Purposely vulnerable ActiveX Control to teach about exploitation in a browser-based environment.
CSS JavaScript
Latest commit 9d4f950 Dec 5, 2014 @brad-anton brad-anton structure cleanup
Permalink
Failed to load latest commit information.
css lots of bug fixes Dec 5, 2014
img first commit Aug 13, 2014
js lots of bug fixes Dec 5, 2014
FSExploitMe.html lots of bug fixes Dec 5, 2014
FSExploitMe.ocx lots of bug fixes Dec 5, 2014
FSExploitMe.pdb lots of bug fixes Dec 5, 2014
Readme.txt lots of bug fixes Dec 5, 2014

Readme.txt

FSExploitMe -
By Brad.Antoniewicz@foundstone.com (@brad_anton)
		
A purposely vulnerable ActiveX control for learning exploitation. Everything
is browser based to guide the student towards browser exploitation however
these vulnerabilities are really in the ActiveX Control, not the browser itself. 

There are some limitations. For instance, L3HeapSpray() only works on IE8. You'll
need a newer heapsray function to complete Lesson 3 on newer browsers. 

Answers are specifically blank in this release. If you'd like to access them, 
please contact me and I'll send them to you, assuming you're not one of my
students :)

FSExploitMe.html -
	Interface to invoke the various vulns.	

FSExploitMe.ocx - 	
	Main ActiveX Control.  
	From an elevated command prompt, run:
		regsvr32 /i FSExploitMe.ocx
		And copy to c:\windows\downloaded program files
					
js/css - 
	To make things pretty - using Foundation. http://foundation.zurb.com/
img - 
	Supporting Images
	
Notes:
		The Debug and Release versions available with Visual Studio will 
		alter the resulting binary, which will change any hardcoded answers 
		in the labs. 


Shoutz:
	This was based off an idea by Dan Guido and those Trail of Bits rock stars :)
	http://pentest.cryptocity.net/exploitation/