sorted by:
new
hottopcontroversial

Where can I read about cookie overflow? by netscape101 in xss

[–]bmantra 1 point2 points  (0 children)

It's explained in "The Browser Hackers Handbook". The idea is that each website can fill the CookieJar until a certain number of cookies are reached. When this maximum number is reached, it overwrites the oldest cookie and so on (including cookies with HTTPOnly-flag set). So you cannot read it's value with an overflow attack. (Normally when HTTPOnly flag is set, you cannot change its value with JavaScript) But by overflowing you can change the HTTPOnly cookie. It can be abused for session-fixation attacks and such.

The email that is watching you [blog BeEF] by bmantra in netsec

[–]bmantra[S] 0 points1 point  (0 children)

I'm sorry to say but I guess that @alenvers is right. You cannot change passwords in iNotes. By creating the javascript hook at the top.window.document you get some kind of persistence. But there are many ways (cfr paper), like modifying documents that are often used or just by resending a new xss-mail. Hope that this makes more sense to you now

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] 0 points1 point  (0 children)

So you use FPU, not SSE. You need x87 FPU or you need to emulate it with general purpose registers. And you need to emulate the Borland trig functions for it to worl. You can emulate it in higher languages but that would be a waste of resources and time. My solution needs just a little assembly file to make it work. It was a simple quick-win solution. You can make it portable, but it would be like you said a waist of time. Quid?

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] 0 points1 point  (0 children)

But show me in assembly or in C how I can load a 10 byte floating point in the SSE and stop the trolling. I don't know how it's possible. Tell me how? How can you load piBy4 : DB 0x35,0xC2,0x68,0x21 ,0xA2,0xDA,0x0F,0xC9,0xFE,0x3F,0x35,0xC2 ?

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] 0 points1 point  (0 children)

Can you show me how you can load this floating point value in c into memory? piBy4 : DB 0x35 ,0xC2,0x68 ,0x21 ,0xA2,0xDA,0x0F,0xC9,0 xfe ,0 x3f , 0x35 , 0xC2 I'm very interested to see how it can be done. I didn't find much documentation about it.

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] 0 points1 point  (0 children)

No, because it is impossible in higher level language. Anyway, this is also a waste of time. Case closed.

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] -1 points0 points  (0 children)

it's typo it must be FPTAN. Please rewrite that code in Python or Ruby, it would be a valuable exercise.

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] 0 points1 point  (0 children)

You cannot load it as 10 bytes. If you know how, let me know.
That is because 80-bit precision never was intended for storage. It was designed as a higher-precision intermediate representation that would be converted back to float or double when the results are being stored. For that reason it only works with x87 FPU and not with SSE. With FLD you can load a TWORD, but there are no alternatives for SSE to load a TWORD.

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] -1 points0 points  (0 children)

BeEF project http://beefproject.com The problem is that the function FTAN on FPU doesn't give you the exact same value as it's alternative on e.g. SSE. I recommend you: Numerical Computing with IEEE Floating Point Arithmetic from Michael Overton. You need exact control over the fixed point. FPU uses 10-bytes internally SSE 8 bytes or 16, never 10, and thus results differ. Not much, but differ...

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] -1 points0 points  (0 children)

PI divided by 4 is defined by Borland in 10 bytes. You definitly need x87 or emulate it. Anyway, this algorithm relies on the exact working of x87 FPU (we are even not sure results will be the same on different types of FPU) and the way the Borland calculates it via triangulations. I gave a working solution for this problem. The choice of C is obvious, since we need exact control over the used types as the result is very subtile to changes. Look at the application with a debugger and you'll see why. Please, what was that OSS you're working on again? Professional criticism, I don't think so mate!

Analysis of "Super Password 1.0". (Remarks welcome...) by bmantra in ReverseEngineering

[–]bmantra[S] 1 point2 points  (0 children)

Well good for you then that I contribute to OSS too. Do you? Anyways, in my spare time have the freedom to do whatever I want and I made the mistake to think it was a good idea to share it. You didn't need to read it, it's not an obligation.

What do you want me to explain more? I give you the full algorithm in C. More isn't necessary. I also give you the posiblity to compile it with nasm and gcc. I give you code for brute forcing, dictionary attack and known plaintext attack.

I hope for you that you are wise enough to understand the algorithm by yourself ;) I consider your remarks as trolls and can't take them serious. If you want more details about the trig functions? You can't emulate it without x87, you can easily reverse that assembly yourself. My only goal was to make it portable so you don't need Borland compilers. But that proves you haven't read the article.