Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was watching Kevin Mitnick demonstrate the results of an exploit via Heap Spray in a PDF https://www.youtube.com/watch?v=0EKTCg7yQ_Y and was wondering what exactly is going on in the PDF and whether there where any resources to replicate what he did?
My Google skills are lacking because each time I search for Heap Spray PDF, I get PDFs about all variations of heap spray including some gardening tips!
Around 2:19 you can see the file name in the top of the pdf reader. Putting this between double quotes let's the search engine search for that exact phrase:
I also tried Bing and Duckduckgo, but they don't give anything either.
If we try meta search engines (special search engines that combine the results of multiple normal search engines):
I also used Excite and Deeperweb, but they don't result in anything either. Besides using the exact phrase method, I used the following:
"inurl:no inurl:malware inurl:here filetype:pdf"
(without double quotes), but that also gives nothing. Because of this I think an exact copy of the document he uses isn't available on the internet.
Wikipedia tells us that heap sprays can be implemented using JavaScript and/or images. Both of which can be used inside a pdf file. If you're really interested, you could search for general tutorials on heap spraying and on using JavaScript inside pdf documents and try something out yourself.
