sprawllatest
automatic password rule analysis and generation
The field of password cracking has evolved by leaps an bounds over the last decade with the introduction of new cracking techniques, more advanced software and significantly faster hardware. One area which I find most fascinating is rule-based cracking. An attacker can develop a set of word mangling rules (e.g. substitute all 'a's to '@'s, upper-case every third letter, etc.) in order to attack non-random passwords which use slightly modified dictionary words. The purpose of this research is to develop an automated method of analyzing a large body of leaked passwords in order to come up with a list of frequently used words and rules to make up passwords. Read more.
password analysis and cracking kit
| Download | PACK-0.0.3.tar.gz |
|---|---|
| Size | 80.0 KB |
| Date | February 13th, 2013 |
| Version | 0.0.3 |
PACK (Password Analysis and Cracking Toolkit) is a collection of utilities developed to aid in analysis of password lists and enhancing cracking of passwords using smart rule generation. It can be used to reverse word mangling rules, generate source words and optimize password masks for the Hashcat family of tools. The toolkit itself is not able to crack passwords, but instead designed to make operation of password crackers more efficient. Read more.
dnschef
| Download | dnschef-0.2.1.tar.gz |
|---|---|
| Size | 2.4 MB |
| Date | January 20th, 2013 |
| Version | 0.2.1 |
DNSChef is a highly configurable DNS Proxy for Penetration Testers and Malware Analysts. It is capable of fine configuration of which DNS replies to modify or to simply proxy with real responses.
Version 0.2 introduces IPv6 support, large number of new DNS record types, custom ports and other frequently requested features. Read more.
ios data interception
Network traffic analysis is an important ingredient of a good iOS app pentest. The article covers several common approaches to iOS specific data interception such as network proxying, defeating network encryption, traffic injection and others. Read more.
writing nmap nse scripts for vulnerability scanning
The article discusses capabilities and application of Nmap Scripting Engine for the purpose of vulnerability scanning. By adapting code snippets covered here, you will be able to quickly develop, scan and generate reports for new vulnerabilities without waiting for mainstream scanners. Read more.
A solution to an exercise in Corelan Tutorial 10 on writing DEP and ASLR bypassing exploits. The solution illustrates grabbing leaked kernel32 address from memory, calculating an offset to VirtualProtect() and at last setting up a ROP chain to make a memory location with shellcode executable. Read more.
A solution to a small exercise in Corelan's Tutorial 9 on writing Windows 32-bit shellcode. The solution illustrates some techniques in removing null-bytes from a sample shellcode as well as a few tricks to keep the shellcode modular and easy to modify. Read more.
A solution to the AIMP2 exercise at the end of the Exploit Writing Tutorial Part 7 by Corelan Team. The solution illustrates a exploitation of Unicode applications using Venetian shellcoding techniques. Read more.
getting from seh to nseh
A collection of techniques on Windows SEH exploitation. Specifically the article covers methods of reliable exploit development by getting from a successfully overwritten pointer to Exception Handler (SEH) to the pointer to the Next Exception Handler (NSEH) struct. Read more.
A solution to the MP3 Studio exercise at the end of the Exploit Writing Tutorial Part 3b by Corelan Team. The solution illustrates a sample buffer overflow exploitation of a Windows application. Read more.
sprawlabout
The Sprawl is a research and development environment with a focus on information security and hacking culture. The site is split into several categories each containing unique presentation of the above topics.
- journal
is the main source for project announcements and site news. It is intentionally kept low volume so as not to distract from the rest of the site.
- research
is a collection of articles covering a wide range of topics related to security. This is the product of my blood, sweat and tears navigating the rough waters of security research; I hope you will enjoy the fruits of my labor.
- projects
is a repository of security tools and scripts that rely heavily on topics covered in the research section. Each tool has detailed usage description; however, you might want to reference respective research article for in-depth understanding of its operation.
- simstim
is a collection of media artifacts covering hacking culture. Currently it includes a few dozen handpicked documentaries and television shows on the subject. In case you are interested the name Simstim comes from William Gibson's The Sprawl trilogy. Simstim is described as a device capable of replaying or live viewing of another person's sensory experience. In a way this project attempts to stimulate your mind with a carefully selected collection of audio and video recordings.
- chronicle
is a historical project to explore events related to the hacking culture and information security such as group formations, important releases, compromises, arrests, etc. Studying the history of the previously mentioned topics is essential when trying to understand where we stand today and possibly glimpse into the future.
The site was designed and developed by iphelix.
Unless specified otherwise, all original content on this site is copyright protected and licensed under a CC BY-SA 3.0 license.
