Penetration Document Format Didier@DidierStevens.com - PowerPoint PPT Presentation

Dec 03, 2022 •584 likes •868 views

Penetration Document Format Didier@DidierStevens.com Didier@DidierStevens.com Didier@DidierStevens.com Identification and Analysis Didier@DidierStevens.com Didier@DidierStevens.com PDFiD PDFiD 0.0.9 hello-world.pdf PDF Header: %PDF-1.1 obj

Penetration Document Format Didier@DidierStevens.com
Didier@DidierStevens.com
Didier@DidierStevens.com
Identification and Analysis Didier@DidierStevens.com
Didier@DidierStevens.com
PDFiD PDFiD 0.0.9 hello-world.pdf PDF Header: %PDF-1.1 obj 7 endobj 7 stream 1 endstream 1 xref 1 trailer 1 startxref 1 /Page 1 /Encrypt 0 /ObjStm 0 /JS 0 /JavaScript 0 /AA 0 /OpenAction 0 /AcroForm 0 /JBIG2Decode 0 /RichMedia 0 /Colors > 2^24 0 Didier@DidierStevens.com
/Name Obfuscation Didier@DidierStevens.com
PDFiD Demo Didier@DidierStevens.com
http://www.Virustotal.com Didier@DidierStevens.com
Didier@DidierStevens.com
http://blog.rootshell.be Didier@DidierStevens.com
In-The-Wild PDF Didier@DidierStevens.com
PoC Pure ASCII PDF Didier@DidierStevens.com
pdf-parser Demo Didier@DidierStevens.com
Protection Didier@DidierStevens.com
Foxit Reader Didier@DidierStevens.com
Sumatra PDF Didier@DidierStevens.com
Know Your Enemy ... Didier@DidierStevens.com
Disable JavaScript? Didier@DidierStevens.com
… Find His Achilles Heel Didier@DidierStevens.com
Access Tokens Didier@DidierStevens.com
Use Restricted Tokens ● Windows >= Vista + UAC ● DropMyRights ● StripMyRights ● SAFER SRP Didier@DidierStevens.com
Restricted Token in Action Didier@DidierStevens.com
Disclosure CVE-2009-2979 Didier@DidierStevens.com
XML-Bomb in Metadata Didier@DidierStevens.com
Questions? And hopefully some answers... Didier@DidierStevens.com
Thank you http://blog.DidierStevens.com Didier@DidierStevens.com

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

26 June 2020 Local Digital Landscape 58% 159% Unique mobile user SIM penetration penetration

Rural Bankers Association of the Philippines 67 th Annual National Convention 26 June 2020 Local Digital Landscape 58% 159% Unique mobile user SIM penetration penetration Average time spent on internet 9 hours 67% and 45 Filipinos are

587 views • 16 slides

ts% 5.s% s.0% 1..9% November 730 3761 4825 1026 County Monthly Avg 45249 68984 ro2792

FY16 Quarter L Penetration Report Ethnicity State Penetration Rate 3.78% s.09% 10.134/o 3.81o/a 10.144/o 7.39o/o July 2015 1462 653 4534 119 2497 978 County Monthly Avg 70255 10662 140147 1046 33644 19089 County Penetration Rate

423 views • 9 slides

Penetration testing auditability Alexandros Tsiridis & Stamatios Maritsas What is the purpose

MSc System and Network Engineering Penetration testing auditability Alexandros Tsiridis & Stamatios Maritsas What is the purpose of penetration testing auditability? Research questions What are the sources of penetration testing

554 views • 13 slides

Cone Penetration Test MoDOT moving in to the future . Cone Penetration Test (CPT) A method

Cone Penetration Test MoDOT moving in to the future . Cone Penetration Test (CPT) A method used to determine the Geotechnical properties of soils and delineating soil stratigraphy. CPT Program @ MoDOT The program got started To

383 views • 26 slides

All India Wind Penetration (in Energy terms) High Wind generation during June to August.

All India Wind Penetration (in Energy terms) High Wind generation during June to August. All India level penetration 9% (max achieved) High Penetration in States: 1. Tamil Nadu 2. Rajasthan 3. Karnataka 4. Gujarat 5.

838 views • 17 slides

Web Application Penetration By: Frank Coburn & Haris Mahboob Testing Take Aways Overview

Web Application Penetration By: Frank Coburn & Haris Mahboob Testing Take Aways Overview of the web Web proxy tool Reporting Gaps in the process app penetration testing process Penetration testing vs vulnerability assessment What

301 views • 17 slides

Penetration Testing for Certification: What we care about Marcel Medwed marcel.medwed@nxp.com

Penetration Testing for Certification: What we care about Marcel Medwed marcel.medwed@nxp.com Outline Common Criteria Evaluation Assurance Levels JHAS Penetration Testing and Countermeasures 2 Design and security of cryptographic

523 views • 40 slides

1 Principle of Easiest Penetration Principle of Easiest Penetration: An intruder must be expected

The Course So Far Middleware Time Global states Coordination Multicast Consensus Replication Transactions 4/10 - 05 Distributed systems - Jonny Pettersson, UmU 1 Security in the Course Lectures

302 views • 12 slides

The North Carolina solar experience: high penetration of utility-scale DER on the distribution

1 The North Carolina solar experience: high penetration of utility-scale DER on the distribution system John W. Gajda, P.E. Duke Energy IEEE PES Working Group on Distributed Resources Integration 2 High penetration of utility-scale DER

377 views • 24 slides

Strategic Issues for Binary/File Format ILDG4 May 21 2004, T.Yoshie CCS,Tsukuna Definition

Strategic Issues for Binary/File Format ILDG4 May 21 2004, T.Yoshie CCS,Tsukuna Definition binary format: array format of config. U(3,3,X,,,) numerical format (precision,IEEE,byte-order) file format: format of a file

88 views • 8 slides

Non-penetration modeling error in physical simulation time-steppers A more accurate and robust

Outline Introduction Error in non-penetration modeling New method to determine active set Conclusion Non-penetration modeling error in physical simulation time-steppers A more accurate and robust method Binh Nguyen, Jeff Trinkle Computer

274 views • 24 slides

Team Cymru Cymru Team Penetration Testing Ryan Connolly, ryan@cymru.com

Team Cymru Cymru Team Penetration Testing Ryan Connolly, ryan@cymru.com <http://www.cymru.com> Penetration Testing Agenda Pentesting Basics Pentesting Defined Vulnerability Scanning vs. Penetration testing Pentesting

879 views • 83 slides

Testing Dr. Patrick McDaniel Meghan Riegel Fall 2015 What is Penetration Testing? Attacking

Introduction to Penetration Testing Dr. Patrick McDaniel Meghan Riegel Fall 2015 What is Penetration Testing? Attacking a system to find security vulnerabilities in order to fix them before a malicious party attacks the system Legal if

455 views • 9 slides

How AR and VR are changing the way we build cities Format The format will be 4-5 Blog that will

How AR and VR are changing the way we build cities Format The format will be 4-5 Blog that will also be supplemented with interviews that will be highlighting the questions asked below. The posts will be the reactions to interview and will also

334 views • 6 slides

THE ELF OBJECT FILE FORMAT PROGRAM EXECUTION gcc/cc output an executable in the ELF format

THE ELF OBJECT FILE FORMAT PROGRAM EXECUTION gcc/cc output an executable in the ELF format (Linux) Executable and Linkable Format Standard unified binary format for: Relocatable object files (.o), Shared object files (.so)

421 views • 16 slides

Aerial Electrostatic Spray Deposition and Canopy Penetration in Cotton Daniel E. Martin, Ph.D. USDA

Aerial Electrostatic Spray Deposition and Canopy Penetration in Cotton Daniel E. Martin, Ph.D. USDA ARS Aerial Application Technology Research Unit College Station, Texas Electrostatic Deposition and Penetration Objective: Determine if

689 views • 36 slides

x86 Assembly Programming under Linux 1 2 Control Flow Instructions Data Movement

x86 Assembly Programming under Linux 1 2 Control Flow Instructions Data Movement Instructions jmp Jump mov Move cmp Compare push Push stack j condition Conditional Jump pop Pop stack call , ret Subroutine

412 views • 13 slides

Defending against Memory Corruption Vulnerabilities and Advanced Attacks Gang Tan Penn State

Defending against Memory Corruption Vulnerabilities and Advanced Attacks Gang Tan Penn State University Spring 2019 CMPSC 447, Software Security * some slides adapted from those by Trent Jaeger Overflow Vulnerabilities Despite

901 views • 46 slides

Place-Based Inclusive Growth 2019 SURF Annual Conference, 29th August Which of the following

Place-Based Inclusive Growth 2019 SURF Annual Conference, 29th August Which of the following sectors best describes the organisation you are representing today? 1. Community Group 13% 2. Central Government / 19% National Public body 3.

490 views • 9 slides

Levels and Dynamics of Inequality in India: Filling in the blanks Peter Lanjouw (Vrije

Levels and Dynamics of Inequality in India: Filling in the blanks Peter Lanjouw (Vrije University Amsterdam) Summary of Findings from the India Component of the UNU- WIDER Inequality in the Giants Project UNU-WIDER Conference: Think

332 views • 30 slides

Create PDFs from Markup with Python Lorna Mitchell Meet rst2pdf https://rst2pdf.org Open

Create PDFs from Markup with Python Lorna Mitchell Meet rst2pdf https://rst2pdf.org Open source, Python project Accepts ReStructured Text format, outputs PDF Useful for: reports, slide decks, ... all sorts @lornajane ReStructured

461 views • 23 slides

CMPT 165 CMPT 165 INTRODUCTION TO THE INTERNET INTRODUCTION TO THE INTERNET AND THE WORLD WIDE

CMPT 165 CMPT 165 INTRODUCTION TO THE INTERNET INTRODUCTION TO THE INTERNET AND THE WORLD WIDE WEB AND THE WORLD WIDE WEB By Hassan S. Shavarani UNIT5: GRAPHICS UNIT5: GRAPHICS 1 TOPICS TOPICS 1. Using Images on Web Pages 2. Image

636 views • 28 slides

Outline CGI CS3157: Advanced CGI security CGI Graphics Programming

Outline CGI CS3157: Advanced CGI security CGI Graphics Programming Alternative Technologies Lecture #5 Threading Sept 26 Shlomo Hershkop shlomo@cs.columbia.edu CGI Requirements Minimum the web server needs to

985 views • 10 slides

Adaptive Techniques for Learning over Graphs ICASSP2017 PhD Final Oral Exam Dimitris Berberidis

Adaptive Techniques for Learning over Graphs ICASSP2017 PhD Final Oral Exam Dimitris Berberidis Dept. of ECE and Digital Tech. Center, University of Minnesota Acknowledgements : Profs G. B. Giannakis, G. Karypis, Z. Zhang, and M. Hong

823 views • 49 slides