag/binary-... VulnerabilitiesbinaryanalysisbyAbysssec

6 http://exploitshop.wordpress.com/ VulnerabilityanalysisblogusingDarunGrim

7 http://0x1byte.blogspot.com/search/label... AlexanderGavrunpublishedvulnerabilities

8 http://sysc.tl/category/advisories/ Patroklos(argp)Argyroudisadvisories

9 http://trapkit.de/advisories/published.h... PublishedSecurityAdvisoriesbyTobiasKlein

10 http://www.scary.beasts.org/security/ChrisEvans:Softwaresecurityholesfoundviaauditing,fuzzing,etc.

11 http://poppopret.blogspot.com/ Hacking&ITSecurityStuff

12 https://www.corelan.be/index.php/articles/ CorelanTeamArticles

13 http://sf-freedom.blogspot.com/ SoftwareVulnerabilityExploitationBlog

14 http://invisiblethingslab.com/itl/Resources.html invisiblethingslab.comResources

15 http://googleprojectzero.blogspot.com ProjectZero

Wikiandweb-sitesonsecurity

ITSecurityCatalog

97VariousStuff

http://sysc.tl/

http://jon.oberheide.org/

http://blog.cr0.org/

http://xorl.wordpress.com/category/bugs/

http://www.abysssec.com/blog/tag/binary-analysis/

http://exploitshop.wordpress.com/

http://0x1byte.blogspot.com/search/label/0-days

http://sysc.tl/category/advisories/

http://trapkit.de/advisories/published.html

http://www.scary.beasts.org/security/

http://poppopret.blogspot.com/

https://www.corelan.be/index.php/articles/

http://sf-freedom.blogspot.com/

http://invisiblethingslab.com/itl/Resources.html

http://googleprojectzero.blogspot.com

Nr URL Description

1 http://www.phrack.org PhrackMagazine

2 http://theiphonewiki.com/wiki/index.php?title=Category:Exploits TheiPhoneWiki

3 http://en.wikibooks.org/wiki/Metasploit TheMetasploitBook

4 http://www.blackhatlibrary.net/ShellcodecsShellcodecsisacollectionofshellcodes,loaders,sources,andgenerators

5 http://skypher.com/wiki/index.php/Main_Page Skypher-thewikiforabsolutelynothing

6 http://grsecurity.net/research.php AcademicResearchPublicationsMentioninggrsecurity/PaX

7 http://uninformed.org/index.cgi? INFORMATIVEINFORMATIONFORTHEUNINFORMED

Collections,lists

Nr URL

1 http://www.shell-storm.org/papers/index.php?lg=english

2 http://secdocs.lonerunners.net/

3 http://www.theamazingking.com/exploit.html

4 http://packetstormsecurity.org/files/tags/paper/

5 http://6dev.net/mirror/doc.bughunter.net/

6 http://www.fuzzysecurity.com/tutorials.html

7 http://projectshellcode.com/

8 http://tools.securitytube.net/index.php?title=Open_Security_Training

ITSecurityCatalog

98VariousStuff

http://www.phrack.org

http://theiphonewiki.com/wiki/index.php?title=Category:Exploits

http://en.wikibooks.org/wiki/Metasploit

http://www.blackhatlibrary.net/Shellcodecs

http://skypher.com/wiki/index.php/Main_Page

http://grsecurity.net/research.php

http://uninformed.org/index.cgi?

http://www.shell-storm.org/papers/index.php?lg=english

http://secdocs.lonerunners.net/

http://www.theamazingking.com/exploit.html

http://packetstormsecurity.org/files/tags/paper/

http://6dev.net/mirror/doc.bughunter.net/

http://www.fuzzysecurity.com/tutorials.html

http://projectshellcode.com/

http://tools.securitytube.net/index.php?title=Open_Security_Training

19 http://jon.oberheide.org/mokb/

20 http://jon.oberheide.org/moab/

21 http://myne-us.blogspot.com/2010/08/from-0x90-to-0x4c454554-journey-into.html

22 http://www.securityaegis.com/the-big-fat-metasploit-post/

23 http://www.gimpel.com/html/bugs.htm

24 http://reverse.put.as/papers/

25 [http://www.xchg.info/ARTeam/conferences/

26 https://code.google.com/p/pentest-bookmarks/

27 https://www.evernote.com/pub/wishi/crazylazy/

28 https://fuzzing-project.org/

29 code.google.com/p/chromium/issues/list...

30 bugzilla.mozilla.org/buglist.cgi...

31 http://www.ioactive.com/ioactive_labs_ad...

ITSecurityCatalog

99VariousStuff

http://jon.oberheide.org/mokb/

http://jon.oberheide.org/moab/

http://myne-us.blogspot.com/2010/08/from-0x90-to-0x4c454554-journey-into.html

http://www.securityaegis.com/the-big-fat-metasploit-post/

http://www.gimpel.com/html/bugs.htm

http://reverse.put.as/papers/

http://www.xchg.info/ARTeam/conferences/

https://code.google.com/p/pentest-bookmarks/

https://www.evernote.com/pub/wishi/crazylazy/

https://fuzzing-project.org/

https://code.google.com/p/chromium/issues/list?can=1&q=ZDI-CAN&sort=-id&colspec=ID+Pri+Mstone+ReleaseBlock+Area+Feature+Status+Owner+Summary+Opened+Reward+Cve+Modified&x=m&y=releaseblock&cells=tiles

https://bugzilla.mozilla.org/buglist.cgi?v4=ZDI-CAN&o5=substring&f1=OP&o3=substring&v6=ZDI-CAN&o7=substring&list_id=7232993&f0=OP&f8=CP&v3=ZDI-CAN&o2=substring&o6=substring&v7=ZDI-CAN&f9=CP&f4=alias&v5=ZDI-CAN&query_format=advanced&j1=OR&f3=component&f2=product&o4=substring&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=RESOLVED&bug_status=VERIFIED&bug_status=CLOSED&f5=short_desc&f6=status_whiteboard&v2=ZDI-CAN&f7=cf_crash_signature

http://www.ioactive.com/ioactive_labs_advisories.html

32 https://docs.google.com/spreadsheets/d/1vY_GipkYMlaitw17UEvIl7J3oyw8iY59v97rSzjX4GM/edit#gid=0

Damnvulnerablethings

Nr URL Description

1 http://exploit-exercises.com/ Providesavarietyofvirtualmachinestoexploit

2 http://sourceforge.net/projects/metasploitable/files/ Metasploitable2

Trainings

Nr URL Description

1 https://www.corelan-training.com/

Win32ExploitDevelopmentclass

2 http://www.opensecuritytraining.info/Training.html TrainingClasses

3 http://pentest.cryptocity.net/

PenetrationTestingandVulnerabilityAnalysis

4 http://www.cis.syr.edu/~wedu/Teaching/CompSec/lecturenotes.html LectureNotes

5 https://community.rapid7.com/community/metasploit/blog/2012/07/05/part-1-metasploit-module-development--the-series

Metasploitexploitdevelopment-TheseriesPart1.

6 http://security.cs.rpi.edu/courses/binexp-spring2015/ModernBinaryExploitation

(tobecontinued...)

ArticlesonDebugging

ITSecurityCatalog

100VariousStuff

https://docs.google.com/spreadsheets/d/1vY_GipkYMlaitw17UEvIl7J3oyw8iY59v97rSzjX4GM/edit#gid=0

http://exploit-exercises.com/

http://sourceforge.net/projects/metasploitable/files/

https://www.corelan-training.com/

http://www.opensecuritytraining.info/Training.html

http://pentest.cryptocity.net/

http://www.cis.syr.edu/~wedu/Teaching/CompSec/lecturenotes.html

https://community.rapid7.com/community/metasploit/blog/2012/07/05/part-1-metasploit-module-development--the-series

http://security.cs.rpi.edu/courses/binexp-spring2015/

Nr URL Description

1 http://msdn.microsoft.com/en-us/magazine/cc163311.aspx

AnalyzeCrashestoFindSecurityVulnerabilitiesinYourApps

2https://blogs.technet.com/b/srd/archive/2009/01/28/stack-overflow-stack-exhaustion-not-the-same-as-stack-buffer-overflow.aspxnotthesameasstackbufferoverflow)

Stackoverflow(stackexhaustion)notthesameasstackbufferoverflow

3 http://sysc.tl/2009/07/02/freebsd-kernel-debugging/FreeBSDkerneldebugging

4 https://blogs.msdn.com/b/sudeepg/archive/2010/04/29/debugging-a-crash-an-example.aspx

debuggingacrash–Anexample

5 http://resources.infosecinstitute.com/debugging-fundamentals-for-exploit-development/

DebuggingFundamentalsforExploitDevelopment

6 http://resources.infosecinstitute.com/in-depth-seh-exploit-writing-tutorial-using-ollydbg/

OllyDbgTricksforExploitDevelopment

7 http://blogs.msdn.com/b/ntdebugging/archive/2013/06/14/understanding-pool-corruption-part-1-buffer-overflows.aspx

UnderstandingPoolCorruptionPart1–BufferOverflows

8 http://blogs.msdn.com/b/ntdebugging/archive/2013/08/22/understanding-pool-corruption-part-2-special-pool-for-buffer-overruns.aspx

UnderstandingPoolCorruptionPart2–SpecialPoolforBufferOverruns

9 http://blogs.msdn.com/b/ntdebugging/archive/2008/02/01/kernel-stack-overflows.aspx

KernelStackOverflows

10 http://www.contextis.com/resources/blog/kgdb-android-debugging-kernel-boss/

KGDBonAndroid:Debuggingthekernellikeaboss

ITSecurityCatalog

101VariousStuff

http://msdn.microsoft.com/en-us/magazine/cc163311.aspx

https://blogs.technet.com/b/srd/archive/2009/01/28/stack-overflow-stack-exhaustion-not-the-same-as-stack-buffer-overflow.aspx

http://sysc.tl/2009/07/02/freebsd-kernel-debugging/

https://blogs.msdn.com/b/sudeepg/archive/2010/04/29/debugging-a-crash-an-example.aspx

http://resources.infosecinstitute.com/debugging-fundamentals-for-exploit-development/

http://resources.infosecinstitute.com/in-depth-seh-exploit-writing-tutorial-using-ollydbg/

http://blogs.msdn.com/b/ntdebugging/archive/2013/06/14/understanding-pool-corruption-part-1-buffer-overflows.aspx

http://blogs.msdn.com/b/ntdebugging/archive/2013/08/22/understanding-pool-corruption-part-2-special-pool-for-buffer-overruns.aspx

http://blogs.msdn.com/b/ntdebugging/archive/2008/02/01/kernel-stack-overflows.aspx

http://www.contextis.com/resources/blog/kgdb-android-debugging-kernel-boss/

11 https://community.rapid7.com/community/metasploit/blog/2015/09/10/a-debugging-session-in-the-kernel

Adebuggingsessioninthekernel

12 https://objective-see.com/blog.html#blogEntry8

KernelDebuggingaVirtualizedOSXElCapitanImage

Listsoflistsofsecurityconferences

Nr URL Title

1 http://en.wikipedia.org/wiki/Computer_se... Computersecurityconference

2 http://www.secsocial.com/blog/?page_id=4... SecurityConferences

3 https://www.google.com/calendar/embed?sr... InformationSecurityConferences

4 http://www.ethicalhacker.net/component/o... EthicalHackerCalendar

5 http://packetstormsecurity.org/papers/ca... PacketStormCFPMonitor

6 http://satoss.uni.lu/lists/ Listofsecurityconferences

7 http://infosecevents.net/calendar/ Upcominginformationsecurityevents

8 http://research.phreedom.org/

TheSecurityResearchIndexisaprojectindendedtohelpthesecuritycommunitykeepupwithalltheresearchpresentedatconferencesaroundtheworld.

9 http://cc.thinkst.com/ ConCollector

10 http://securityconferences.net/ ComputerSecurityConferences

11 http://www.conpiler.com/ CONpiler—Securityconferencesaroundtheworld

12 https://secore.info/conferences SECurityOrganizer&ReporterExchange

13 http://www.clocate.com/conferences/it-se... Clocate-ConferencesandExhibitions

14 http://www.sp3ctr3.me/hardware-security-resources/ HardwareSecurityResources

ITSecurityCatalog

102VariousStuff

https://community.rapid7.com/community/metasploit/blog/2015/09/10/a-debugging-session-in-the-kernel

https://objective-see.com/blog.html#blogEntry8

http://en.wikipedia.org/wiki/Computer_security_conference

http://www.secsocial.com/blog/?page_id=478

https://www.google.com/calendar/[email protected]&gsessionid=OK

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/action,calendar/

http://packetstormsecurity.org/papers/call_for/indexdate.html

http://satoss.uni.lu/lists/

http://infosecevents.net/calendar/

http://research.phreedom.org/

http://cc.thinkst.com/

http://securityconferences.net/

http://www.conpiler.com/

https://secore.info/conferences

http://www.clocate.com/conferences/it-security/su-477/

http://www.sp3ctr3.me/hardware-security-resources/

Bugbounty

Nr URL Description

1 http://weis2007.econinfosec.org/papers/29.pdf TheLegitimateVulnerabilityMarket

2 https://docs.google.com/present/view?id=0Ae_usSLlqH60ZGZnYjI0NTVfMjBobngybWRoaA&hl=en

Google'sVulnerabilityRewardPrograms

3 http://blog.nibblesec.org/2011/10/no-more-free-bugs-initiatives.html

http://www.bugsheet.com/bug-bounties

4 http://blog.bugcrowd.com/list-of-active-bug-bounty-programs/ TheBugBountyList

Timelineandhistory

ITSecurityCatalog

103VariousStuff

http://weis2007.econinfosec.org/papers/29.pdf

https://docs.google.com/present/view?id=0Ae_usSLlqH60ZGZnYjI0NTVfMjBobngybWRoaA&hl=en

http://blog.nibblesec.org/2011/10/no-more-free-bugs-initiatives.html

http://www.bugsheet.com/bug-bounties

http://blog.bugcrowd.com/list-of-active-bug-bounty-programs/

Nr URL Description

1 [http://ilm.thinkst.com/folklore/index.shtml

MemoryCorruptionandHackerFolklore

2 https://zynamics.files.wordpress.com/2010/02/code_reuse_timeline1.pngCodeReuseTimeline

3 [http://www.abysssec.com/blog/2010/05/past-present-future-of-windows-exploitation/

Past,Present,FutureofWindowsExploitation

4 https://media.blackhat.com/bh-us-10/whitepapers/Meer/BlackHat-USA-2010-Meer-History-of-Memory-Corruption-Attacks-wp.pdf

MemoryCorruptionAttacks:The(almost)CompleteHistory

5 [https://paulmakowski.wordpress.com/2011/01/25/smashing-the-stack-in-2011/

SmashingtheStackin2011

6 http://www.isg.rhul.ac.uk/sullivan/pubs/tr/technicalreport-ir-cs-73.pdf

MemoryErrors:ThePast,thePresent,andtheFuture

7 http://blogbromium.files.wordpress.com/2013/01/heap-sprays-to-sandbox-escapes_issa0113.pdf

HeapSpraystoSandboxEscapes:ABriefHistoryofBrowserExploitation

Media

ITSecurityCatalog

104VariousStuff

http://ilm.thinkst.com/folklore/index.shtml

https://zynamics.files.wordpress.com/2010/02/code_reuse_timeline1.png

http://www.abysssec.com/blog/2010/05/past-present-future-of-windows-exploitation/

https://media.blackhat.com/bh-us-10/whitepapers/Meer/BlackHat-USA-2010-Meer-History-of-Memory-Corruption-Attacks-wp.pdf

https://paulmakowski.wordpress.com/2011/01/25/smashing-the-stack-in-2011/

http://www.isg.rhul.ac.uk/sullivan/pubs/tr/technicalreport-ir-cs-73.pdf

http://blogbromium.files.wordpress.com/2013/01/heap-sprays-to-sandbox-escapes_issa0113.pdf

Nr URL Description

1 https://ange4771.imgur.com/AngeAlbertiniposters

2 [https://community.rapid7.com/community/infosec/blog/2011/02/24/dual-cores-metasploit-track-free-download

DualCore'sMetasploitTrack:FreeDownload!

3 http://0xdabbad00.com/2013/04/28/exploit-mitigation-kill-chain/ExploitMitigationKillChain

Advisories

Nr URL Description

1 https://github.com/QubesOS/qubes-secpack/tree/master/QSBs

QubesOSAdvisories

ITSecurityCatalog

105VariousStuff

https://ange4771.imgur.com/

https://community.rapid7.com/community/infosec/blog/2011/02/24/dual-cores-metasploit-track-free-download

http://0xdabbad00.com/2013/04/28/exploit-mitigation-kill-chain/

https://github.com/QubesOS/qubes-secpack/tree/master/QSBs

table of contents - cloudinary · pdf filezef cekaj 9 ... criminals are getting smarter:...

Documents