The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

0
votes
3answers
48 views

What should I do when my warnings are ignored?

If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I proceed? I gave the developer ample time to address the issue, as recommended by this and I know I ...
0
votes
1answer
32 views

How to adapt my exploit strategy when “00” is part of the targeted return address and the victim uses strcpy

I intend to exploit the following program on an x86 Linux machine with NX enabled (ASLR and stack canary disabled). The goal is to get a shell. //vuln.c #include <stdio.h> #include <string....
0
votes
1answer
17 views

Offset in Stack

Offsets in buffer overflows I can't seem to get a grasp on. Here is a quote from the book I am reading about this topic. The address of the variable "i" in main()'s stack frame is used as a point ...
0
votes
0answers
14 views

Bypassing SafeSEH in application without unprotected modules

I'm trying to write an exploit for a vulnerable Win32 application, which has DEP, SafeSEH and stack cookies enabled. I can write anything to the stack, as there is buffer overflow vulnerability in an ...
0
votes
1answer
28 views

Metasploit INFILENAME

I am learning *MSF on Kali but I ran into a problem. I am trying a simple adobe_pdf_embedded_exe and when I set INFILENAME to something simple such as nutrition.pdf it cannot find the file, so ...
0
votes
3answers
100 views

How a professional hacker would penetrate a computer in a network?

Which kinds of vulnerabilities or security holes a hacker would use to penetrate and take over a computer in a network, like a normal PC in a default network (Wireless-LAN). I often hear that the ...
0
votes
1answer
72 views

Is a rootkit not an exploit?

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
0
votes
0answers
44 views

What is the Linux Kernel attack surface? [on hold]

What is the full Linux Kernel attack surface ? meaning what are the vectors through which untrusted or unprivileged access interacts with the Kernel. For instance, system calls are an attack vector, /...
1
vote
2answers
80 views

SQL injection to login when there's no record in the database

I have a question to solve. Well there's no records of username and password in the database and so one cannot Log in without inserting any records. Is there anyway to exploit the following code and ...
-3
votes
1answer
45 views

Which WYSIWYG editor has the best security reputation? [on hold]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
2
votes
2answers
64 views

Is this integer overflow vulnerability exploitable?

Is this integer overflow exploitable and if the answer is yes, how can i exploit it? char buffer[20]; int len = atoi(argv[1]); if(len < 20) memcpy(buffer,argv[2],len); If I set len to -1 the ...
-1
votes
2answers
89 views

Are these queries vulnerable to injection in mysql

The queries below show SQL injection in appscans for MySQL. Is there a way to do a proof of concept or otherwise to how can they be exploited? INSERT INTO cscart_sessions (session_id, expiry) values('...
-1
votes
3answers
61 views

Why is netapi obsolete [closed]

Why is the ms08_067_netapi exploit obsolete? Are there alternatives to this exploit that can help me inject payloads to more recent version of windows?
0
votes
1answer
75 views

Random persistent Gmail password requests from Google

I am trying to figure out something for my father in law. This persistent popup keeps interrupting anything anyone is doing on his desktop by requesting he put in his password. I told him not to. It ...
3
votes
2answers
88 views

What does EIP stand for?

There are a ton of questions on here that make reference to the eip: How can I partially overwrite the EIP in order to bypass ASLR? Unable to overwrite EIP register Do I always have to overwrite EIP ...
1
vote
1answer
75 views

Can you get a virus from sending a GET or POST request? [duplicate]

If I need to fix up my question in any way please let me know, this is my first question on the site So there's a game development website I use where you can develop with other people, and within ...
-1
votes
2answers
47 views

Launching SQL injection in MD5 with mysqli_real_escape_string()?

Can we exploit the MD5() and mysqli_real_escape_string() methods in this case to perform SQL injection? Here is the code snippet: $pwd = mysqli_real_escape_string($conn,MD5($_POST['pwd'])); $login = ...
1
vote
1answer
43 views

How does the recent discovered PowerPoint exploit work?

One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files. But I do not understand how the rounding up to the length of the cache can ...
90
votes
4answers
36k views

I was tricked on Facebook into downloading an obfuscated script

I got a notification on Facebook: "(a friend of mine) mentioned you in a comment". However, when I clicked it, Firefox tried to download the following file: comment_24016875.jse This is an ...
0
votes
0answers
6 views

Can Data Flow Integrity prevent all memory errors from being exploited?

Memory errors can occur in basically every program. Since memory errors are pretty much unavoidable, I wonder what a program needs to be at least impossible to exploit. A lot of research focuses on ...
2
votes
1answer
72 views

Is it possible to encode a Flash exploit with msfencode?

I am using a Flash exploit from metasploit, exploit/multi/browser/adobe_flash_hacking_team_uaf. The Cisco FirePOWER services notice these signatures and drop the packets. I was wondering about the ...
39
votes
7answers
5k views

Exploiting MD5 vulnerability in this PHP form?

I've been practicing in security-related topics and I came upon this problem which I don't understand at all. You receive a form with one input named pass, and this is the code you need to bypass: &...
1
vote
1answer
55 views

What is the difference between vulnerability identification and exploitation?

Are strings like AND '1' = '2 and <script>alert('xss')</script> used to identify SQL injection and XSS vulnerability exploits? If so, when black-box testing a house made web application, ...
0
votes
1answer
161 views

How does the ERAD device gain access to your personal bank account?

I am trying to get specifics on how exactly this ERAD device is able to access and withdraw from personal bank accounts. http://www.dailykos.com/stories/2016/6/8/1536190/-Oklahoma-has-started-using-...
2
votes
1answer
81 views

Control flow integrity and data flow integrity

Many exploits nowadays can be prevented by control flow integrity (CFI). However, there are also data only exploits such as Heartbleed, read arbitrary data/keys which can be prevented by data flow ...
0
votes
0answers
33 views

Developing exploit with limited buffer space on Windows XP SP1

I am working on an exploit that has a very limited buffer space on Windows XP. DEP is disabled. The binary is a socket server that has a accepts commands, in one of those commands there is a stack ...
3
votes
2answers
179 views

Can't get a reverse shell on port 80

In a pentest, I have found a RFI and the endpoint looks like: https://xxx.com/file.php?page={localhost/evilcode.txt} Port 80 isn't open. 22,443 are only open ports Now, I am using php reverse ...
1
vote
2answers
70 views

OpenSSH DOS exploit proof of concept [closed]

For some research I'm looking for a working DOS exploit for OpenSSH. The OpenSSH version, vulnerable to the exploit is irrelevant. The only requirement that I have is, that the exploit should work for ...
5
votes
2answers
228 views

How can someone upload a PHP file to a server without an upload form?

I was entrusted with an existed website for which I should do some changes on the design part, but when I was about to access it, i've seen that it has been compromised. When I was searching for the ...
3
votes
1answer
139 views

Can a simple comment on WordPress harm my system (CVE-2016-4567)?

What risks are associated with the WordPress vulnerability CVE-2016-4567? Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in ...
8
votes
2answers
2k views

What does “exploit price” on vuldb.com means?

I was checking vuldb.com, and they state in one of the boxes: Top vulnerabilities with the highest current exploit price of the current month. The evaluation happens multiple times per day. ...
0
votes
1answer
51 views

ImageMagick < 6.9.3-9 - Multiple Vulnerabilities question [closed]

Do you know any contain management system or other applications that are affected by the recent ImageMagick exploits? (I have already played with convert tool which is offered on Linux)
-1
votes
2answers
153 views

What is going on with the FBI's mysterious 'Firefox exploit'? [closed]

Apparently, the FBI have the ability to 'hack TOR'. There was an operation against a pedophile website this year, to cut a long story short, the feds got the IP addresses of the denizens of the site ...
0
votes
0answers
18 views

PTRACE_TRACEME Process stopped

I'm trying for fun to exploit a code which uses ptrace to prevent debugging. This executable is suid, therefore thre's no use in cracking it. It have also the stack segment executable. It is made for ...
2
votes
3answers
156 views

How can I execute shell in this CTF exercise?

I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough. How can I: Make strcmp to be 0 (evaluate ...
1
vote
0answers
41 views

“Rollback process” for different penetration testing in case of something goes wrong? [closed]

In some extent, different kind of vulnerability assessment and penetration testing may impact on target system. I am looking for the solution/rollback process if something goes wrong during test. ...
2
votes
1answer
108 views

What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features: The file contained Swf.Exploit.CVE_2015_0323-1 It required android....
5
votes
1answer
59 views

Are Heap addresses randomized by ASLR?

I have been reading this article about an Internet Explorer exploit and I am a little confused about why the memory addresses effected by the heap-spray "work". The paper states that the attack uses ...
0
votes
0answers
49 views

How to create meterpreter session with multi/handler for WAN without LPORT, over VPN?

Actually, my router's WAN IP address is private so i cannot port forward. Is there any way to create metasploit's meterpreter session without specifying LPORT using VPN (i have hotspot shield ) or ...
1
vote
1answer
93 views

XSS works when I save generated HTML to file, but not directly in browser

The hints of XSS game's level2 say that Entering a tag on this level will not work. Try an element with a JavaScript attribute instead. When entering <script>alert(1)</script> ...
0
votes
0answers
46 views

Deciding on payload

I am new to penetration testing and I am trying to understand how to choose a payload and why. For example I set up 2 virtual machines 1 with Kali Linux and a Windows XP SP2. On a previous experience ...
0
votes
0answers
59 views

Why there is no shell prompt by exploiting this script?

I tried to get a shell prompt in the following vulnerable code, I think that I found the vulnerability, actually it is a simple stack buffer overflow, but now I have a problem with exploiting the ...
0
votes
2answers
102 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
1
vote
2answers
163 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
7
votes
0answers
198 views

Are shatter attacks still possible in the days of User Interface Privilege Isolation?

Before Windows introduced User Interface Privilege Isolation, any application could send all kinds of window messages to any window on the same desktop (a shatter attack), allowing elevation of ...
1
vote
1answer
149 views

How to detect a silent .pdf exploit without opening the file?

I have suspicions that a file is using a silent .pdf exploit. How can I confirm them without opening the file?
4
votes
1answer
91 views

Steps to recommend after people connect Android devices to questionable open WiFi access points

What are the appropriate steps to recommend for people to take after they connect their Android device to questionable open WiFi access points? When I say "people", I mean friends and colleagues. I ...
22
votes
3answers
4k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
1
vote
1answer
32 views

What can an attacker do with an exploited program?

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? Would it be able to only change data in Internet Explorer, could it modify anything on ...
0
votes
1answer
79 views

return-to-libc can't get the system function address

I'm trying to exploit my own code, just to learn how the "return-to-libc" technique works. I'm following a tutorial which basically says that to use this, I must find the address of the function I ...