PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Have you ever played with Domino?

blog.quarkslab.com | research | #cryptography | #reverse-engineering | #password-cracking | #ibm | #lotus-domino | #john-the-ripper
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Reverse-engineering IBM Lotus Domino password storage: the user.id file's ciphered 5-byte digest, built from RC2 and SHA-1 through a custom scheme, and a John the Ripper plugin to brute-force it.
Published
Collected

Related coverage

research · eshard.com
Unfolding obfuscated code with esReverse - Part I (full write-up)
We take the Grehack 2015's challenge scoring the highest number of points over all categories (cryptography, exploit, reverse engineering, etc.) using esReven.
blog · netspi.com
GPU Cracking: Setting up a Server
A walkthrough for building a headless GPU cracking server: installing Ubuntu 12.10, AMD drivers, oclHashcat-plus, and John the Ripper, tailored to AMD cards since Linux driver support lags Windows.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · hackerone.com
HackerOne Partners with IBM to Advance AI Protections for Granite Models
HackerOne and IBM launched a bug bounty paying up to $100K for jailbreaks and guardrail flaws in IBM Granite models, tested with Granite Guardian active in enterprise-like deployment scenarios.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back