Overview
Google, IBM & Meta Certificates — All 10,000+ Courses at 40% Off
One annual plan covers every course and certificate on Coursera. 40% off for a limited time.
Get Full Access
Explore DIY vulnerability discovery techniques focusing on DLL side loading in this conference talk from BSides Augusta 2015. Delve into topics such as DLL hijacking, ghost DLL injection, and tools for auditing DLL injection. Learn about the default DLL search path, testing methods, and practical defenses. Gain insights into using tools like Gflags, Dependency Walker, and Procmon for identifying vulnerabilities. Discover HDMoore's DIY techniques for file extensions and understand the importance of Sxstrace in action. Enhance your cybersecurity skills with hands-on demonstrations and expert guidance on uncovering potential security weaknesses in software applications.
Syllabus
Intro
Blatant Disclaimer
Why bother?
Is anybody doing this?
DLL Hijacking
Where's Waldo?
Rules of Fight Club
DLL Search Path (Unsafe)
Default DLL Search Path (SafeSearch)
Testing for "Ghost DLL" injection
Tools for Auditing DLL Injection
Gflags for the win!
Finding craziness with gflags
Debug Output
HDMoore DIY for file extensions (2)
Dependency Walker (2)
Dependency Walker vs. Argon.exe
HDMoore DIY for file extensions (3)
DLL Hijack Auditor (2)
Going Native with Procmon
Sxstrace in Action
Practical Defenses (2)
Rendition is Hiring
Questions?