LiveOverflow posts
Posts: 189
Files: 194
Minetest - Google CTF 2019 Qualifier
CTF video write-up about the Minetest challenge from the Google CTF 2019 Qualifier. It's similar to Blocky's Revenge from Pwn Adventure 3blog: https://liveoverflow.com/minetest/
Arbitrary Read and Write in WebKit Exploit - browser 0x08
Putting it all together. Achieving arbitrary read/write with the WebKit exploit. video: https://www.youtube.com/watch?v=uY4FQNwS4ME blog: https://liveoverflow.com/preparing-for-stage-2-of-a-webkit-exploit-browser-0x07-2/
Preparing for Stage 2 of a WebKit exploit - browser 0x7
We arrange and fake JavaScript objects to create some crazy memory layout ✨🤩✨This preparation is the necessary foundation to achieve arbitrary read/write in the next episode. video: https://www.youtube.com/watch?v=3c6nC0wdU-Qblog: https://liveoverflow.com/preparing-for-stage-2-of-a-webkit-exp...
(BONUS) Commentary Video of Speedrun-001 Challenge
This is the bonus video for the members on Patreon on YouTube. I hope you enjoy this additional real-time commentary video. If you would compare this style of video with the main video, do you like a particular style more? What do you think has more value and what is more fun to watch?main video: ht...
Speedrun Hacking Buffer Overflow - speedrun-001 DC27
This week we have another CTF video. It was a simple buffer overflow speedrun challenge, exploited with a ROP chain generated by Ropper. But we also analyse my timeline of the run.blog: https://liveoverflow.com/speedrun-hacking-buffer-overflow-speedrun-001-dc27-2/
Pledge per Video Data
Hey Patrons,June was interesting , because five videos fell into the month.As you know, here on Patreon you are supporting each video, but you can also set a monthly limit. In my introduction video about Patreon, I encouraged you to do that, because this tells me how frequent the videos should be.An...
Revisiting JavaScriptCore Internals: boxed vs. unboxed
Part 6: We go over the boxed vs. unboxed values, how to convert Integer addresses to Doubles and why our bug is a memory corruption.blog: https://liveoverflow.com/revisiting-javascriptcore-internals-boxed-vs-unboxed-browser-0x06/
The fakeobj() Primitive: Turning an Address Leak into a Memory Corruption - browser 0x05
In this video we introduce the fakeobj() primitive. It's based on the bug used in addrof() and allows us to corrupt the memory of internal JavaScriptCore objectsblog: https://liveoverflow.com/the-fakeobj-primitive-turning-an-address-leak-into-a-memory-corruption-browser-0x05/
WebKit RegExp Exploit addrof() walk-through - browser 0x04
We finally look at the actual exploit code! We start with the addrof() primitive, which can leak the address of a JavaScript object in memory.blog: https://liveoverflow.com/webkit-regexp-exploit-addrof-walk-through-browser-0x04/
The YouTube Curse
It's clear that a series like the current Browser Exploitation series is not interesting to many people. Most of you might not even watch it :D But I get more positive feedback and "thank you" messages from them, than from any of the more successful and entertaining videos. So while thos...
Just-in-time Compiler in JavaScriptCore - browser 0x03
In this video we have a first look at the WebKit JIT compiler - the part that converts JavaScript bytecode to machine code. blog: https://liveoverflow.com/just-in-time-compiler-in-javascriptcore-browser-0x03/
Twitch
Hey Patrons,today I have streamed again on Twitch!I want to build Ben Eater’s 8-bit computer. But the topic doesn’t really fit on the main channel. So I wanted to make a second channel where I can just archive them and maybe share some other unrelated videos. But first I need a name. Got any ide...
The Butterfly of JSObject - browser 0x02
Last video we learned how to debug WebKit. Now we can use that to look at how JavaScriptCore implements objects and values like integers and floats. And why there is such a thing like a "butterfly"blog: https://liveoverflow.com/the-butterfly-of-jsobject-browser-0x02/
Setup and Debug JavaScriptCore / WebKit
We are going to try out Linus's exploit, setup a vulnerable WebKit version and learn how we can explore the internals and debug JSC.blog: https://liveoverflow.com/setup-and-debug-javascriptcore-webkit-browser-0x01/
New Series: Getting Into Browser Exploitation - browser 0x00
The start of a new series. We will try to learn some basics about browser exploitation. Specifically we will look at JavaScriptCore - the JavaScript engine from WebKit.blog: https://liveoverflow.com/getting-into-browser-exploitation-new-series-introduction-browser-0x00/
The Origin of Script Kiddie - Hacker Etymology
Where does the term "script kiddie" come from? Who said it first? Let's do some hacker history research!https://liveoverflow.com/the-origin-of-script-kiddie-hacker-etymology/
Unpacking Redaman Malware & Basics of Self-Injection Packers - ft. OALabs
I'm excited to share with you a video collaboration with @herrcore from OALabs about unpacking a self-injection malware. Definitely also checkout their channel if you want to learn more about malware analysis!OALabs shows a walk-through of how to unpack a sample malware and explains some basics ...
I pledge for ...
I would like to better understand why you pledge or what you pledge for. I haven't charged you for today's video and I want to know if that was the right decision, or going forward you would have been okay being charged for it.
Business, Money, 300k Subscribers and What's Next
A vlog with a recap about the last year, how LiveOverflow is now a business and generally what is going on behind the scenes.As you know, on Patreon you are pledging for each video I make - however I didn't charge for this video because it's not a technical video you might expect. So I have ...
GitLab 11.4.7 Remote Code Execution
Video write-up about the Real World CTF challenge "flaglab" that involved exploiting a GitLab 1day. Actually two CVEs are combined to achieve full remote code execution:CVE-2018-19571 (SSRF) + CVE-2018-19585 (CRLF) = RCENot only is there a video, but thanks to your support I have started to ...
Fuzzing Browsers for weird XSS Vectors
We have a look at another interesting XSS vector due to weird Firefox parsing, and then explore how researchers find this stuff.
How did Masato find the Google Search XSS?
Last week I showed you a XSS on Google Search. In this follow-up video we discuss how @kinugawamasato found the XSS and find evidence of a conspiracy of XSS researchers!!!11!!1!!
XSS on Google Search - Sanitizing HTML in The Client?
I never thought I would experience a XSS on Google Search. But Masato Kinugawa blew my mind!This is a video going over the difficulties of sanitizing HTML in JavaScript.The fix can be found here: https://github.com/google/closure-library/commit/c79ab48e8e962fee57e68739c00e16b9934c0ffa
YouTube Space Berlin
Hey!This week I was three days at the YouTube Space in Berlin. I thought I could write a small comment for Patreon about this, because I think it’s quite interesting to know that this exists. YouTube has spaces around the world (https://www.youtube.com/yt/space/) where they offer free workshops an...
Weird Return-Oriented Programming Tutorial
There are a lot of tutorials on ROP out there, so I try to explain the concept in a different way. Maybe that's a bad idea and a lot more confusing. But if you didn't understand it yet, or you already know ROP, then this could be interesting.
I know this looks weird.
It's a screenshot from an upcoming video series. It's part of the same series where this image was from: https://www.patreon.com/posts/24461460
Introducing Weird Machines: ROP Differently Explaining part 1 - bin 0x29
This is the first part where I try to explain Return-oriented Programming in a different way. And in this video I want to introduce what a weird machine is... it's kinda theoretical, but the concept can be applied to a lot of exploits. Developing that intuition feels very important to me. But be...
Ethereum Smart Contract Backdoored Using Malicious Constructor
Remember the crazy smart contract challenge from the Real World CTF? Here is a video specifically talking about the backdoor method used. Together with @ret2got we finally understood it.Acoraida Monica - Real World CTFPart 1: https://www.youtube.com/watch?v=ozqOlUVKL1sPart 2: https://www.youtube.com...
Rediscovering the f00dbabe Firmware Update Issue - Hardware Wallet Research #7
We finally figure out how to create a firmware update, but als run into an annoying check. However based on what we have learned so far, we can find a bypass - rediscovering the f00dbabe issue.
Analysing a Firefox Malware browserassist.dll - FLARE-On 2018
This is another challenge of the FLARE-On 2018 CTF. This challenge is about analysing the functionality of a Firefox malware, but I got a bit lucky :D
