osirislab / project-ideas Goto Github PK
View Code? Open in Web Editor NEWA place to discuss potential projects for students of the ISIS Lab.
A place to discuss potential projects for students of the ISIS Lab.
Pretty self explanatory. Wikipedia doesn't have these articles and they are pretty important. Writing them will demonstrate you have a clear working knowledge of dynamic linking and runtime behavior and your work will be seen by many people.
Burp plugin to use Burp Repeater functionality to fuzz web applications.
The plugin needs to:
The documentation for Burp Extender is poor and the approach for writing this plugin is unclear. Work needs to be done in deciphering the documentation, scripting Burp Repeater to submit information pragmatically, and keep track of requests and their appropriate responses.
http://portswigger.net/burp/extender/
The plugin can be written in Java, Jython, or JRuby. Most likely given the preferences in the lab, Jython will be chosen as the plugin language. In addition, it is probable that the Burp Extender demo extensions will be of more assistance than the Extender documentation if you choose to use Jython or JRuby.
http://osehra.org/
http://osehra.org/wiki/code-status-dashboard
http://osehra.org/page/osehra-code-repository
http://osehra.org/content/va-enterprise-vista-standard
http://code.osehra.org/gitweb
https://github.com/OSEHRA
Use the vulnerability research methodology from project idea #3.
Post it to our blog or your blog.
Synopses should be ran past me
http://acm.poly.edu/wiki/Net_Sensor
Use the vulnerability research methodology from project idea #3.
This can be implemented as a Burp plugin (see #8) or a stand alone application.
http://acm.poly.edu/wiki/Rogue_DHCP_Server_Detector
Use the vulnerability research methodology from project idea #3.
E-mail clients like Thunderbird and Mail.app support S/MIME out of the box but various essential components are missing.
For example, e-mails aren't automatically upgraded to encrypt when it's detected that a public key for the recipient exists in your keystore for Thunderbird. Various other conditions lead many e-mails to be sent that you may believe are signed and encrypted but are not. This functionality could be investigated in the open-source Thunderbird repository and changed or added to.
https://www.mozilla.org/en-US/contribute/
https://wiki.mozilla.org/Thunderbird
As another example, attackers may find an unscrupulous CA to sign a CSR and get an S/MIME cert in the name of a friend of yours. Mail.app provides little to no facilities to check whether the S/MIME cert used by a third party is the one you expect. It's not possible to view the certificate used to sign a message from the message display, compare it to previous certificates used by that sender, or inspect that the keys used were strong enough to resist cracking. Changing this functionality would require developing a plugin, similar to GPGTool's GPGMail which is open-source and might serve as a template.
https://github.com/GPGTools/GPGMail
https://developer.apple.com/library/mac/#documentation/CoreFoundation/Conceptual/CFBundles/Introduction/Introduction.html
This is a pretty simple concept and it might already exist. A user would run something like !plugin RtlHeapAlloc and the plugin would automatically set a breakpoint on RtlHeapAlloc() that will print out the arguments when the function is originally called and the return value of the function after it returns.
Possible design goals
Use cases
In European countries, ',' and '.' are reversed when used to delimit thousands/the decimal. This could be the source of a few bugs out there. Write a static analysis tool that looks for these bugs.
One possible approach is to search for the following pattern /(,|.)\d{3}/.
Some other notes:
Look for locations where a function is receiving more arguments than it expects. (Perl, Ruby?)
Python lists (a = 1,000)
Some students are self-starters, others need their hand held every step of the way. Some students need to hear it, others just need to touch it, and some need to see concepts demonstrated over and over again.
What can we do so Hack Night, and our other publicly available materials are useful for everyone?
https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API
Use the vulnerability research methodology from project idea #3.
Idea from Thomas Reddington.
Mapping a network from the perspective of an external attacker or an internal attacker. The lab has expertise in many areas of networking, and this expertise can be turned into a stealthy, sensitive information gathering tool that's useful for both offense and defense.
https://code.google.com/p/skipfish/
Use the vulnerability research methodology from project idea #3.
https://www.updateframework.com/
Use the vulnerability research methodology from project idea #3.
https://github.com/BUILDS-/Derpnet
Use the vulnerability research methodology from project idea #3.
This project can be done for Windows or Linux.
The hard version of this project is very educational. This project is related to project #15.
http://spin.atomicobject.com/2013/01/13/exceptions-stack-traces-c/
What information do new students need to be exposed to in order to be high-functioning members of the ISIS Lab and the information security industry?
Research Type Confusion and Content Sniffing, and build a working payload for a vulnerable browser (like IE 6).
Often not discussed, this complex vulnerability has huge ramifications on the web. Although having multiple short bursts of popularity with GIFAR and JPEGZIP, this vulnerability still doesn't have an OWASP page. Please feel free to add any more resources you find on this subject.
Like this but for Windows.
http://duartes.org/gustavo/blog/post/anatomy-of-a-program-in-memory
Web application software made for serving advertisements, like OpenX, are among the most exploited web applications on the internet due to the large volume of web traffic they come in contact with. Criminals frequently exploit these systems to redirect this flow of traffic towards a crimeware pack like the Blackhole Exploit Kit. Much of this software was written years ago in PHP and they have not been the subject of close study.
Perform a targeted assessment of these web applications with a eye towards vulnerabilities that can result in a server compromise.
The shellcode repository needs some work.
A list of all the issues is available here: https://github.com/isislab/Shellcode/issues
Some of the tickets currently open are:
Write a stager and some awesome stages: osirislab/Shellcode#5
Come up with a strategy to organize and maintain the collection: osirislab/Shellcode#4
Help finish authoring the socket reuse shellcode: osirislab/Shellcode#3
Author some connect back shellcode on IPv6:
osirislab/Shellcode#1
Writing a debugger can be an enlightening process. This project will help you understand how debuggers interface with the operating system to allow program debugging. It will also teach you the techniques debuggers need to use to provide simple and complex debugging features.
This project is related to project #14.
@isislab/jewdbg.
This could be a simple standalone tool or an add-on to an existing static analysis framework, such as:
This could also be written as a rule for commercial static analysis engine, such as:
This could be a simple standalone tool or an add-on to an existing static analysis framework, such as:
This could also be written as a rule for commercial static analysis engine, such as:
https://github.com/ozoneplatform/owf
The Ozone Widget Framework, a government developed application for widget development is available on GitHub under version 2.0 of the Apache license. The Defense Department was under a year-end congressional deadline to release the code as open source; its developers describe it in the ReadMe as "basically a glorified web portal engine, with the unusual characteristic that the content within the portal (i.e. the widgets) is decentralized."
Security Researchers could look to see how security is implemented on this framework, and to check to see if any vulnerabilities exist.
http://www.microsoft.com/en-us/server-cloud/system-center/configuration-manager-2012.aspx
Use the vulnerability research methodology from project idea #3.
Cuckoo is one of the leading automatic malware analysis engines. Bypass it consistently with common malware or contrived malware, and notify the developers. Then work on better ways for Cuckoo to detect your malware.
http://www.wireshark.org/
http://www.wireshark.org/develop.html
http://www.wireshark.org/docs/wsdg_html_chunked/
https://bugs.wireshark.org/bugzilla/
https://bugs.wireshark.org/bugzilla/buglist.cgi?quicksearch=fuzz
This methodology assumes you have already completed the Hack Night curriculum.
Remember always focus on the easiest way to find bugs first. This might change from project to project, but here's a guide.
This could be a simple standalone tool or an add-on to an existing static analysis framework, such as:
This could also be written as a rule for commercial static analysis engine, such as:
http://www.mozilla.org/projects/firefox/
https://developer.mozilla.org/en-US/docs/Introduction
https://developer.mozilla.org/en-US/docs/Simple_Firefox_build
https://bugzilla.mozilla.org/buglist.cgi?query_format=specific&order=relevance+desc&bug_status=__all__&product=Firefox&content=crash&comments=0
http://www.mozilla.org/security/known-vulnerabilities/firefox.html
Use the vulnerability research methodology from project idea #3.
Related to #14.
See me for details.
Abstract:
Android's Intents are a way of communication that takes place between the app's components. The communication can be within a single app or can be with other apps in the system. Intent's are a two layer abstraction of what the actual Inter-Process Communication (IPC) mechanism is being performed on the low level(Kernel). Binder kernel module in the Android's architecture is responsible for all the IPC communications. It would be interesting to see how the marshaling and un-marshaling takes place, and if any vulnerability is present, it would lead intents being passed to other app's than intended, or worse an arbitary code execution.
Short-Term Goals:
Long-Term Goals:
Reference:
Using publicly available information about different groups of attackers and their motives, build a taxonomy of different types of attackers and their motives, capabilities, resources, growth, and more.
Make sure to follow standard principles of economics, like an actor will take the path of least effort/resources/sophistication to achieve their goal. For instance, crimeware groups who are stealing bank account information don't need to use 0-day to install their malware so chances are, they won't.
This project is designed to help show laymen how and why attackers operate the way they do. And also to prevent bullshit and lies from ending up in the New York Times. :)
http://acm.poly.edu/wiki/ARP_Counterattack
Use the vulnerability research methodology from project idea #3.
msec.dll is open source.
http://msecdbg.codeplex.com/
Research bugs in the python interpreter. Research how to exploit bugs in the python interpreter.
http://en.wikipedia.org/wiki/Cross-site_scripting
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
This project can yield a tool specific to a web programming language:
This project could also yield a tool that works across platforms.
This could be a simple standalone tool or an add-on to an existing static analysis framework, such as:
This could also be written as a rule for commercial static analysis engine, such as:
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.