Exploit Dev Quiz

#######################################################
# Open the following web links below as tabs          #
# For each web link answer all of the questions below #
#######################################################
https://www.exploit-db.com/exploits/46762
https://www.exploit-db.com/exploits/46070
https://www.exploit-db.com/exploits/40713
https://www.exploit-db.com/exploits/46458
https://www.exploit-db.com/exploits/40712
https://www.exploit-db.com/exploits/40714
https://www.exploit-db.com/exploits/40680
https://www.exploit-db.com/exploits/40673
https://www.exploit-db.com/exploits/40681
https://www.exploit-db.com/exploits/37731
https://www.exploit-db.com/exploits/31254
https://www.exploit-db.com/exploits/31255
https://www.exploit-db.com/exploits/27703
https://www.exploit-db.com/exploits/27277
https://www.exploit-db.com/exploits/26495
https://www.exploit-db.com/exploits/24557
https://www.exploit-db.com/exploits/39417
https://www.exploit-db.com/exploits/23243



                      ###############################
###################### # Class Exploit Dev Quiz Task # ######################
                      ###############################


EID number:

1. Vulnerable Software Info
    a- Target Product Name
    b- Target Software version
    c- Available for download on exploit-db.com


2. Target platform
    a- OS Name                              (ex: Windows XP)
    b- Service pack                         (ex: SP3)
    c- Language pack                        (ex: English)


3. Exploit info
    a- modules imported                     (ex: sys, re, os)
    b- application entry point              (ex: TRUN)
    c- distance to EIP                      (ex: 2006)
    d- how is code redirection done         (ex: JMP ESP, JMP ESI)
    e- number of NOPs                       (ex: 10 * \x90  = 10 NOPs)
    f- length of shellcode                  (ex: 368)
    g- bad characters                       (ex: \x0a\x00\x0d)
    h- is the target ip hard-coded
    i- what does the shellcode do           (ex: bind shell, reverse shell, calc)
    j- what is the total buffer length
    k- does the exploit do anything to ensure the buffer doesn't exceed a certain length
    l- Is this a server side or client-side exploit




######################################
# Exploit Development Scoring System #
######################################

1. Comments
-----------
1a. Has detailed comments (1 point)
1b. Comments target app info (1 point)
1c. Comments target platform info (1 point)
1d. Comments protocol or file spec info (1 point)
1e. Comments program redirection info (1 point)
1f. Comments shellcode info (1 point)


2. Modules/Libraries
--------------------
2a. Uses correct modules/libraries to properly interact with protocol or file type (1 point)


3. Program redirection
----------------------
3a. Use correct program redirection (JMP ESP, CALL ESP, PUSH ESP; RET) from the correct platform for stable program code redirection

4. Shellcode
------------
4a. Tests for bad characters (1 point)
4b. Tests for maximum length of payload (1 point)

5. Exploit stability
--------------------
5a. Use NOPS correctly
5b. Maps to protocol or file spec correctly
5c. Uses a stack shift if applicable
5c. Uses correct EXITFUNC for stability (1 point)