In the presentation I demonstrated two new techniques – Bitmap Heap Spraying and Silverlight Heap Spraying which I’ll publish here later on this week in addition to a few other new techniques, so stay tuned, it’ll be fun.

You can view the presentation online on Google Docs or you can download the slides here – Advanced Heap Spraying Techniques or from OWASP Israel.

• Exploit writing tutorial part 1 : Stack Based Overflows
• Exploit writing tutorial part 2 : Stack Based Overflows – jumping to shellcode
• Exploit writing tutorial part 3 : SEH Based Exploits
• Exploit writing tutorial part 3b : SEH Based Exploits – just another example
• Exploit writing tutorial part 4 : From Exploit to Metasploit – The basics
• Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development
• Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR
• Exploit writing tutorial part 7 : Unicode – from 0×00410041 to calc
• Exploit writing tutorial part 8 : Win32 Egg Hunting
• Exploit writing tutorial part 9 : Introduction to Win32 shellcoding
• Exploit writing tutorial part 10 : Chaining DEP with ROP – the Rubik’s[TM] Cube

Enjoy the reading!

Metasploit Unleashed – Mastering the Framework online course will give you a solid knowledge base to start working with the Metasploit Framework, from simple things such as lunching an exploit to post exploitation, Meterpreter scripting and more.

But the greatest thing about this course is its main purpose, which is to promote awareness and raise funds for underprivileged children in East Africa. So if you enjoy the course and find it useful, please make a donation to Hackers For Charity.

Code:
javacompile.rb.

Installation:
Place the mixin in the following path:
\msf3\lib\msf\core\exploit

Include the mixin in \msf3\lib\msf\core\exploit.rb file:
# JavaCompile
require 'msf/core/exploit/javacompile'

Using the mixin in exploit and auxiliary modules:
include Msf::Exploit::JAVACOMPILE

The mixin requires JDK to be installed, get it from Sun.

Usage:
OUTPUTPATH – defines the path of the working directory (where the files will be created).

java_compile(filename,data) function is used to compile Java code. filename variable sets the file and public class name and data variable defines the Java code.

java_clean(filename) function is used to clean the working directory. filename variable sets the file name to delete (both .java and .class files) from the working directory.

Demonstration:
The following “exploit” module demonstrate the Java compilation mixin by calling a simple Java applet (displaying “Hello World”) from an HTML page:
java_hello.rb (See comments in the code).

This mixin is still in an early stage and will be modified and improved in time, any kind of feedback and suggestions are welcome.
Cool exploits soon to follow :-)