Hi๐Ÿ‘‹๐Ÿผ Iโ€™m HAHWUL.

Offensive Security Engineer, Rubyist/Crystalist/Gopher and H4cker

Posts - Page 50 of 86

LOKIDN! ์žฌ๋ฏธ์žˆ๋Š” IDN HomoGraph Attack ๋ฒกํ„ฐ

  • 1 min read

ํ•œ 2์ฃผ์ „์ฏค์ธ๊ฐ€์š”? EDB์—์„œ ์žฌ๋ฏธ์žˆ๋Š” ๋ฌธ์„œ ํ•˜๋‚˜๋ฅผ ๋ณด์•˜์Šต๋‹ˆ๋‹ค. ์„œ๋กœ ๋‹ค๋ฅด์ง€๋งŒ ๋น„์Šทํ•˜๊ฒŒ ์ƒ๊ธด ๋ฌธ์ž๋“ค ์ด์šฉํ•œ ๊ณต๊ฒฉ ๊ธฐ๋ฒ•์ธ IDN Homograph attack์œผ๋กœ ์›น์„ ๊ณต๊ฒฉํ•˜๋Š” ์žฌ๋ฏธ์žˆ๋Š” ๋ฐฉ๋ฒ•์ด๋ผ ์ •๋ฆฌํ•ด์„œ ๊ธ€๋กœ ๊ณต์œ ํ•ด๋ด…๋‹ˆ๋‹ค.

Read More

iOS App IPA ํŒŒ์ผ ์ถ”์ถœํ•˜๊ธฐ(ipainstaller, jailbreak)

  • ~1 min read

๋งจ๋‚  iFunBox๋กœ IPA ํŒŒ์ผ์„ ์ถ”์ถœํ–ˆ์—ˆ๋ฐ, ํ™˜๊ฒฝ์ ์ธ ๋ฌธ์ œ๋กœ USB ์—†์ด ํ•˜๋ ค๊ณ  ๋‹ค๋ฅธ๋ฐฉ๋ฒ• ์ฐพ์•„๋ณธ ๊ฒƒ ๋ฉ”๋ชจํ•ด๋‘ก๋‹ˆ๋‹ค. ipainstaller๋กœ ipa ํŒŒ์ผ์„ ํ†ตํ•ด ์•ฑ์„ ์„ค์น˜ํ•  ์ˆ˜ ์žˆ๋Š”๋ฐ(ipa ์„ค์น˜๋„ cydia impactor๋กœ..) ์ด ํˆด๋กœ ์ถ”์ถœ๋˜ํ•œ ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค.

Read More

DynoRoot Exploit (DHCP Client Command Injection / CVE-2018-1111)

  • 2 min read

์ „์— ์ด ์ทจ์•ฝ์ ์ด ๋‚˜์™”์„ ๋•Œ ๊ทธ๋ƒฅ dhcp ๊ด€๋ จ ์ทจ์•ฝ์ ์ด ๋‚˜์™”๊ตฌ๋‚˜ ํ—€์—ˆ๋Š๋ฐ, ์ตœ๊ทผ์— ๋‹ค๋ฅธ ์ทจ์•ฝ์  ๋ณด๋‹ค๋ณด๋‹ˆ ์ด ์ทจ์•ฝ์ ์„ ๊ธฐ๋ฐ˜์œผ๋กœ ํ•œ ์ทจ์•ฝ์ ์ด ๋ช‡๋ช‡ ๋ณด์—ฌ ๊ธ€๋กœ ํ’€์–ด๋ด…๋‹ˆ๋‹ค. ์˜ค๋Š˜ ์ด์•ผ๊ธฐ๋“œ๋ฆด ๋‚ด์šฉ์€ DynoRoot Exploit์ž…๋‹ˆ๋‹ค.

Read More

์›น ์–ด์…ˆ๋ธ”๋ฆฌ(Web Assembly)๋Š” ์–ด๋–ป๊ฒŒ ๋ณด์•ˆ ์ทจ์•ฝ์  ๋ถ„์„์„ ํ• ๊นŒ์š”?

  • 7 min read

์ฒœ์ฒœํžˆ ์ •๋ฆฌํ•˜๋˜ ๊ธ€์ด ํ•˜๋‚˜ ์žˆ์—ˆ๋Š”๋ฐ, ๋“œ๋””์–ด ๊ธ€๋กœ ์˜ฌ๋ฆฌ๊ฒŒ๋˜์—ˆ์Šต๋‹ˆ๋‹ค. ์˜ค๋Š˜ ์ด์•ผ๊ธฐ๋“œ๋ฆด ๊ฒƒ์€ ์›น ์–ด์…ˆ๋ธ”๋ฆฌ์™€ ๋ณด์•ˆ๋ถ„์„ ๋Œ€ํ•œ ๋‚ด์šฉ์ž…๋‹ˆ๋‹ค.

Read More

Ruby gem ๋งŒ๋“ค๊ธฐ(Make ruby gem)

  • 1 min read

์š”์ฆ˜ ์ข€ ์ •์‹ ์—†์ด ์ง€๋‚ด๋‹ค๋ณด๋‹ˆ ๋ฒŒ์จ 10์›”์ด๋„ค์š”.. ์จ๋†“์€ ๊ธ€๋„ ๋งˆ์นจ ์—†๋Š” ์ƒํƒœ์ธ์ง€๋ผ ์ด๋ฒˆ์—๋„ ๊ฐ„๋žตํ•œ ๊ธ€ ์ž‘์„ฑํ• ๊นŒ ํ•ฉ๋‹ˆ๋‹ค. (์•„ 10์›”์˜ ์ฒซ๊ธ€์ด ๋ฉ”๋ชจ๊ธ€์ด๋ผ๋‹ˆโ€ฆ) ๋งŽ์€ ruby application ๋“ค์ด ๋‹จ์ˆœํžˆ ์ฝ”๋“œ๋ฅผ clone ํ•ด์„œ ์“ฐ๋Š” ํ˜•ํƒœ๋ณด๋‹จ gem์œผ๋กœ ํŒจํ‚ค์ง•ํ•˜์—ฌ ๋ฐฐํฌํ•˜๊ณ  ์‚ฌ์šฉํ•˜๋Š” ํ˜•ํƒœ๋ฅผ ๊ฐ€์ง‘๋‹ˆ๋‹ค.

Read More

Ruby IDB(iOS App ๋ณด์•ˆ๋ถ„์„ ๋„๊ตฌ) Select App ์‹œ ์ฃฝ๋Š” ํ˜„์ƒ ํ•ด๊ฒฐ ๋ฐฉ๋ฒ•(iOS10, Error downloading file)

  • 1 min read

์˜ˆ์ „์— idb๋ผ๋Š” iOS ๋ถ„์„๋„๊ตฌ๋ฅผ ๊ณต์œ ๋“œ๋ฆฐ์ ์ด ์žˆ์Šต๋‹ˆ๋‹ค. ์ตœ๊ทผ์— ํ…Œ์ŠคํŠธ ์‹œ Select App ์‹œ ์•ฑ ๋ฆฌ์ŠคํŠธ๋ฅผ ๊ฐ€์ ธ์˜ค๋Š” ๊ณผ์ •์—์„œ ์ฃฝ๋Š” ํ˜„์ƒ์ด ์žˆ์—ˆ๋Š๋ฐ์š”, ์˜ˆ์ „์— ๊ฐ€๊นŒ์šด๊ณณ์—์„œ ๋™์ผํ•œ ๋ฌธ์ œ๊ฐ€ ์žˆ์—ˆ๊ณ  ํ•ด๊ฒฐ๋ฐฉ๋ฒ• ๊ณต์œ ํ•ด์ฃผ์…จ๋˜๊ฒŒ ๊ธฐ์–ต๋‚˜์„œ ์ € ๋˜ํ•œ ์‰ฝ๊ฒŒ ํ•ด๊ฒฐํ—€๋„ค์š”.

Read More

JSFuck XSS

  • 2 min read

ํ˜น์‹œ ์ด๋Ÿฐ XSS ์ฝ”๋“œ ๋งŽ์ด๋“ค ์‚ฌ์šฉํ•˜์‹œ๋‚˜์š”? ์ €๋Š” ๊ฐœ์ธ์ ์œผ๋กœ Js ์ฝ”๋“œ ํƒˆ์ถœ ์ดํ›„ ํŠน์ˆ˜๋ฌธ์ž~๋ฌธ์ž์—ด ๋“ฑ ์›ํ•˜๋Š” ๊ตฌ๋ฌธ ์‚ฝ์ž…์ด ์–ด๋ ค์šธ ๋–„ ์ข…์ข… ์‚ฌ์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•์ž…๋‹ˆ๋‹ค.

Read More

XSS Polyglot Challenge(v2)์— ์ฐธ์—ฌํ•˜๋ฉฐ XSS์— ๋Œ€ํ•œ ๊ณ ๋ฏผ์„ ๋” ํ•ด๋ด…์‹œ๋‹ค!

  • 1 min read

polyglot์ด๋ž€ ์—ฌ๋Ÿฌ ํ™˜๊ฒฝ? ์—์„œ๋„ ๋™์ž‘ํ•˜๋Š” ํ•œ์ค„์งœ๋ฆฌ ๊ฐ•๋ ฅํ•œ ํ…Œ์ŠคํŒ… ์ฝ”๋“œ๋ฅผ ์˜๋ฏธํ•ฉ๋‹ˆ๋‹ค. ์ € ๋˜ํ•œ ๊ฐ€๋”์”ฉ ํ…Œ์ŠคํŠธํ•  ๋•Œ ์“ฐ๊ณคํ•˜๋Š”๋ฐ, ์•„๋ฌดํŠผ ๊ณ ๋ฏผํ•ด๋ณด์‹œ๊ณ  ๋งŒ๋“ค์–ด๋ณด์‹œ๋ฉด ๋ถ„๋ช… ์ข‹์€๊ฒ๋‹ˆ๋‹ค.

Read More

p0wn-box - ๊ฐ€๋ณ๊ฒŒ ์‚ฌ์šฉํ•˜๊ธฐ ์ข‹์€ ๋ชจ์˜ํ•ดํ‚น/์นจํˆฌํ…Œ์ŠคํŠธ ํˆด ๋„์ปค ์ด๋ฏธ์ง€

  • 2 min read

์ตœ๊ทผ์— Docker image ํ•œ๋ฒˆ ์ œ๋Œ€๋กœ ๋‚ ๋ ค๋จน์€์ ์ด ์žˆ์Šต๋‹ˆ๋‹ค. ํ…Œ์ŠคํŠธ์šฉ ์นผ๋ฆฌโ€ฆ.ใ…œใ…œ (๋งฅ์€ ๋ฆฌ๋ˆ…์Šค์™€ ๋‹ค๋ฅด๊ฒŒ ์„ธํŒ…์„ ๋‹ค ์•ˆํ•ด๋†“์€์ง€๋ผโ€ฆ ๋„์ปค์— ์—„์ฒญ ์˜์กดํ•˜๊ณ  ์žˆ์—ˆ์ฃ )

Read More

Scala์˜ underscore(_)๋ž€?

  • 1 min read

์š”์ฆ˜ ์ž๊พธ ์Šค์นผ๋ผ๋ž‘ ๋ถ€๋”ซํžˆ๊ฒŒ ๋˜๋„ค์š”. ์จ๋ณธ์ ๋„ ์—†๋Š” ์–ธ์–ด์ง€๋งŒ ๋‹ค๋ฅธ ์–ธ์–ด๋ž‘ ๋น„์Šทํ•˜๊ฑฐ๋‹ˆ(Js+Java๋Š๋‚Œ..) ํ•˜๊ณ  ๋ดค๋Š”๋ฐ, ์–ด๋งˆ๋ฌด์‹œํ•˜๊ฒŒ ๊ฐ€๋…์„ฑ์„ ๋–จ์–ด๋œจ๋ฆฌ๋Š” ๋ฌด์–ธ๊ฐ€๋ฅผ ๋ฐœ๊ฒฌํ•˜์˜€์Šต๋‹ˆ๋‹ค.

Read More