Shulou(Shulou.com)05/31 Report--

This article is about the usefulness of building a pseudo-Update server tool, isr-evilgrade. The editor thinks it is very practical, so share it with you as a reference and follow the editor to have a look.

Build pseudo-Update server tool isr-evilgrade

Most software now provides update capabilities. Once the software runs, it automatically checks the corresponding Update server. If a new version is found, the user will be prompted and downloaded and installed. And users often believe any prompt, will choose to upgrade. If the update policy is not carefully formulated, there will be serious vulnerabilities.

Based on this idea of social workers, penetration testers can easily control the target host. Kali Linux provides a tool for isr-evilgrade to take advantage of this feature. The tool provides DNS and Web service modules, as well as dozens of pseudo update service modules. When DNS spoofing is implemented, the software that needs to be updated will access the penetration tester's computer, download the pre-prepared attack payload as an update package, and run it. Thus, the penetration tester can control the target host. Security personnel can also use their own templates to write specific pseudo-update modules.

Thank you for reading! This is the end of this article on "what is the use of building a pseudo-Update server tool isr-evilgrade?". I hope the above content can be of some help to you, so that you can learn more knowledge. if you think the article is good, you can share it out for more people to see!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.