1463 matches found
KLA10988 Information disclosure vulnerability in Windows DirectShow
An improper objects handling in memory was found in Windows DirectShow. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed website. Original advisories MS17-021 CVE-2017-0042 Related products...
KLA10983 Privilege escalation vulnerability in Windows IIS
An improper sanitizing of a specially designed request was found in Microsoft IIS Server. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited remotely via a specially designed URL. Original advisories MS17-016 CVE-2017-0055 Exploitation Public...
Windows PE Binary Static Analysis Tool : BinSkim
Windows PE Binary Static Analysis Tool BinSkim is a binary static analysis tool that scans Windows Portable Executable PE files for security and correctness. Among the verifications performed by BinSkim are validations that the PE file has opted into all of the binary mitigations offered by the...
KLA10970 Multiple vulnerabilities in Mozilla Thunderbird
Multiple serious vulnerabilities have been found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to obtain sensitive information, run arbitrary code and cause a denial of service. Below is a complete list of vulnerabilities 1. Memory curruption vulnerability in asm.js ca...
Simple Static Malware Analyzer: SSMA
Simple Static Malware Analyzer SSMA is a simple malware analyzer written in Python 3. Features: Analyze PE file’s header and sections number of sections, entropy of sections/PE file, suspicious section names, suspicious flags in the characteristics of the PE file, etc. Searches for possible...
Altap Salamander 2.5 PE Viewer Buffer Overflow (CVE-2007-3314)
A buffer overflow exists in Altap Salamander. A remote attacker could trigger this vulnerability by creating a malicious file and convincing a user to view the file with the Portable Executable Viewer plugin within a vulnerable version of Salamander. Successful exploitation would allow remote...
DETRAN-PE Mais Fácil - Customized SSL, Redefined SSL Common Names verifier, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application DETRAN-PE Mais Fácil published at the 'play' market has multiple vulnerabilities...
KLA10957 Multiple vulnerabilities in Oracle Java SE
Multiple serious vulnerabilities have been found in Oracle Java SE components. By exploiting these vulnerabilities malicious users can gain privileges and obtain sensitive information. These vulnerabilities can be exploited remotely by unauthenticater attacker having network access via multiple...
shellcode programming: in memory in the parsing API to address-vulnerability warning-the black bar safety net
For Windows all with position-independent code, PIC core feature is based on a real-time analysis the API function address. It is a very important task. Here I introduce two popular methods, the use of the import address table IAT, and export address table to EAT is by far the most stable method...
KLA10939 Arbitrary code execution vulnerability in Microsoft Office Word 2016 and Microsoft SharePoint Enterprise Server 2016
Memory corruption vulnerability was found in Microsoft Word 2016 and Microsoft SharePoint Enterprise Server 2016. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed document. Original advisories MS17-0...
Multiplatform Open Source Binary Analysis: BARF Project
BARF : A multiplatform open source Binary Analysis and Reverse engineering Framework The analysis of binary code is a crucial activity in many areas of the computer sciences and software engineering disciplines ranging from software security and program analysis to reverse engineering. Manual...
KLA10923 Privilege escalation vulnerability in Microsoft Windows
Improper objects handling in memory was found in the Secure Kernel Mode implementation in Microsoft Windows. By exploiting this vulnerability malicious users can gain priveleges and violate virtual trust levels VTL. This vulnerability can be exploited locally via a specially designed application...
Do You See What I CCM?
SCCM Software Metering Reviewing forensic keyword searches can be confusing because it is often difficult for an analyst to determine the source of the various structures that contain string matches. One such structure belongs to Microsoft's System Center Configuration Manager's SCCM software...
Do You See What I CCM?
SCCM Software Metering Reviewing forensic keyword searches can be confusing because it is often difficult for an analyst to determine the source of the various structures that contain string matches. One such structure belongs to Microsoft's System Center Configuration Manager's SCCM software...
Open Source Malware Clusterization Toolkit: Cosa Nostra
Open Source Malware Clusterization Toolkit Cosa Nostra is an open source software clustering toolkit with a focus on malware analysis. It can create phylogenetic trees of binary malware samples that are structurally similar. It was initially released during SyScan360 Shanghai 2016. Required 3rd...
Interactive Disassembler: Plasma
Interactive disassembler for x86/ARM/MIPS. Generates indented pseudo-code with colored syntax code. PLASMA is an interactive disassembler. It can generate a more readable assembly pseudo code with colored syntax. You can write scripts with the available Python api. The project is still in big...
Free Open Source Self Hosted VirusTotal: Malice
Free Open Source Self Hosted VirusTotal Malice’s mission is to be a free open source version of VirusTotal that anyone can use at any scale from an independent researcher to a fortune 500 company.’ Ubuntu Install: Install Go $ sudo add-apt-repository ppa:ubuntu-lxc/lxd-stable $ sudo apt-get updat...
Memory corruption vulnerability in PECompact shell pec2codec_ffce.dll module
PECompact shell is a shelling tool that runs on the win32 platform. This tool has a memory corruption vulnerability in the handling of pe files, allowing attackers to cause a program crash by constructing a malformed pe file. If successfully exploited, it can cause arbitrary code execution...
Memory Corruption Vulnerability in PEtite Shell
PEtite is a shelling tool that runs on the win32 platform and has some usage. The tool has multiple memory corruption vulnerabilities in the handling of pe files, allowing attackers to exploit the vulnerability to construct malformed pe files that can lead to program crashes. If successfully...
Manalyze - A static analyzer for PE executables
Manalyzer is a free service which performs static analysis on PE executables to detect undesirable behavior. A static analyzer for PE files Manalyze was written in C++ for Windows and Linux and is released under the terms of the GPLv3 license . It is a robust parser for PE files with a flexible...