StalkR's Blog

Surely you've heard of the Burp Suite , quite useful software to perform security testing of web applications and in general to play wit...

Are you the lucky owner of an IDA Pro linux license? Since I had errors last time I set it up, here is a quick brain dump on setting up IDA...

It was DEFCON 21 quals last week-end, with new organizers . It went well, good organization and good challenges. If you're curious abou...

As I said in the last post , I obtained YubiKey USB tokens and started to play with it. One of the programs I made is YubiText , it allows ...

I recently obtained YubiKeys from Yubico . It's a USB hardware token able to act as a keyboard device to input characters (a HID ) and...

Again this year was ShmooCon 's Ghost in the Shellcode warm-up round or Teaser ( @ShellGhostCode ). Congrats to Eindbazen for winning!...

I recently discovered Chrome's net-internals . Among other interesting things, there is a tab about HTTP Strict Transport Security (HST...

Twitter is great to get and share information, quickly. But it is all web 2.0 and you cannot use a simple cat or grep to view or search y...

May 19th-20th was Hack in the Box Amsterdam 2011 security conference in the Netherlands, also holding a CTF . To participate, you had to qu...

Challenge #19 "Another small bug" was a stack-based buffer overflow. Djo ( @shell_storm ) has already published a write-up ( e...

Challenge #26 "Hashcalc2" was very similar to Hashcalc1 . Again, a good write-up is already available on sleepya's blog . He...

Challenge #22 "Hashcalc 1" was binary exploitation over the network. A good write-up is already available on sleepya's blog ...

The only networking problem at pCTF 2011 was unusual because it involved ZigBee , based on IEEE 802.15.4 . Context We captured this networ...

You may already know that the CRC-32 of any text can be forged if you can add 4 bytes anywhere in the text. See anarchriz's paper on t...

Last week was held the first-ever Honeynet project public conference in Paris at ESIEA . Great speakers, interesting conferences ( slides ...

Last week-end was ShmooCon CTF Warmup Contest (aka Ghost in the Shellcode 2011). Three challenges, the last one being an ELF binary + host...

Recently I've been playing with gdb 7.2 and python . It extends what we can have with a great .gdbinit such as gdbinit73 . As examples,...

Challenge #11 of smpCTF was interesting: we were given an URL to a phplist version 2.10.12 installation - with default admin/phplist admi...

smpCTF challenge #1 was a simple web + programming challenge. We were given the following instructions: Set S = 1 Set P = 1 Set previo...

Packet Madness 200 was a simple TCP server speaking an uncommon language (at least now). Description: These folks speak a different langu...