Hi everyone, I'm looking for a way to arbitrary decompress a raw compression data rar5 (Not a winrar archive itself), based on compression method in meta data, and I wounder why there is no a comunity for such a thing.
I've tried to put it in a another winrar file and rebuild the archive with changing sizes, fixing checksums , brutefoce the compression methods, ....etc, but it didn't work, I don't care about recover the whole file by the way, So my questins are:
Q1: Is there way to recover the orignal file from compressed archive raw data or at least part of it (that would be enough) ?
Q2: Can I figure out the type of file (without relying on compression ratio) ?
Q3: Is there an existing script/project that isolated the decompression logic of rar archives from open source unrar utility ?
- not that the compressed data has an image extention but that could be changed manually in winrar archive , so I'm not sure if it's an image in the first place.
thank you for you time, any answers will be highly appriciated.

I was recently reading about format strings and I came across this article from phrack, https://phrack.org/issues/67/9.html . It was a very good read, but ther was this line

https://preview.redd.it/pqwqhn7ghmzd1.png?width=1153&format=png&auto=webp&s=122833b534f2d1163271be438e9184d2009fdf88

now, my problem is kinda embarassing, I cannot find the 'rebel' article, does anyone know where it might be......(pardon me if it is kinda lame)

I did download all the tar of phrack , usually I just do a global find and try to find stuff of interest. it is very helpful.

https://preview.redd.it/bmrbxpddgxwd1.png?width=1121&format=png&auto=webp&s=2faa8b0f3c7fd32515297e31f140e6e06ac02a01

now lets say we have a canary like [7 bytes][x00] , wont this be same as any other string, like strcpy would copy the 7 bytes and then terminate when it sees a null charecter and then append a null charecter of its own. that essentially means the same. I am not understanding how a null value is gonna help, maybe in the middle, not sure how at then end.

So I randomly wandered upon this video:

https://www.youtube.com/watch?v=16szBsQjyGM

The images shown while scrubbing the video progress bar is an entire different video compared to what's being shown. The captions don't match the real video but the images shown in preview when scrubbing.

Any ideas how they're achieving this? It seems interesting.

An example of what I mean: https://imgur.com/a/0FsiIBW

Perhaps they're using this technique to bypass youtube's copyright strikes?

I am trying to access the second argument ( the one I set up "AAAA" ) . I can see argc to be 2 ( at $ebp+8), but any attempts to access $ebp+0xc does not give me AAAA, what am I doing wrong

https://preview.redd.it/p6uoib9grjud1.png?width=948&format=png&auto=webp&s=d42abd822c9a27647c478efe368b26368a682b98

https://preview.redd.it/gbyz88bhrjud1.png?width=1044&format=png&auto=webp&s=073b07386755c629f48fb935451e0a0059a5de40

Hello ,

I'm working on a security companion for apps that lets you chat with your application's logs/traces , i'm looking for a set of questions that may come to your minds that would either help investigate an issue or detect malicious behavior via alerting.

I will combine all the questions and make sure the tool respond to most top of mind questions first.

Thank you for your help,

https://preview.redd.it/miow6goitctd1.png?width=2525&format=png&auto=webp&s=2d1291de63c9ca935a1129cc91631a3bbed15dd2

https://preview.redd.it/xgm4ccpztctd1.png?width=2502&format=png&auto=webp&s=853a62811d3eb73f7d90d342282cee52c866acb2

Has anyone solved the widget challenge in the Broadcast Receiver hex? Flag 19.

Hi,
I'm working on a power side-channel analysis project using the Sakura X board. However, due to the board being somewhat outdated, I’m having trouble finding proper guides and documentation. If anyone has experience with this board, I’d appreciate your help. Thanks :)

Hello,

I was working on a web app and I was trying to look at JS libraries used by the app.

I could see that the lib Lodash was used in version 4.17.15 that is vulnerable to multiple CVE (https://security.snyk.io/package/npm/lodash/4.17.15).

I took this one by curiosity :

Code Injection

lodash is a modern JavaScript utility library delivering modularity, performance, & extras.

Affected versions of this package are vulnerable to Code Injection via template.

PoC

var _ = require('lodash');

_.template('', { variable: '){console.log(process.env)}; with(obj' })()

From what I can see, it is when the Lodash lib is used in the back-end because the function "require" does not exist on JS client-side.

So to be exploited, this code has to run on server-side. This vuln is existing only if we have access to the JS engine in the server ? or is there a way to trigger it from the client-side ? (Maybe this kind of vulns is never exploitable from client side ?)

Thanks guys

Hi!

I probably think this question might be asked a couple of times, but I am confused in selecting some good programs and could use your help.

I am a final year student from India completing my undergrad in CSE with specialization in Cyber Security. As per my background I am totally into Systems security, I am also OSED Certified and currently preparing for my PNPT Exam.

I saw a few programs on MS in Cyber security offered by ETH Zurich , NUS , NTUS and UCL

I am looking for a course that would be industry relevant and the knowledge will be actually useful.

Regarding countries I am targeting Europe and UK but open to other countries as well. I have a CGPA of 8.9/10 (if it helps) and have relevant work experience in the field of security.

Do you suggest doing masters from India or abroad will be a better option and also if you could suggest any better courses?

I am a bit confused on taking the programs and could use your help.

Thanks!

I'm trying to make a shellcode that executes dlopen once it's injected. I'm using ragg2 from radare2 to convert my C code to shellcode bytes and from there I have no idea how to correctly find the pointer to replace.

I can get the address of the real dlopen from the target by parsing it's proc maps but I can't figure out how to replace it in my shellcode bytes.

Could anyone help me with some examples?

Hi everyone, I was trying to practice steganography and came up with an idea to hide AndroRAT in an image and try to hack my own old android. So, I clone AndroRAT by karma978 from github and created a karma.apk using the instructions given in READ.me , however, I change my mind and created a http server using python in 8000 port. After all of this, I port forwarded on my Kali which was running on VM and connected to internet using bridge mode. However, when I tried to access the file using http://kali_ip:8000/karma.apk from my android which was using mobile data. I couldn’t able to access the file. Where did I make a mistake (i checked all the configuration, IP and port are correct). Or is their any better solution for this.

Hello,

I'm looking for a course that teaches about modern mitigations in binaries and how to bypass them. I have basic background knowledge about binary exploitation.

Do you have any recommendations? Everything from paid courses to YouTube playlists or channels will be super helpful.

Thanks!

I have a C program that simply prints "Hello, world!", I started the program using r2 -d test.exe. As soon as I did that, r2 says "INFO: Spawned new process with pid...". and if I run dc, it open up another cmd, quickly print hello word and exist. I want to work in the same terminal.

heres stackoverflow link: https://stackoverflow.com/questions/78884562/radare2-debug-mode-dc-not-working-properly

I am beginner and I heard best way to study cybersecurity is CTF and I don't know where do I participate in CTF and is there beginner friendly CTF or do I need some knowledge beforehand if so then what then .If you can be more specific.Thankyou

Hi, I’m very much a beginner, and I wanted to ask a few questions before I try anything:

1. Is the LiveOverflow minecraft server still up? And if so, where’s the absolute first place I should start looking for it? (Don’t spoil the search, please)
2. What’s the bare minimum I should be doing to ensure my network safety if I’m doing network scans / other penetration testing, especially as a beginner?

I have a feeling I may need more questions, but I don’t know what to ask lol. Thanks!

Error getting while asking chatgpt4 to do a task

Hi everybody,

I enjoy infosec and ethical hacking, but am not a professional, nor even a talented hobbyist.

So my solving skills are at a beginner level. However, I enjoy watching and learning through CTF tutorials on YouTube.

So, here's my question: without having any connections to security researchers or similar, is it possible to create a few CTF challenges myself and (that's what the question is about) host them somewhere secure, so that people can solve them, and then there's a but....

BUT: regardless on how well they solve them, they shouldn't be able to get any further into the system.

Let's say I rent a virtual server and host a few challenges in docker containers on them.... What prevents professionals to break out of these containers and take over my server?

Not having the knowledge to secure a server sufficiently, this might very well be possible.

Yeah, and those challenges would be cryptography based, not related to securing servers, obviously ;)

And even though I wouldnt host anything other than those challenges (so no sensitive data could be obtained), I still wouldn't like the idea of somebody breaking out of the docker environment that was meant for the challenge and have access to my server.

Are there providers just for this kind of thing? Our what would you recommend?

Thank you in advance for your ideas :)

Oh and BTW those challenges would mostly be building upon cryptographic methods that come to mind when I watch other challenges.

For example, there is some kind of Cypher or hashing method, and it makes total sense that it can be cracked / reverse engineered, so I imagine additional security layers that I'd like to have tested. Can people. See through these as easily as through existing solutions, or might they be something that actual professionals might find interesting and build new solutions upon?

(in other words, not being a professional, perhaps I think outside the box in some regards that make total sense to me but wouldn't be imagined by people that were educated to do this kind of thing)

is there any youtube series where a youtuber hack a game but from a Cybersecurity POV

I watched Minecraft:HACKED and Pwn Adventure 3: Pwnie Island I and I want(NEED) MORE

I was following the playlist of PwnAdventure3 and while setting up the network proxy I am not able to setup a connection because the script gives an error that the address is busy. I have tried all combinations: Server then Proxy and Proxy then Server but whichever starts later is not able to connect the port because the first one is already binded to that. I am running the server on the docker image on ip 127.0.0.1. Here is the exact error messages:

└─$ python3 proxy_part9.py

[proxy(3333)] setting up

[proxy(3000)] setting up

Exception in thread Thread-1:

[proxy(3001)] setting up

Exception in thread Thread-2:

[proxy(3002)] setting up

Traceback (most recent call last):

Traceback (most recent call last):

File "/usr/lib/python3.11/threading.py", line 1045, in _bootstrap_inner

[proxy(3003)] setting up

Exception in thread Thread-7:

[proxy(3004)] setting up

Exception in thread Thread-5:

File "/usr/lib/python3.11/threading.py", line 1045, in _bootstrap_inner

[proxy(3005)] setting up

Traceback (most recent call last):

Traceback (most recent call last):

File "/usr/lib/python3.11/threading.py", line 1045, in _bootstrap_inner

Exception in thread Thread-11:

Traceback (most recent call last):

File "/usr/lib/python3.11/threading.py", line 1045, in _bootstrap_inner

$ self.run()

self.run()

Exception in thread Thread-8:

Traceback (most recent call last):

File "/usr/lib/python3.11/threading.py", line 1045, in _bootstrap_inner

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 73, in run

Exception in thread Thread-12:

Traceback (most recent call last):

self.run()

File "/usr/lib/python3.11/threading.py", line 1045, in _bootstrap_inner

self.run()

self.run()

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 73, in run

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 73, in run

self.run()

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 73, in run

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 73, in run

self.g2p = Game2Proxy(self.from_host, self.port) # waiting for a client

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 73, in run

self.g2p = Game2Proxy(self.from_host, self.port) # waiting for a client

self.g2p = Game2Proxy(self.from_host, self.port) # waiting for a client

self.g2p = Game2Proxy(self.from_host, self.port) # waiting for a client

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

self.g2p = Game2Proxy(self.from_host, self.port) # waiting for a client

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 44, in __init__

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 44, in __init__

self.g2p = Game2Proxy(self.from_host, self.port) # waiting for a client

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 44, in __init__

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 44, in __init__

sock.bind((host, port))

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 44, in __init__

sock.bind((host, port))

sock.bind((host, port))

sock.bind((host, port))

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

OSError: [Errno 98] Address already in use

sock.bind((host, port))

OSError: [Errno 98] Address already in use

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 44, in __init__

OSError: [Errno 98] Address already in use

OSError: [Errno 98] Address already in use

sock.bind((host, port))

OSError: [Errno 98] Address already in use

OSError: [Errno 98] Address already in use

File "/usr/lib/python3.11/threading.py", line 1045, in _bootstrap_inner

self.run()

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 73, in run

self.g2p = Game2Proxy(self.from_host, self.port) # waiting for a client

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/home/dv/Desktop/PwnAdventure3/Pwn3/tools/proxy/proxy_part9.py", line 44, in __init__

sock.bind((host, port))

OSError: [Errno 98] Address already in use

quit

Hey there! I stumbled upon a fresh sample of Formbook info-stealer malware. During analysis I found this malware hides its payload into a vulnerable WordPress website.

Read the article to know more.

#FormBook #Stealer #MalwareAnalysis #MalwareResearch #CTI #ThreatIntel #InfoSec

SHA256 : 7d7d6f46787e230d59ce6b73c39f7b63510c7a6d13a886959a27bad0f8477162

https://ashishranax.github.io/posts/FormBook-Malware-The-Uninvited-Guest-of-WordPress/

I just got landed my first interview for penetration tester, I want to secure a job in this. I would love if you guys can help me by telling the topics I should prepare for the interview and any questions that you guys have gotten asked during your interviewinc similar fields.

Hello,

I have a binary that has PIE, ASLR, nx, full RELRO, no canary. there is buffer overflow vulnerability, but no string format vulnerability (nothing gets printed with user input). how can i leak pie base address?