The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

-1
votes
0answers
16 views

Port explotation of servers [on hold]

I'm voluntary scanning a website, not for money, but just for testing and learning. I decided that now I'll be looking for more complex vulnerabilities than just XSS and SQLi. So, I started scanning ...
-2
votes
0answers
38 views

How to become an admin? [on hold]

I have tried to resolve a pwn task in a ctf since three days !! but i didn't get the idea to do it . as a hint , the description said that i must be an admin to read the flag, the host id is ...
2
votes
2answers
53 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
0
votes
2answers
40 views

Need some help on Wordpress issue

When I am accessing my Wordpress website, for example: https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php it's returning a page containing zero. Is ...
3
votes
1answer
61 views

return-to-libc attack

I was trying to attempt at return-to-libc buffer overflow attack for my Computer Software Security assignment. As far as my understanding goes, we can do these kind of attacks regardless of stack ...
0
votes
2answers
116 views

Computer Security vs Privacy

Probably this is a redundent post but in fact I have been searching online about a precise clear distinction between computer security and privacy. I'd like to know the difference of between them ...
0
votes
1answer
27 views

Exploit by overwriting relative address?

I see a lot of exploits overwrite an absolute address to gain code execution. I wonder if there are vulnerabilities which offer the possibility to overwrite relative addresses. Can you imagine a ...
4
votes
3answers
135 views

How often do high-end attackers actually use zero-day exploits?

Earlier this week the head of the NSA's Tailored Access Operations unit rather remarkably gave a presentation at the USENIX Enigma security conference. (News coverege here and here; video of the talk ...
3
votes
2answers
50 views

metasploit exploits and payloads documentation

Where can i found the documentation of the exploits and payloads available in metasploit. I am looking for a documentation that tells what does the exploit or the payload do, and possibly a ...
5
votes
2answers
177 views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
3
votes
1answer
532 views

Is my server vulnerable to a perl exploit?

I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable. Firstly, the following seems to fail, receiving a 404 response: ...
4
votes
0answers
55 views

Bluetooth vulnerabilities for Internet of Things demo

For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it ...
0
votes
0answers
25 views

Encode metasploit

Using metasploit I generated an exploit exploit/windows/fileformat/ms14_017_rtf for windows 7 with windows/shell_reverse_tcp payload. In show advanced, I use option EnableContextEncoding true and it's ...
1
vote
0answers
21 views

How to exploit a stack-overflow without setting -mpreferred-stack-boundary=2

I have been playing with some wargames and I ported some of then on my Linux machine as well. I noticed that when not using -mpreferred-stack-boundary=2, gcc might compile "main" with an interesting ...
1
vote
0answers
78 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
4
votes
2answers
172 views

Preventing unvalidated redirects and forwards

Suppose you have a redirect page where the client is redirected to a URL from the query string: http://victim/redirect.aspx?url=http://evil/ You really need to be able to redirect to a another page ...
2
votes
0answers
38 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
4
votes
3answers
235 views

Ysoserial and Jenkins commons collection exploit - what can you do?

I have read about the Jenkins exploit of the Commons Collections vulnerability. I've tested this (legitimately) on a system, but I'm not very good at this, so I can't seem to achieve much. What is the ...
1
vote
0answers
52 views

Exploit Development Road-map [closed]

this days i am trying some exploit development practices, i already learned assembly, c, python, immunity debugger, corelan articles, pentester academy exploit development, now i can bypass DEP, ASLR, ...
1
vote
1answer
57 views

Controlling where a program crashes

I'm missing a part of the process for preparing a payload for an overflow exploit. To crash a program using an overflow vulnerability, lets say the heap. How can we control the memory address it ...
3
votes
2answers
117 views

Javascript injection in email address as username?

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that ...
3
votes
4answers
120 views

Simple tools for searching process memory for MSSQL connection strings

I'm working with a piece of software that handles all permissions in a Windows client binary on the user's computer. The software connects to a backend database using the sa account. The sa password ...
1
vote
1answer
57 views

Any ways to exploit PHP through an echo'd parameter?

I was wondering, lets say we have a page like this. <?php if(isset($_GET['example'])){ echo $_GET['example']; } Would there be any way to exploit this page into doing something such as executing ...
0
votes
0answers
45 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
-1
votes
1answer
39 views

ROP: Use return value of function

Is it possible to call a function and store its return value in the next stack frame? So: call foo(); // int foo(); store return value of foo in next stack frame; call bar(int);
7
votes
0answers
219 views

iPhone 5/6 RAM security

I'm interested in how the RAM can be exploited in iPhone 5+, iOS 8+. I've previously discussed general iPhone encryption and from the response it reads: There are many exploits over the years ...
0
votes
1answer
87 views

What attacks or exploits are possible when MAC address, IP, and Port of a WiFi access point are known? [closed]

I just accepted a position at a small firm and was testing the previous WiFi setup for flaws and exploits that were possible. We have two AP's for business and guest connections, everything checks out ...
5
votes
2answers
95 views

Is it possible become root through a broken symlink owned by root and globally writeable?

I'm looking for a vulnerability on a server. I'm looking in the /var directory and I get something like this: drwxr-xr-x 3 root root 4.0K Aug 14 21:02 kerberos drwxr-xr-x 12 root root 4.0K Nov 11 ...
3
votes
1answer
148 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
2
votes
4answers
2k views

Can CVE-2015-4852 be exploited against WebLogic servers after a load balancer?

I have Java applications served by Oracle WebLogic servers that are after a load balancer. The WebLogic t3 protocol (vulnerable) is not tunneled to the WebLogic servers, only the HTTP requests. In ...
-1
votes
1answer
80 views

how to execute /bin/sh at stdout

Below is objdump output of a C program (source code at bottom of this post) where I am doing buffer overflow to overwrite the group offset table (GOT) entry: -$ objdump -R ./vuln ./vuln: file ...
1
vote
3answers
125 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
1
vote
3answers
308 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
1
vote
1answer
65 views

how to circumvent ASLR without pointer leaks

is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to ...
1
vote
0answers
62 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
0
votes
0answers
36 views

Is it appropriate to request a bounty for finding exploit on major site? [duplicate]

Long story short, I found an easily reproducible, very easy, and honestly embarrassing exploit on a major (yes, major) financial institution's online banking site today. It's not directly tied to ...
2
votes
1answer
72 views

Run fuzzer on any service or process in Linux

I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
3
votes
3answers
111 views

How dangerous is the remote Jeep Cherokee attack?

Recently two researchers working with a Wired Magazine reporter have demonstrated a serious vulnerability in UConnect, the software that powers the onboard entertainment systems of all Chrysler group ...
3
votes
2answers
141 views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: ...
1
vote
2answers
190 views

Good book about general methods of exploit [closed]

I suppose that a lot of users hate this type of 'noob' questions, but I really eager to become a Cyber Security specialist and I need a little advice. As for now I'm learning Networking/Routing ...
0
votes
0answers
54 views

Is sharing with Direct Connect DC++ secure?

As I have some useful software that I want to share with friends and I don't like to get involved with torrents, DC++ (P2P client for sharing and chatting) seems a good way to do it, but I'm not sure ...
1
vote
2answers
32 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
1
vote
0answers
62 views

Where can I find live browser exploits to test my sandbox? [closed]

I've just built a custom sandbox, and I'm happy with the way it processes samples that I upload directly. Now I'd like to work on "drive-by" browser exploits, but I'm not sure how to go about testing ...
4
votes
1answer
107 views

Never heard of compiler vulnerabilities when compiling?

Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code. ...
3
votes
2answers
209 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in java when I noticed a strange thing.......... On Compiling the program My antivirus detected it as trojan and deleted the jar file....... Further it is not ...
0
votes
1answer
204 views

Openvas - exploiting result

I am an IT administrator and I try at present to secure my network. I have made an analysis of safety with OpenVAS on one computer, and I have difficulty exploiting the result : Vulnerability ...
1
vote
0answers
124 views

Converting Metasploit module to standalone Python script [closed]

How easy is to convert Ruby code to Python code and to change Metasploit module into standalone Python script for Linux?
1
vote
1answer
67 views

Privilege escalation from exploit

What is the connection between an exploit to the point of privelage escalation and opening a reverse shell? I understand certain parts of the process but not how they are tied together. E.g. If a ...
0
votes
3answers
167 views

How can i prevent my phone from spying through sms

Recently while reading up a article over here ,The following were the summary : hacking suite dubbed Smurf Suite, it can hack any mobile by sending an encrypted text message So based on the ...
1
vote
1answer
78 views

(Theoretically) intercepting GCHQ's smartphone exploit

In the lastest Snowden interview, it was revealed that GCHQ used an exploit sent via SMS to gain access to smartphones, and that this 'exploit' goes unnoticed to the handset user. I was wondering if ...