DLL Search Order Hijacking: Finding and Exploiting the Flaw This is a deep dive into DLL Hijacking, specifically Search Order Hijacking. This is one of the most common and persistent techniques used …

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

A hands-on walkthrough of DLL Search Order Hijacking on Windows. Covers how Windows resolves DLL names using Safe DLL Search Mode, how to identify vulnerable applications using Sysinternals Process Monitor with targeted filters, and how to build a proof-of-concept exploit using a vulnerable C++ victim app and a malicious DLL. Demonstrates the difference between secure (absolute path) and vulnerable (relative path) DLL loading, and shows step-by-step how placing a malicious DLL in an application's directory causes it to be loaded instead of the legitimate system DLL.

DLL Search Order Hijacking: Finding and Exploiting the Flaw

Finding Vulnerabilities with Process Monitor (ProcMon)

The Baseline: A Secure Application (Notepad)