Reading Room

  1. ActiveX – Active Exploitation
    warlord – http://www.nologin.org/
    Abstract: This paper provides a general introduction to the topic of understanding security vulnerabilities that affect ActiveX controls. A brief description of how ActiveX controls are exposed to Internet Explorer is given along with an analysis of three example ActiveX vulnerabilities that have been previously disclosed.
  2. Exploit writing tutorials
    Peter Van Eeckhoutte – http://www.corelan.be:8800/
    Abstract: In this multi-part tutorial, Peter beautifully explains the various stages of exploit development. He also discusses advance exploits and how to bypass exploit protection mechanism. A tutorial on porting your exploits to the Metasploit framework is included as well. A must-read for every Security professional
  3. Smashing the Stack in 2010
    Andrea Cugliari & Mariano Graziano – http://mariano-graziano.llab.it/, http://5d4a.wordpress.com/
    Abstract: Report for the Computer Security exam at the Politecnico di Torino. It deals with buffer overflows in modern Linux and Windows systems considering also all the countermeasures introduced by software companies.
  4. Windows remote administration tools overview
    Jean-Baptiste Marchand
    Abstract: The purpose of this document is to present the different methods and tools frequently used to administer remote Windows systems.
  5. Pass-the-hash attacks: Tools and Mitigation
    Bashar Ewaida
    Abstract: Although pass-the-hash attacks have been around for a little over thirteen years, the knowledge of its existence is still poor. This paper tries to fill a gap in the knowledge of this attack through the testing of the freely available tools that facilitate the attack. While other papers and resources focus primarily on running the tools and sometimes comparing them, this paper offers an in-depth, systematic comparison of the tools across the various Windows platforms, including AV detection rates.
  6. Blindfolded SQL Injection
    Ofer Maor & Amichai Shulman – iMPERVA
    Abstract: The purpose of this document is to refute the notion that SQL Injection can only be exploited with detailed error messages, and to present simple techniques used by attackers when no detailed error messages are present. These techniques all come under the name ’Blindfolded SQL Injection’.
Advertisements

One thought on “Reading Room

  1. Pingback: Exploiting ActiveX « Security Thoughts

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s