Portcullis Labs - Presentations

Big Game Hunting: Simple techniques for bug hunting on big iron UNIX | Content

Mon, 10 Sep 2012 14:32:41 GMT

Presentation on auditing and bug hunting on AIX (as given at 44con 2012).

Simple techniques for bug hunting on big iron UNIX. The talk will build on the work previously done in my “Breaking The Links” paper but will focus on AIX and associated IBM products. The talk will include some new bugs as well as going through a simple methodology for finding them.

Breaking the links: Exploiting the linker | Content

Tue, 27 Mar 2012 01:26:35 GMT

Presentation on exploiting linkers based on my paper (as given at Uncon 0x12 and CRESTCon 2010).

I am currently working on an update to the paper which will focus on other UNIX like OS with the aim of sharing some of my findings at a future conference.

Attacking Windows Domains | Content

Fri, 23 Mar 2012 13:23:10 GMT

Windows Domains use a single sign on system, authenticate to one machine, you can then use that machine to access all of your available resources accross that domain. This is great for users but also for attackers. This presentation covers a number fo techniques and tools that be used to take control of a windows domain without ever needing to run time consuming password cracking.

Introducing Heyoka: DNS Tunneling 2.0 | Content

Tue, 24 Mar 2009 14:45:47 GMT

Slides from SOURCE Boston 2009, presenting heyoka, a new DNS tunneling tool that uses spoofed traffic to avoid detection and multiple encodings to improve speed. By Alberto Revelli and Nico Leidecker.

OWASP AU 2009 Slides | Content

Thu, 19 Mar 2009 13:14:32 GMT

Slides from OWASP Australia 2009.

Owasp Au Rev4

View more presentations from sumsid1234.

Insecure Trends in Web 2.0 Applications | Content

Fri, 31 Oct 2008 16:08:40 GMT

Non technical talk about insecure trends in Web 2.0 applications. Explains what's wrong with today's Web 2.0 applications and why new comers keep repeating these.

Flash Security | Content

Fri, 31 Oct 2008 16:00:50 GMT

This presentation given at RIATalks, it's about fundamental flash security issues, attack surface of Flash and secure development.

During the presentation there was stealing data through vulnerable Crossdomain.xml files, you can download source code of this file - FlashSecurityCrossdomain.zip.

Introduction To Format Strings | Content

Tue, 17 Jun 2008 13:11:17 GMT

What?

This presentation tries to cover the basics of format strings exploitation. Starting with an explanation of the legitimate use of Format Strings (Yin) moving onto how programming flaws can be exploited using this technique.

Why?

I spent many months getting my head aorund the nuonces of FS explitation so though I would put together a presentation on all the little things that I though were they key points when coming accross this subject for the first time. This hopefully will act as a good basis for the More Adventures In Format Strings presentation

How to Detect and Exploit 99% of XSS Vulnerabilities | Content

Wed, 02 Apr 2008 16:23:40 GMT

This presentation has given in Intercon 2007 (Portcullis's internal conference), Talks about exploiting and identifying most common XSS vulnerabilities in real world.

Examples include following types,

Classic XSS Vulnerabilities
In HTML Attributes
In Comments
In Javascript Blocks
DOM Based XSS
Flash Based XSS
Direct Linking

Presentation was heavily based on demonstration, so you need to fill in the blanks.

GUI Access Through SQL Injection | Content

Tue, 01 Apr 2008 15:30:22 GMT

Slides presented by Alberto Revelli at OwaspDay II in Rome, 31/03/2008. They describe some SQL Injection tricks that can be used to get a full access to the DB server's operating system. The examples are mainly focused on MS SQL Server, but the concepts are valid for other DBMS as well.

More Adventures in Format Strings | Content

Mon, 14 Apr 2008 15:11:37 GMT

What?

This presentation covers a method for exploiting format string vulnerabilities which is compared to techniques used for exploiting heap smashes. It does not not cover the basics of the vulnerability because these seem ten a panny.

Why?

Much work has been written about covering the underlying principles of format strings but not much seemed to be written concerning this specific technique. More over is was written to push forward a method and library that can be used to optimise format strings to fit into smaller buffer spaces