assembly basics: strcmp ; test eax, eax

push eax (1st string to compare)
push ecx (2nd string to compare)
call strcmp (do the compare using C library ... if same EAX = 0, if different EAX = 1)
test eax, eax (same as 'and eax, eax' ... so if EAX = 0 ZF = 1 ... if EAX = 1 ZF = 0)
jz loc_40124C (so jump if zero jumps if ZF = 1 ... which is when EAX = 0)

------

In simpler terms
- compare the 2 strings
- if same
  - EAX gets set to 0
  - ZF gets set to 1
  - JZ will jump because ZF = 1
- if different
  - EAX gets set to 1
  - ZF gets set to 0
  - JZ will NOT jump because ZF = 0

------

In simplest terms 

  if you see " strcmp ; test ; jz "
    JZ green if the 2 strings are the same (0)

    JZ red if the 2 strings are different (non 0)

  if you see " strcmp ; test ; jnz "
    JNZ green if the 2 strings are different (non 0)

    JNZ red if the 2 strings are the same (0)

  if you see " strlen; test ; jz "
    JZ green if empty string (0)

    JZ red if non-empty string (non 0)

  if you see " strlen ; test ; jnz "
    JNZ green if non-empty string (non 0)

    JNZ red if empty string (0)

  if you see " call; test ; jz "
    JZ green if function call successful (0)

    JZ red if function call failed (non 0)

  if you see " call ; test ; jnz "
    JNZ green if function call failed (non 0)

    JNZ red if function call successful (0)

  if you see " cmp ; test ; jz "
    JZ green if the 2 numbers are the same (0)

    JZ red if the 2 numbers are different (non 0)

  if you see " cmp ; test ; jnz "
    JNZ green if the 2 numbers are different (non 0)

    JNZ red if the 2 numbers are the same (0)

Jump arrows

Green: if condition is satisfied (JZ=0, JNZ=non-0)
Red: if the condition is not satisfied (JZ=non-0, JNZ=0)

Wordpress Test Environment Requests

Why would somebody make a request to this path?

GET /test/wp-admin/

It appears this is a common, perhaps the default, location to install your "test" environment for a Wordpress blog. The problem appears to be if I do a google search for test wp-admin pages I get a bunch that are indexed and accessible.



I would never advise having your test environment accessible to the internet. Only have it accessible locally, you're just asking for trouble because test environments are never as locked down and monitored as production, and if your test blog is on the same server as production then you've just created a backdoor to production if an attacker can get into your test environment they're on your production server.

Another perhaps even bigger problem is that when I do the google search, most of these folders return directory listing and allow access to potentially sensitive files. Uh-oh. Lock down your test environments or remove them if you don't need them because the bad guys are looking for them!





More about neonprimetime

• neonprimetime pastebin
• neonprimetime virustotal
• @neonprimetime twitter
• neonprimetime reddit

Top Blogs of all-time

1. pagerank botnet sql injection walk-thru
2. DOM XSS 101 Walk-Through
3. An Invoice email and a Hot mess of Java

Top Github Contributions

1. Qualys Scantronitor 2.0

Copyright © 2016, this post cannot be reproduced or retransmitted in any form without reference to the original post.