Tagged Questions

15
votes
4answers
860 views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
1
vote
5answers
299 views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. ...
2
votes
1answer
163 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
8
votes
3answers
695 views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
2
votes
1answer
134 views

amd64 safer than 686-pae?

Apart from stronger ALSR entropy... Is a system using amd64 any safer than 686-pae? What are the advantages, if any?
2
votes
1answer
92 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
1
vote
1answer
356 views

syn flood size per second

Given the size of a TCP packet is 60 bytes, there is a SYN Flood attack on a computer made ​​by a 100 Mb bandwidth, the question is how many syn packets are sent in a second? Is there any formula for ...
3
votes
2answers
448 views

How to use attack trees and attack graphs

I am trying to understand how attack trees\graphs can be used in the security process. I read a lot of papers presenting the topic and how this reppresentation can be useful, but I really don't ...
0
votes
1answer
2k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
7
votes
3answers
379 views

How to gain a shell?

I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user. My question is this: I can create application that is guaranteed to be run by the ...
2
votes
3answers
119 views

I want to implement a new type of security feature over several platforms

I want to make a security feature that will go farther in discouraging people from looking through a secure system or server than what I have seen being implemented. Specifically, is there a way (or ...
4
votes
1answer
242 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
5
votes
5answers
2k views

What kind of attacks against home router's NAT do exist?

I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
3
votes
2answers
542 views

Reverse shell connections

Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice. Would not most servers restrict outgoing ...
48
votes
7answers
35k views

Can webcams be turned on without the indicator light?

I want to know how secure I am. I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a ...
12
votes
3answers
729 views

Bypassing Address Space Layout Randomization

How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
6
votes
4answers
454 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
4
votes
6answers
1k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...