欢迎信息安全界的朋友!黑站、挂马的勿扰!只做基础理论研究。交流IDS、IPS、buffer overflow、内核编程 、sniffer,技术共享!

                                                 
              .                 .    . . .                  
             .                        .        .            
         'BBNNNN                        .  .                
          N                      .       .     .            
         N                         .   .   .                
         N.  .                        .                     
        N  .   .                  .  N   .  NN              
        B   .                       NN.     NN              
       NN                  .  .     BN      NN              
       N .  . .           .      .  ND.     NN              
       N. .                ..  .    NN .    NN              
       N    ..                   .  NB      NN              
       N                 B. .       NN.     NN                    
       N  .               NN        NB .    NN              
       NNNBNNNN            B     .  N.      NN            
       N  .                        .N       NN              
 .     N                 .          N.      NN              
      .N   .            .   .    .  N  .  . BN  ..          
  ..  .B .   .     ..     .       . N       NN     .  .     
       N       NNN.  B.    .  .     N   NNNNNN NNN          
    .. N       N N  N  .NNNB    NNN.B. BN. NBN   B. B.      
      .B .   .   N NN . N N  . NB NBN .N    NN   N  N  .    
     .NN   .    N NN   .  B   .B .  N  N. . B    N.BN.      
  .   N         N N  .    NN   N  ..B. N .  N   .B NN       
      N         NN       NNN   N  NNN  N   NB   NNNN        
  . . B.        BN       NN  .  NNN NN NNNNNN. .NB N  .     
      N         N  . .              . . NN . N.  . N        
   .  N          .                        . .  .  .B   .    
    . D.        .    .      .    .     .      .    N.       
      N          .      .  '    .            .     N  .     
      N          .  .     .       .       .        N  .     
  .             .               .             .   NN .      
                                    . .           N   .     
                                  .        .   .  N .       
                                         .  .     N. ..     
                                    .     .      NN    .    
                                .     . .    NNBNB. '       
                                 . .  BNBNNNNN         .    
                                . .   . . .           .     
                                 .    .      .                                                                                                                

分类: 漏洞挖掘预览模式: 普通 | 列表

PDF File Standard Fuzzer

#!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# PDF FUZZER -- TAKE IT TO THE HEAD
# :) HAVE FUN :)

use PDF::Create;
use Getopt::Std;

@overflow = ('A' x 8200, 'A' x 11000, 'A' x 110000, 'A' x 550000, 'A' x 1100000, 'A' x 2200000, 'A' x 12000000, "\0x99" x 1200, "//AAAA" x 250, "\\AAAA" x 250);

@fmtstring = ("%n%n%n%n%n", "%p%p%p%p%p", "%s%s%s%s%s", "%d%d%d%d%d", "%x%x%x%x%x",
 

查看更多...

分类:漏洞挖掘 | 固定链接 | 评论: 43 | 引用: 0 | 查看次数: 25366

介绍几种国外的FUZZ


Gfuzz

Gfuzz is a web application fuzzing environment which combines fine-grained taint analysis on the server-side (using CORE Grasp) with grammar-based analysis. This allows to perform fuzzing tests and accurately detect attacks feeding the grammar analyzer with the executed SQL queries (on the server side) together with security taint marks for each query.

查看更多...

分类:漏洞挖掘 | 固定链接 | 评论: 76 | 引用: 0 | 查看次数: 17980

怎样检测IE网马?大家跟贴

RT
分类:漏洞挖掘 | 固定链接 | 评论: 18 | 引用: 0 | 查看次数: 9370

What is Fuzz Testing?

Fuzz testing or Fuzzing is a software testing technique, often used to discover security weaknesses in applications and protocols. The basic idea is to attach the inputs of a program to a source of random or unexpected data. If the program fails (for example, by crashing, or by failing in-built code assertions), then there are defects to correct. It should be noted that the majority of security vulnerabilities, from buffer overflows to cross-site scripting attacks, are generally the result of insufficient validation of user-supplied input data. Bugs found using fuzz testing are frequently severe, exploitable bugs that could be used by a real attacker. This has become even more true as fuzz testing has become more widely known, as the same techniques and tools are now used by attackers to exploit deployed software. This is a major advantage over binary or source auditing, or even fuzzing’s close cousin, fault injection, which often rely on artificial fault conditions that are difficult or impossible to exploit.

Fuzzing Tools

The following tools and testing frameworks are used by professional penetration testers when performing a blackbox assessment of a network, server or application. If you would like to learn more about the black-box assessment methodology or to find out how to use fuzz-testing techniques for your application, please contact a Hacksafe senior consultant.

查看更多...

分类:漏洞挖掘 | 固定链接 | 评论: 133 | 引用: 0 | 查看次数: 25037