Clickjacking: the click that was not for you
Overlaying your site in an invisible iframe above a lure makes the victim click actions they cannot see.
notes on hacking and technology
|
main menu
user menu
topics
|
latest postsOpen redirect: your domain sending users elsewhereA redirect based on an unvalidated parameter lends your domain's credibility to phishing and aids OAuth bypasses. Race conditions and TOCTOU: the window between check and useIf check and action are not atomic, concurrent requests exploit the in-between instant: double redemption, negative balance, limits bypassed. Sudo misconfiguration: from user to rootOne over-generous sudoers line, or an allowed binary with shell features, and root escalation is a single command. SUID binaries: running with the owner's privilegesA SUID-root binary runs as root even when launched as a user. If it has an exploitable feature, it is privilege escalation. Writable cron jobs: scheduled privilege escalationA script run by root on a schedule, but writable by you (or with exploitable PATH/wildcards), runs your code as root. Linux capabilities: root split into (exploitable) piecesCapabilities give a binary a slice of root's powers. The wrong capability on the wrong binary is privilege escalation. Linux kernel exploitation: from user to ring 0A kernel bug jumps every process boundary. Mitigations (SMEP, SMAP, KASLR) made the craft harder, not impossible. SSH agent hijacking and mishandled keysAn accessible SSH agent socket, or agent forwarding on a compromised host, lets you authenticate as the victim elsewhere. Reverse shells: making the target call homeA bind shell waits for connections; a reverse shell starts them toward the attacker, crossing NAT and outbound firewalls. Pivoting and tunneling: moving through internal networksA compromised host becomes the springboard into unreachable segments. Port forwarding, SOCKS and tools like chisel open the way. Living off the land: attacking with the tools already thereWhy bring malware when the system already offers trusted, signed binaries that download, execute and persist? That is LOLBAS. |
latest posts
your IP address:
216.73.216.108
visitor #0
MOTD:
Every abstraction leaks somewhere. Here we look at where. |
topics