Explore how attackers operate and their favorite tools and targets in our new SANS research. Get the Report ›

Tool Talk: asminject.py

Watch as we explore Bishop Fox’s very own asminject.py, a code injection tool that tampers with trusted Linux processes to capture sensitive data and change program behavior.

Watch the livestream on Tuesday, Nov. 1 at 2 p.m. ET!

Consider a product designed to process patient information from hospitals, or one that analyzes the performance of experimental stealth aircraft materials being researched in a lab. In an ideal world, IT staff would have access to manage the overall system but would somehow be prevented from accessing the actual data. Instead, currently, administrators with full control over the host itself can tamper with kernel memory, files in persistent storage, and even CPU registers if necessary.

To illustrate the potential dangers of hackers getting this level of administrative access, Senior Consultant Ben Lincoln developed a fork of David Buchanan's dlinject.py tool named asminject.py. This tool shows how attackers can tamper with trusted Linux processes to capture sensitive data with little to no detection.

Join the eighth episode of our Tool Talk series to get a play-by-play of asminject.py. In this livestream, you’ll hear the creator of asminject.py share:

  • Why asminject.py was developed
  • How asminject.py interacts with the target process to capture sensitive data
  • An asminject.py demo for penetration testing

We hope to see you there!

Speakers: Ben Lincoln, Managing Senior Consultant II, Bishop Fox; Joe Sechman, AVP of R&D, Bishop Fox


Ben Lincoln Headshot Managing Senior Security Consultant Bishop Fox

About the author, Ben Lincoln

Managing Senior Consultant II, Bishop Fox

Ben Lincoln is a Managing Senior Consultant II at Bishop Fox and focuses on application security. He has extensive experience in network penetration testing, red team activities, white-/black-box web/native application penetration testing, and exploit development. Prior to joining Bishop Fox, Ben was a security consultant with NCC Group, a global information assurance consulting organization. He also previously worked at a major retail corporation as a senior security engineer and a senior systems engineer. Ben delivered presentations at major security conferences, including "A Black Path Toward the Sun" at black hat USA 2016. Ben is OSCP-certified and has released several open-source exploit tools.

More by Ben

Joe sechman

About the author, Joe Sechman

AVP of R&D at Bishop Fox

Joe brings over 20 years of experience to his role as Associate Vice President of R&D where he is responsible for nurturing a culture of innovation across Bishop Fox. Over his career, Joe has amassed many security certifications, delivered several presentations, and has co-authored multiple industry publications with groups such as ISC2, ISACA, ASIS, HP, and IEEE.

Additionally, Joe is a prolific inventor with nine granted patents in the fields of dynamic and runtime application security testing, attack surface enumeration, and coverage (U.S. Patents 10,699,017, 10,515,219, 10,516,692, 10,515,220, 10,423,793, 9,846,781, 10,650,148, 10,587,641, and 11,057,395). Prior to joining Bishop Fox, Joe held leadership positions with companies such as Cobalt Labs, HP Fortify, Royal Philips, and Sunera LLC (now Focal Point Data Risk). Earlier in his career, Joe served as the lead penetration tester within SPI Labs at SPI Dynamics where he cut his teeth alongside some of the best and brightest application security industry professionals. Joe received his Bachelor of Business Administration degree in Management Information Systems from the Terry College of Business - University of Georgia.
More by Joe

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.