Full Disclosure mailing list archives
Re: Book of unreleased exploits?
From: Dave Aitel <dave () immunitysec com>
Date: Sat, 13 Mar 2004 10:21:05 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks for your interest in Shellcoders! The book is not simply a listing of new exploits. It does contain new exploits to highlight some of the techniques in the chapters. Specifically, I have a new CDE remote, and Sinan has some kernel exploits in the advanced chapters, and there are 0day "techniques" throughout some of the chapters. There were several goals with this book: 1. Not make it a collection of Phrack papers 2. Not make it confusing to the reader by bouncing between architectures 3. To try to provide a coherent progression from easy to advanced. While we do cover Windows, Solaris, and Tru64 in some detail, the beginner's chapters of the book are written for Linux. We felt that by staying with one, widely available, platform, we could make the book understandable to readers who had not had experience writing exploits previously. This is why we have so many people on the book - each of us is good at presenting some things, and we were able to bounce things off each other. If you're curious about me in particular, I run a mailing list "The Daily Dave" where I post my advisories and comments on information security technology linked off of www.immunitysec.com. I posted two advisories to it yesterday, for example. Thanks, Dave Aitel Immunity, Inc. David Cohen wrote: Coworker is telling me this is some sort of compendium of unreleased exploits. Figuring that the average exploit would take up about 5 pages of printed text, and the book at 650 pages, that would lead me to infer that it has somehwere around 130 new exploits. WTF? What is the point of this other than to force people to buy exploits? Im speculating that this is mostly going to be lame XSS bugs and rewrites of existing exploits. Anyone know for sure? I've never heard of any of these guys, but one of these jokers has to be on this mailing list. David -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFAUybhzOrqAtg8JS8RAm/PAJ94Xq01KRFUOoISeDwWU4PpPos5vACdEhMI b8WncJGfwHcF66O4djWYzYg= =mrVl -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Book of unreleased exploits? david cohen (Mar 12)
- Re: Book of unreleased exploits? madsaxon (Mar 12)
- Re: Book of unreleased exploits? c0hiba (Mar 12)
- Re: Book of unreleased exploits? Cael Abal (Mar 12)
- Re: Book of unreleased exploits? c0hiba (Mar 12)
- Re: Book of unreleased exploits? Person (Mar 12)
- Re: Book of unreleased exploits? Ron DuFresne (Mar 12)
- RE: Book of unreleased exploits? Aditya, ALD [Aditya Lalit Deshmukh] (Mar 13)
- RE: Book of unreleased exploits? Oliver Schneider (Mar 13)
- Re: Book of unreleased exploits? Cael Abal (Mar 13)
- Re: Book of unreleased exploits? Alexander Hoogerhuis (Mar 13)
- <Possible follow-ups>
- Re: Book of unreleased exploits? Dave Aitel (Mar 13)
- Re: Book of unreleased exploits? madsaxon (Mar 12)