mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysi...

AFL helped us to find a buffer overflow. Did we find a real crash in sudo? Let's investigate it.

Linode 100$ free Credit [*affiliate]: https://liveoverflow.com/linode3

Files on GitHub: https://github.com/LiveOverflow/pwnedit/tree/main/episode04
Blog Post: https://liveoverflow.com/finding-buffer-overflow-with-fuzzing/

Episode 4:
00:00 - Intro
00:28 - Looking at AFL crashes
01:25 - Investigate Crashes with gdb
03:35 - Debug Crash in AFL argv[] wrapper
04:27 - Fixing Buffer Overflow in AFL argv[] wrapper
05:19 - Setup Fuzzing Experiment with AFL++
07:11 - AFL UI Output Information

-=[ ❤️ Support ]=-

→ per Video: https://www.patreon.com/join/liveoverflow
→ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join

-=[ 🐕 Social ]=-

→ Twitter: https://twitter.com/LiveOverflow/
→ Website: https://liveoverflow.com/
→ Subreddit: https://www.reddit.com/r/LiveOverflow/
→ Facebook: https://www.facebook.com/LiveOverflow/

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.

00:00 - Intro
01:20 - Start of nmap
03:00 - Discovering wordpress, fixing our host file
04:20 - Running wpscan to enumerate wordpress via aggressive mode
06:10 - Manually enumerating wordpress users by listing blog posts by author
08:30 - Discovering Sator.php, then using GoBuster to discover hidden backups to find Sator.php.bak
11:40 - Start of looking at the php source to see its a basic deserialization challenge.
12:40 - Building the deserialization gadget to write a file
15:15 - Uh oh.  Made a typo, thankfully can find it quickly and get RCE
16:24 - Going back a step and showing a proper way to troubleshoot it
18:30 - Getting a reverse shell then examining wordpress config to get some credentials
20:15 - Testing the credentials with SSH and logging in with neil
21:00 - Discovering Neil can run enableSSH.sh with sudo, which has a race condition
23:00 - Writing a bash loop to exploit the race condition
25:20 - Exploiting the race condition more elegantly by using inotify to be notified when files are created…

Generate obfuscated meterpreter shells. Contribute to smokeme/payloadGenerator development by creating an account on GitHub.

Burp Automator - A Burp Suite Automation Tool. It provides a high level CLI and Python interfaces to Burp Suite scanner and can be used to setup Dynamic Application Security Testing (DAST).  - tris...

Retrieve AWS security credentials from the AWS console using CloudShell.

Cloud Security Docs - by Marco Lancini