null – The open security community n|u

null meet on June 13th 2009

// June 9th, 2009 // Meets

Special thanks to Dinesh O Bareja for proviiding us the conference room for conducting our monthly meet. There are some really interesting topics we’ll be discussing this time.

Highlights: Free null hacker T-Shirt Giveaway to a randomly selected member present at the meet.

Date & Time: Sat 13th June 2009 17:00 hrs

Venue: Securematrix, 2nd Floor, Trident Towers, Pashan Road, Bavdhan, Pune

Directions: If coming from Chandni Chowk, Take the road going down towards pashan, after 1/2 km or so u’ll see a thin Glass building on the right called Trident realtors or something, Come directly to the 2nd floor. Excellent view of the mountains from the office location.

Agenda:

Talks/Discussions:

1. .NET (MSIL) Code Ijnection  – Prashant Mahajan

2. Bruteforcing PPPoE accounts: An option – Aseem Jakhar

3. nullcon website design – Kinjal, Rohan, abhijeet, Pankit

We can go to Apache after that, if time permits, for some real taste hacking .

_________________________________________________________________

Minutes of the Meeting:

Member Present:
1. Tushar Dalvi
2. Sameer V. Joshi
3. Swatantra Kr Gupta
4. Neha Chandra
5. Harsh Patel
6. Antriksh Shah
7. Shailesh Deshmukh
8. Anup Unawne
9. Pankit Thakkar
10. Varun Hirve
11. Abhijeet Patil
12. Krity Deb
13. Hemanshu Asolia
14. Prashant Mahajan
15. Rohan Mishra
16. Murtuja BHarmal
17. Aseem Jakhar
18. Sorabh S.

Talks/Discussions:
——————

PPPoE Session:
————–
Hemanshu talked about the authentication loophole in an ISP(name not disclosed till ISP responds/fixes) Murtuja talked about the details of PPP and PPPoE protocol and how they are used by ISPs. He further discussed on how the default pppoed can be modified to create and pppoe password cracker tool.

.NET Code Inject?ion:
—————————-
Prashant showed how to inject your own malicious code inside a dll to hijack .NET application function calls.
1. Identify the Library.
2. Disassembling the dll using ILDASM.
3. Calculating the offsets required to inject your own code.
4. Compliling the dll and using NGEN to re-insert the modified dll.
5. Implications.

nullcon Website Design:
1.Pankit showed 9 designs of NullCon site which was in Beta version.
2.Rohan showed the NullCon posters.
3. Krity and Tushar to send a design.

Lucky Winner of the null hacker T-Shirt:

1. Shailesh Deshmukh