Bug In Focus: Remote Code Execution (RCE)
We talk about remote code execution, often a holy grail bug with bounties getting upwards of $1k and a scary amount of impact. We're going to break down, what they are, what people's first RCEs often are, then we chat about CVEs and how to exploit them. Finally, I give some interesting RCEs and explain the process of finding them.
Welcome to the first video in the Bug In Focus series, this series is going to be all about breaking down those really hard advanced bugs and explaining how they found them, what they are, what you need to know and how they were exploited. These videos are not going to be tutorials but instead presenting some interesting bugs, it's important to expose yourself to more advanced techniques even if you don't 100% understand what's happening.
Links
Orange Tsai - Infiltrating Corporate Intranet Like NSA Preauth RCE
DEF CON 27 Conference : • Orange Tsai - Infiltrating Corporate Intra...
Rez0 - My first RCE: a tale of good ideas and good friends: https://rezo.blog/hacking/2019/11/29/...
Strynx - Abusing ImageMagick to Obtain RCE: https://strynx.org/imagemagick-rce/
Spaceraccoon - Remote Code Execution in Three Acts: Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2: https://spaceraccoon.dev/remote-code-...
Neex - RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`: https://hackerone.com/reports/212696
mrnbayoh - Insufficient sanitizing can lead to arbitrary commands execution: https://hackerone.com/reports/494979
Spaceraccoon - RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/: https://hackerone.com/reports/502758
Orange Tsai - Potential pre-auth RCE on Twitter VPN: https://hackerone.com/reports/591295 & https://blog.orange.tw/2019/09/attack...
Sur cette page du site, vous pouvez voir la vidéo en ligne Bug In Focus: Remote Code Execution (RCE) durée heure minute seconde en bonne qualité , qui a été Téléchargé par l'utilisateur InsiderPhD 01 février 2020, Partagez le lien avec vos amis et connaissances, sur youtube cette vidéo a déjà été regardée 14,755 fois et il a aimé 455 téléspectateurs. Bon visionnage!
