Favorites from todd

Omada Identity versions prior to 15U1 and 14.14 hotfix #309 suffer from a persistent cross site scripting vulnerability.

Whitepaper called The Apple Sandbox. It discuss the access control system in OS X and iOS operating systems.

Whitepaper called Non-Executable Stack ARM Exploitation.

111 bytes small FreeBSD/x86 portbinding and forking shellcode.

This exploit takes advantage of the same underflow as the original, but takes a different approach. Instead of underflowing into userspace (which doesn't work on 64-bit systems and is a lot of work), the author uses an underflow to some static values inside of the kernel which are referenced as pointers to userspace. This method is pretty simple and seems to be reliable.

GNU libc/regcomp(3) suffers from overflow and stack exhaustion vulnerabilities. proftpd.gnu.c exploit included.

The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. Metasploit is used by network security professionals to perform penetration tests, system administrators to verify patch installations, product vendors to perform regression testing, and security researchers world-wide. The framework is written in the Ruby programming language and includes components written in C and assembler.