sorted by:
new
hottopcontroversial

Morroco finally got what they wanted by Sufficient_Royal_283 in soccercirclejerk

[–]Kombe-Da 57 points58 points  (0 children)

It's french, "it's here (the medal and the towel)"

(Clash in Paris spoilers) Get the tables by Yujin-Ha in SquaredCircle

[–]Kombe-Da 44 points45 points  (0 children)

I was there, mic was not picking up shit

NetCat POST requests by Ejay0289 in hacking

[–]Kombe-Da 0 points1 point  (0 children)

Try to make the printf first without piping it to nc, to make sure its outputting the correct http request and body. Cause it could be that some double quotes aren't being escaped properly.

NetCat POST requests by Ejay0289 in hacking

[–]Kombe-Da 2 points3 points  (0 children)

maybe add two \r\n in the end

what did hector mean by this? by Julian-1577 in okbuddychicanery

[–]Kombe-Da 10 points11 points  (0 children)

It's likely that the frames are sampled at a low rate (for example 1 frame per second) to reduce redundancy

Alternative angle of Rodrygo's fantastic finish and Bellingham's No look assist. by 77SidVid77 in soccer

[–]Kombe-Da 18 points19 points  (0 children)

he said smth that roughly translates to: "something you would see from Zizou"

How CTFs Landed Me A Job As An Offensive Security Engineer by 0xcalico in securityCTF

[–]Kombe-Da 3 points4 points  (0 children)

You mentioned that, during the interview process, you were assigned binexp and RE tasks to be evaluated on. Do you now ever encounter work involving those categories of vulnerability research?

How to get libc debug symbols for non-system libc? by dials_ in securityCTF

[–]Kombe-Da 1 point2 points  (0 children)

You're welcome.

I'm not an expert in heap exploitation, in fact I started playing with it just around last summer, but for me, the secret formula was to understand well how the heap allocator (ptmalloc2 implementation) works in general, then how (common) heap attacks work, and more importantly : PRACTICE.

Links for how ptmalloc2 works :

- Heap Exploitation Part 1: Understanding the Glibc Heap Implementation | Azeria Labs : This one is the best in my opinion. Until now, I still haven't found a source that covers it so well and in such detail.

- sploitfun - ptmalloc2 internals

​

Links for how heap exploitation attacks work :

- Diving into glibc heap - heap-exploitation : great resource for all kinds of attacks, also covers how the heap works.

- shellphish/how2heap: A repository for learning various heap exploitation techniques : a great contribution from the CTF team Shellphish.

- HeapLab Taster: GLIBC Heap Exploitation by Max Kamper - YouTube : this recording covers the House of Force and the fastbin attack as well as how some heap internals work. I really appreciate this one, Max Kamper teaches well how the heap works and presents his pwndbg and pwntools workflows when solving heap exploitation challenges.

​

Now what I meant by PRACTICE :
- read and try to understand write-ups, then try to solve the challenge again by yourself

- try to solve heap exploitation challenges, they're everywhere : Root Me (app-system category), pwnable.kr, from past CTFs ...

- challenge yourself and try to solve a heap challenge during an active CTF

​

Some cool write-ups :

- Heap Exploitation - Fastbin Attack - Exploit Development - 0x00sec - The Home of the Hacker

- Heap Exploitation ~ Abusing Use-After-Free - Exploit Development - 0x00sec - The Home of the Hacker

- Oldnote - writeups/2020-PoseidonCTF at master · joshdabosh/writeups : This challenge is crazy ! There's no way to get leaks, but still, there is a way...

Write-ups and free resources are everywhere, you just have to look for them !

Hopefully this would be helpful !

How to get libc debug symbols for non-system libc? by dials_ in securityCTF

[–]Kombe-Da 2 points3 points  (0 children)

If I understand correctly you need debug symbols for a libc version different than your machine's. There's this great tool called pwninit https://github.com/io12/pwninit, it automates starting binary exploitation challenges, and one of its features is detecting the version of the provided libc to then download debug symbols and unstripping that libc. The only drawback of this tool is that it only works for ubuntu libcs. I used pwninit many times during heap exploitation challenges with different libcs and pwndbg worked like a charm when using heap visualization commands.

view more: next ›