Hot Topics

Professionally Evil

Professionally Evil Fundamentals: Introduction

Linux X86 Assembly – How To Test Custom Shellcode Using a C Payload Tester

| | ALSR, analysis, Application Security, architecture, ASM, cpu, debugging, DEP, function, gas, getpagesize, Hello World, Linux, mprotect, payload, Penetration Testing, pointers, Professionally Evil, programming, Reverse Engineering, Secure Ideas, shellcode, stub, syscalls, testing, training, x86
Overview In the last blog post in this series, we created a tool to make it easy to build our custom payloads and extract them.  However, what if we want to test ...
Professionally Evil Insights

It Was The Best Of Times, It Was The Worst Of Times…A Tale of Two Passwords

| | Best Practices, Information Security, Password Security, Professionally Evil, Secure Ideas, security, Security Awareness, web app security
Two of the characters in Charles Dickens’ beloved novel, A Tale of Two Cities have such similar features that their identities are swapped.  No one notices.  One escapes and reunites with his ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

Linux X86 Assembly – How to Make Our Hello World Usable as an Exploit Payload

| | analysis, Application Security, architecture, ASM, call, cpu, exit, gas, Hello World, int, jmp, Linux, mov, objdump, optimize, payload, Penetration Testing, PoP, Professionally Evil, programming, push, Registers, Reverse Engineering, Secure Ideas, shellcode, syscalls, training, write, x86, xchg, xor
Overview In the last two tutorials, we built a Hello World program in NASM and GAS for x86 assembly.  While this can help us learn x86 assembly, it isn’t viable as a ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

Linux X86 Assembly – How to Build a Hello World Program in NASM

| | analysis, Application Security, architecture, ASM, C++, cpu, exit, Hello World, int, Linux, mov, NASM, payload, Penetration Testing, Professionally Evil, programming, Registers, Reverse Engineering, Secure Ideas, shellcode, syscalls, write, x86
Overview A processor understands bytecode instructions specific to that architecture.  We as humans use mnemonics to make building these instructions easier than remembering a bunch of binary codes.  These mnemonics are known ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

A Hacker’s Tour of the X86 CPU Architecture

| | analysis, Apple, architecture, ARM, cpu, eflags, Endian, M1, payload, Penetration Testing, Professionally Evil, Registers, Reverse Engineering, Reviews, Secure Ideas, segments, shellcode, x86
Overview The Intel x86 CPU architecture is one of the most prolific CPU architectures for desktops, laptops, and servers.  While other architectures exist and are even taking some market share with mobile ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

LD_PRELOAD: How to Run Code at Load Time

| | analysis, attribute, C++, constructor, debugging, destructor, ELF, gcc, gnu, inject, injection, LD_PRELOAD, Linux, make, Penetration Testing, proc, Professionally Evil, programming, Reverse Engineering, Secure Ideas, self-, Shared Objects, training
    Today I want to continue the series on using LD_PRELOAD.  In previous posts, we covered how to inject a shared object binary into a process, and use that to hijack a library ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

Solving the November 13th Detective Nevil Mystery Challenge

| | .gdb, ARM, ASM, challenge, debug, debugging, Detective Nevil Mystery Challenge, Linux, payload, Penetration Testing, Professionally Evil, programming, Pwntools, Reverse Engineering, Write-up
Overview Each week on Friday, we post a social media challenge known as “Detective Nevil Mystery Challenge”.  On November 13th of 2020, we released a challenge that contained a payload and it ...
Professionally Evil Insights
Professionally Evil Fundamentals: Introduction

Solving the November 13th Detective Nevil Mystery Challenge

| | .gdb, ARM, ASM, challenge, debug, debugging, Detective Nevil Mystery Challenge, Linux, payload, Penetration Testing, Professionally Evil, programming, Pwntools, Reverse Engineering, Write-up
Overview Each week on Friday, we post a social media challenge known as “Detective Nevil Mystery Challenge”.  On November 13th of 2020, we released a challenge that contained a payload and it ...
Professionally Evil Insights
Not-So-Random: LD_PRELOAD to Hijack the rand() Function to Control The Generation of Random Numbers

Not-So-Random: Using LD_PRELOAD to Hijack the rand() Function

| | C++, Hijack, ld, LD_PRELOAD, libc, Linux, Penetration Testing, Professionally Evil, programming, Reverse Engineering, Shared Objects
    Today I wanted to continue the series on using LD_PRELOAD.  In today’s post we are going to use LD_PRELOAD to hijack the rand() function in a simple random number guessing game to ...
Professionally Evil Insights
Not-So-Random: LD_PRELOAD to Hijack the rand() Function to Control The Generation of Random Numbers

Not-So-Random: Using LD_PRELOAD to Hijack the rand() Function

| | C++, Hijack, ld, LD_PRELOAD, libc, Linux, Penetration Testing, Professionally Evil, programming, Reverse Engineering, Shared Objects
    Today I wanted to continue the series on using LD_PRELOAD.  In today’s post we are going to use LD_PRELOAD to hijack the rand() function in a simple random number guessing game to ...
Professionally Evil Insights
Load more