Friday December 25th

Friday December 18th

Thursday December 3rd

Tuesday December 1st

Monday November 16th

Sunday November 15th

Friday November 6th

Tuesday November 3rd

Wednesday October 14th

1 Kicks

PHP Object Injection: getting dirty with SOAP

Lately I have been spending some time digging into PHP, especially focusing on issues which could be used in Object Injection contexts; more specifically,for my research, I chose to target the SoapClient built-in class since it already had a past in terms of interesting findings. For the TL;DR guys: I ended up finding an RCE+info leak, a couple of NULL pointer dereference, a memory exfiltration and sort of a trick to extend its attack surface ; all the issues have been fixed with PHP 5.6.12/5.5.28/5.4.44 relases.

0 comments

Commenting on Stories is limited for now and will open up to those recommended by the community. Learn how
Loading InfoSecKicks...
brought to you by the Kicks Network