Comments on: How We’ll Miss You So, Black Hat ’06… http://ddos.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/ A weblog dedicated to educating the community on security threats that matter Mon, 07 May 2012 13:07:22 +0000 hourly 1 http://wordpress.org/?v= By: Steo http://ddos.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/comment-page-1/#comment-796 Steo Sat, 19 Aug 2006 17:30:24 +0000 http://asert.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/#comment-796 Nice article. Thanks. Nice article. Thanks.

]]> By: Haroon Meer http://ddos.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/comment-page-1/#comment-781 Haroon Meer Thu, 17 Aug 2006 22:23:06 +0000 http://asert.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/#comment-781 We did a pdb little brother as part of our "tale of two proxies" talk at the same show. I used python (but mainly so that i could steal scapys packet structures/code :> We bumped into the tcp re-transmit issue too, but i suspect it can be fixed relatively easily by faking window updates (size 0) to both client and server (effectively becoming a pdb style int3) My code is far messier, but ill throw it up soonishly.. We did a pdb little brother as part of our “tale of two proxies” talk at the same show. I used python (but mainly so that i could steal scapys packet structures/code :>

We bumped into the tcp re-transmit issue too, but i suspect it can be fixed relatively easily by faking window updates (size 0) to both client and server (effectively becoming a pdb style int3)

My code is far messier, but ill throw it up soonishly..

]]> By: Dino Dai Zovi http://ddos.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/comment-page-1/#comment-742 Dino Dai Zovi Thu, 10 Aug 2006 18:29:29 +0000 http://asert.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/#comment-742 [...] I’m taking the bait. I am somewhat of a programming language geek and actually love debating the pros/cons of various languages and whether some of them (i.e. bourne shell) are well suited to certain tasks (i.e. fuzzing). However, claiming that a specific language is the best tool for any job is the silly sort of argument that someone who knows *one* high-level language tends to make. Sometimes the right language for the job in the hands of good programmers lets you make a cool few million bucks in one summer. Sometimes, your exploits must be written in OCaml (if you haven’t already tried it, pattern matching is *phenomenal* for writing network protocol stacks). Try and reverse that binary! [...] [...] I’m taking the bait. I am somewhat of a programming language geek and actually love debating the pros/cons of various languages and whether some of them (i.e. bourne shell) are well suited to certain tasks (i.e. fuzzing). However, claiming that a specific language is the best tool for any job is the silly sort of argument that someone who knows *one* high-level language tends to make. Sometimes the right language for the job in the hands of good programmers lets you make a cool few million bucks in one summer. Sometimes, your exploits must be written in OCaml (if you haven’t already tried it, pattern matching is *phenomenal* for writing network protocol stacks). Try and reverse that binary! [...]

]]> By: Domber http://ddos.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/comment-page-1/#comment-732 Domber Thu, 10 Aug 2006 12:09:33 +0000 http://asert.arbornetworks.com/2006/08/how-well-miss-you-so-black-hat-06/#comment-732 Thx for the hint about the WoW Rootkit ... pretty interesting stuff. Thx for the hint about the WoW Rootkit … pretty interesting stuff.

]]>