Install and Setup Burp Suite Proxy & Certificate with Java Application

Introduction

Java application sometimes did not go through (use) the global proxy setting. This means that even we setup the proxy and import the burp suite certificate, we are still not able to intercept HTTPs traffic.

This article is going to show you how to setup your Burp Suite proxy and certificate with Java Application for intercepting HTTPs traffic.

Continue reading

How did I find Command Injection in MVP-5150 (CVE-2019-11224)

Introduction

OS Command Injection is that the software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

This article describes that how did I find CVE-2019-11224 and three ways for bypassing “space” character while OS Command Injection.

Continue reading

Buffer Overflow – Return to Libc

Introduction

In information security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer’s boundary and overwrites adjacent memory locations.

Return-to-libc is a method that defeats stack protection on linux systems.

This article will show you that how to attack C program by using buffer overflow and return to Libc method to pop a bash shell.

buffer overflow

Continue reading