Typosquatting programming language package managers

Posted on Mi 08 Juni 2016 in Security • Tagged with PyPi, Npmjs.com, rubygems.org, security, TyposquattingLeave a comment

Edit: It seems that the blog post and the thesis caused quite some interest. Please contact me under the following mail address, since my mail server on this VPS is constantly down :/ tschachn [|[at]|] hu-berlin [[|dot|]] de

In this blog post I will show how:

  • 17000 computers were forced to execute arbitrary code by typosquatting programming language packages/libraries
  • 50% of these installations were conducted with administrative rights
  • Even highly ...
Continue reading

Nebula Wargame walkthrough Level 10-19

Posted on Di 29 September 2015 in Wargames • Tagged with Linux, Programming, Security, Problem SolvingLeave a comment

Walkthrough of nebula wargame from level 10 to level 19

Continue reading

Nebula Wargame walkthrough Level 0-9

Posted on Mo 28 September 2015 in Wargames • Tagged with Linux, Programming, Security, Problem SolvingLeave a comment

In this blog post we will walk through the solutions of the levels 0 to 9 of the Nebula wargame, which is hosted on http://exploit-exercises.com. This writeup will force me to memorize commands better and exercise a bit. I fear that this writeup is of no use for other people, since you hopefully want to solve those exercises on your own :)

Level 0 - Finding setuid programs in the ...

Continue reading

Solution for wargame natas19

Posted on Di 15 September 2015 in Php • Tagged with Python, Wargames, Php, SecurityLeave a comment

Hi everyone

I am still trying to solve wargames on overthewire. Level 19 proofed to be very similar to level 18, where server side code looks something like the following:

<?

$maxid = 640; // 640 should be enough for everyone

function isValidAdminLogin() { /* {{{ */
    if($_REQUEST["username"] == "admin") {
    /* This method of authentication appears to be unsafe and has been disabled for now. */
        //return 1;
    }

    return 0;
}
/* }}} */
function isValidID($id) { /* {{{ */
    return is_numeric($id);
}
/* }}} */
function createID ...
Continue reading

Solution for Natas11 for natas wargame on overthewire.org

Posted on Do 10 September 2015 in Php • Tagged with Wargames, Php, Programming, SecurityLeave a comment

Solution for Natas web security wargame with by XORing the plaintext with the ciphertext...

Currently I am playing some wargames on overthewire.org.

The first 10 levels were very easy and everyone with some technical knowledge and programming experience should be able to solve them. But somehow I got stuck for a few hours on level 11. The task is to modify a XOR encrypted cookie. For some reason I ...

Continue reading