Source Meets Sink
Source Meets Sink
  • Видео 44
  • Просмотров 219 269
Ret2plt to bypass NX and ASLR in Linux x64
This video shows a practical example of how ret2plt technique can be used in x64 Linux to bypass NX and ASLR protections
Просмотров: 1 387

Видео

Introduction to Procedure Linkage Table (PLT) and Global Offset Table (GOT)
Просмотров 3,8 тыс.2 года назад
This video highlights the basics of Procedure Linkage Table (PLT) and Global Offset Table (GOT)
Blind XXE Part 2 (OOB Data exfiltration)
Просмотров 2,1 тыс.3 года назад
This video provides a walkthrough of how Blind XXE Injection can be exploited using Out of Band (OOB) exfiltration. Please watch: The basics of XML Entities and XXE here: ruclips.net/video/jWX0Gb10J-Y/видео.html The basics of Blind XXE here:
Blind XXE Part 1 (SSRF via XXE)
Просмотров 2 тыс.3 года назад
This video provides a walkthrough of how Blind XXE Injection works in web applications. Please watch the basics of XML Entities and XXE here: ruclips.net/video/jWX0Gb10J-Y/видео.html
XML Externel Entity (XXE) Injection
Просмотров 1,6 тыс.3 года назад
This video explains the basics of XML Entities and XML Externel Entity (XXE) Injection vulnerability.
Return to Libc Part 3
Просмотров 5103 года назад
This is part 2 of the video series covering the topic Return to Libc on Linux x86_64 architecture.
Return to Libc Part 2
Просмотров 5683 года назад
This is part 2 of the video series covering the topic Return to Libc on Linux x86_64 architecture.
Return to Libc Part 1
Просмотров 1,5 тыс.3 года назад
This is part 1 of the video series covering the topic Return to Libc on Linux x86_64 architecture.
Setting up a Kubernetes cluster using kind
Просмотров 13 тыс.3 года назад
This video explains how to set up a kubernetes cluster using a tool called kind. We will also deploy and expose an nginx container in kind cluster. Twitter: @srini0x00
Installing Docker in Ubuntu
Просмотров 1343 года назад
This video demonstrate how to install Docker in Ubuntu 20.04 LTS Virtual Machine.
Root Detection Bypass using Objection
Просмотров 17 тыс.3 года назад
This playlist has a list of free videos from the course "Hacking and Pentesting Android Applications". You can watch the full course here: theoffensivelabs.com/p/hacking-and-pentesting-android-applications
Hacking Kubernetes Clusters
Просмотров 2,4 тыс.3 года назад
This video explains how a Kubernetes cluster can be compromised using a web vulnerability. Check out www.theoffensivelabs.com for a complete Kubernetes Security course.
x64 Linux Binary Exploitation Training
Просмотров 17 тыс.3 года назад
This video is a recorded version of free LIVE online training delivered by @srini0x00 and supported by www.theoffensivelabs.com If you like to get access to the lab VM used in the training, please get free access here: www.theoffensivelabs.com The video covers: 1. A simple x64 Stack based buffer overflow 2. Return to Libc to bypass NX 3. Return Oriented Programming to bypass NX 4. Format String...
Emulating ARM64 Raspberry Pi Image using QEMU
Просмотров 48 тыс.4 года назад
In this video, I explain the process of emulating ARM64 Raspberry Pi Image using QEMU.
Bypassing ASLR and NX in Linux (x86)
Просмотров 2,2 тыс.4 года назад
This video is made by Geoffrey Huck, a student of my Linux(x86) exploit development course. Jef demonstrates how format string vulnerabilities and Return Oriented Programming can be used to bypass ASLR and NX, when exploiting Stack Based Buffer Overflows. Check out the course at: theoffensivelabs.com/p/exploit-development-for-linux-x86
Setting up Damn Vulnerable Thick Client Application [PART 2] - Configuring the server
Просмотров 3,9 тыс.4 года назад
Setting up Damn Vulnerable Thick Client Application [PART 2] - Configuring the server
Setting up Damn Vulnerable Thick Client Application [PART 1] - Installing SQL Server and FTP Server
Просмотров 7 тыс.4 года назад
Setting up Damn Vulnerable Thick Client Application [PART 1] - Installing SQL Server and FTP Server
Hacking and Pentesting Android Apps - Traffic Analysis Revisited
Просмотров 2 тыс.4 года назад
Hacking and Pentesting Android Apps - Traffic Analysis Revisited
Hacking and Pentesting Android Apps - Course Introduction
Просмотров 4244 года назад
Hacking and Pentesting Android Apps - Course Introduction
Bypassing Root Detection in Android Apps using Frida
Просмотров 7 тыс.4 года назад
Bypassing Root Detection in Android Apps using Frida
Hacking and Pentesting iOS Applications - Introduction to frida trace
Просмотров 6 тыс.4 года назад
Hacking and Pentesting iOS Applications - Introduction to frida trace
Hacking and Pentesting iOS Applications - Signing and installing third party applications
Просмотров 8114 года назад
Hacking and Pentesting iOS Applications - Signing and installing third party applications
Hacking and Pentesting iOS Applications - Traffic Analysis
Просмотров 7 тыс.4 года назад
Hacking and Pentesting iOS Applications - Traffic Analysis
Hacking and Pentesting iOS Applications - Course Introduction
Просмотров 1844 года назад
Hacking and Pentesting iOS Applications - Course Introduction
Hacking and Securing JSON Web Tokens(JWT) - None signature attack
Просмотров 2,1 тыс.4 года назад
Hacking and Securing JSON Web Tokens(JWT) - None signature attack
Hacking and Securing JSON Web Tokens(JWT) - Manually creating HS256 signature
Просмотров 2,6 тыс.4 года назад
Hacking and Securing JSON Web Tokens(JWT) - Manually creating HS256 signature
Hacking and Securing JSON Web Tokens(JWT) - Course Introduction
Просмотров 4634 года назад
Hacking and Securing JSON Web Tokens(JWT) - Course Introduction
Exploit Development for Linux (x86) - Understanding NX
Просмотров 5214 года назад
Exploit Development for Linux (x86) - Understanding NX
Exploit Development for Linux (x86) - Using third party shellcode
Просмотров 2874 года назад
Exploit Development for Linux (x86) - Using third party shellcode
Exploit Development for Linux (x86) - Course Introduction
Просмотров 5494 года назад
Exploit Development for Linux (x86) - Course Introduction

Комментарии

  • @RazDorNV
    @RazDorNV 2 месяца назад

    awesome material, concise and clear. love it ❣

  • @user-th3ym9nt2p
    @user-th3ym9nt2p 3 месяца назад

    nice

  • @fadihafez23
    @fadihafez23 5 месяцев назад

    How do you get the gdb view with all those sections (stack, code, variables, etc).? at 5:18 in video. Great tutorial btw.

    • @fadihafez23
      @fadihafez23 5 месяцев назад

      I think I figured it out - I got the .gdbinit from cyrus-and/gdb-dashboard

    • @sourcemeetssink2073
      @sourcemeetssink2073 5 месяцев назад

      I use GEF a GDB plugin

  • @FreeONLINEJyotish-zb6ps
    @FreeONLINEJyotish-zb6ps 6 месяцев назад

    please tell how can i buy this course

  • @FreeONLINEJyotish-zb6ps
    @FreeONLINEJyotish-zb6ps 6 месяцев назад

    sir i want this course from offensive labs , but i couldnot find this produce , please help me

  • @KundonGautam
    @KundonGautam 6 месяцев назад

    why your website is not wotking ? I want to buy your courses

  • @Adsenseonay
    @Adsenseonay 8 месяцев назад

    bro why i know this voice from somewhere....

  • @faiqueali
    @faiqueali 8 месяцев назад

    I am getting (initramfs) error, maybe it is not able to find the partition when I worte blkid it shows nothing. or I guess there is no partition created. when I open the /etc/fstab file there is some other type of entries which I change to /dev/vda1 and vda2.

    • @sagarhp2350
      @sagarhp2350 6 месяцев назад

      Hi , I'm getting the same error (initramfs) , did you find any solution.. ??

  • @jondoough
    @jondoough 10 месяцев назад

    No gui? bad demo

  • @alexgravitos
    @alexgravitos Год назад

    So *that* is how they reverse engineer APIs.

  • @Pandakaniya
    @Pandakaniya Год назад

    Accidentally watched your video. This is awesome work

  • @juicyvanil109
    @juicyvanil109 Год назад

    Thank you

  • @vitaliye86
    @vitaliye86 Год назад

    On windows I can start?

  • @user-xf1re9bm9u
    @user-xf1re9bm9u Год назад

    Can we add a GPU passthrough to this raspberry PI setup such that I can run complex deep learning algorithms on this emulation (irl Raspberry Pi uses Google Coral to allow Raspberry PI to run deep learning based algorithms) If this is possible could you please the link of your source of info on this?

  • @KarolinaRiddle111
    @KarolinaRiddle111 Год назад

    Can you help me? I also can not find pop rdi instruction. What should I do? Enable or disable some other option?

  • @maboswansong856
    @maboswansong856 Год назад

    Hi! is it possible to install windows arm64 ? Ty ;)

  • @0xn4if
    @0xn4if Год назад

    Can you upload the lab for us?

  • @nguyenluu4285
    @nguyenluu4285 Год назад

    Please give me the file yaml was not

  • @davidwilson4804
    @davidwilson4804 Год назад

    How to prevent Based on some input field like date parameter Could you please reply it

  • @frozendeadbush5026
    @frozendeadbush5026 Год назад

    I cannot find the gadget pop rdi, I could only find pop rbp; ret;

  • @frozendeadbush5026
    @frozendeadbush5026 Год назад

    How do I find the offset to the system and exit function? I tried using the page offset using xinfo but it doesn't work.

  • @st3alth_chased643
    @st3alth_chased643 Год назад

    Damn.. i learn alot to this.. i didnt expect this to would work.. idor to sql injection

  • @yppjeevan
    @yppjeevan Год назад

    virtual machine and relevant files are unavailable in both google cloud and mega link u have shared

  • @funil6871
    @funil6871 Год назад

    THANK YOU! AWESOME! (YOU ARE AWESOME)

  • @pkqqq
    @pkqqq Год назад

    Your content is very rich, thank you, You helped me alot

  • @ansrhl9448
    @ansrhl9448 Год назад

    Could. you also make a similar video on relocatable shared libraries?

  • @nothingnew3831
    @nothingnew3831 Год назад

    i followed every step but i did get release folder on desktop ...what can i do now sir?

  • @prasanthbodepu8221
    @prasanthbodepu8221 Год назад

    Could someone kindly provide me with a working link to the VM? The links that were mentioned in the course don't seem to be working.

  • @Teruroom
    @Teruroom Год назад

    参考になりました。ありがとうございます😊

  • @McdRecordsOfficial
    @McdRecordsOfficial Год назад

    response is encoded in funny characters you know how to decrypt then ? otherwise it is useless

  • @vishnujg8374
    @vishnujg8374 Год назад

    Hey can you tell me how to do the same for a docker image running my nginx website pls???

  • @DEADCODE_
    @DEADCODE_ Год назад

    i like to hacking apis i love them i have a book for api hacking

  • @theone4808
    @theone4808 Год назад

    Wow this is great! Thanks really helped me understand things a lot better.

  • @hetmht
    @hetmht Год назад

    Fantastic! Loved Your Way Of Teaching.

  • @TheBashir007
    @TheBashir007 Год назад

    Hi u there

  • @asabhish
    @asabhish Год назад

    You are using qemu-system-aarch64 in the command, and the memory is 1GB, I am guessing the raspberry Pi guest is 3B model. Can you please confirm if the network configuration that you did for the guest Raspberry Pi system is NAT network? Because you have not mentioned the broadcast range of your host system, I am slightly confused. I am looking for some help regarding a public bridged network between my emulated guest Raspberry Pi and my host Linux system, so that I am able to see my emulated system as a separate LAN device in my router. I have had some luck with bridged network while emulating older models (qemu-system-arm with 256 MB RAM). But for some reason, the 1G aarch64 variant doesn't click, no matter what! Please share any insight that you might have regarding this. Thx

  • @LeonardoLabolida
    @LeonardoLabolida Год назад

    Good video. Thank you!

  • @codinggang77
    @codinggang77 Год назад

    bro please upload more videos

  • @saicharan__0690
    @saicharan__0690 Год назад

    Is jail break needed?

  • @xrayonthemove
    @xrayonthemove Год назад

    Brilliant video!! Thanks a ton; keep uplaoding more!

  • @anishgoyal4424
    @anishgoyal4424 Год назад

    One of the best videos

  • @paulwratt
    @paulwratt Год назад

    umm.. why "delete patition" method? why not _truncate_ with "parted"? or use the same "expand partition" command that RPi (and others) use (resize2fs)?

  • @festchest120
    @festchest120 Год назад

    Thanks for your great tutorial. Did you understand the reason why the formula for calculating the stack base address is wrong and you must add a fixed offset to it?

  • @TapanDThaker
    @TapanDThaker Год назад

    Awesome explanation ! Thank you

  • @gxbytes
    @gxbytes Год назад

    can we bypass liapp alert ???

  • @computersindia
    @computersindia Год назад

    Excellent Presentation!!!

  • @ilabsentuser
    @ilabsentuser 2 года назад

    I found this and seems pretty good, but, where can I get this VM?

  • @diegoporras7769
    @diegoporras7769 2 года назад

    Missed important details between 6:01 and 6:20, that's the whole relationship between PLT and GOT.

    • @FlamurMustafa-l4l
      @FlamurMustafa-l4l 2 месяца назад

      what is that information

    • @diegoporras7769
      @diegoporras7769 Месяц назад

      @@FlamurMustafa-l4l I forgot it myself... But w/o watching the video again I think it was on how the LPT/GOP resolution worked.

  • @vishwar2671
    @vishwar2671 2 года назад

    why fdisk is not working for me ~/rasb$ sudo fdisk -l 2022-09-06-raspios-bullseye-arm64-lite.img fdisk: cannot open 2022-09-06-raspios-bullseye-arm64-lite.img: Operation not permitted

  • @nabeelasimofficial1577
    @nabeelasimofficial1577 2 года назад

    Thanks so much, really helped a lot