The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

0
votes
1answer
19 views

What is the difference between XSS and Cross Site Flashing? [duplicate]

I want to know the basic differences between XSS and XSF
-1
votes
1answer
46 views

Running javascript when there is error on the script?

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
1
vote
0answers
32 views

Am I safe to see a thumbnail of a downloaded images on Ubuntu 14.04?

I have downloaded an image that someone has uploaded to my website with a public upload form. My intention was to copy the file in a virtual machine and see the image from there; unfortunately, on ...
3
votes
2answers
66 views

Is there any danger in allowing users to host PDF/RTF/DOC files on my web server?

If I were to allow users to host arbitrary PDF/RTF/DOC files on my server all under the same name, but with different query strings would there be anything to worry about? I've heard of PDF/RTF ...
30
votes
9answers
4k views

Why is it a security problem not to update one's browser?

Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update? As part of this question, I would like to ...
-1
votes
1answer
55 views

Why should I use ROP for exploit dev? [closed]

Return Oriented Programming is a technique for bypassing DEP which based on ret2libc.. ROP is used for formatting the API function parameters in order to make a reliable shellcode.. I dont get ...
2
votes
4answers
93 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
0
votes
1answer
62 views

Are shell scripts / bash inherently less secure than other (script) languages such as python?

Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts? Or are shell scripts / bash less advisable for some tasks such as parsing ...
18
votes
1answer
435 views

EICAR Virus Test maliciously used to delete logs?

Today at work I was asked to test our anti-virus software on our Linux servers. I attempted to create a text file containing the EICAR Virus Test signature. The file was deleted instantly, ...
0
votes
1answer
173 views

Which shell is more secure, mksh or bash?

Which shell is more secure, mksh or bash? There has been some discussion pointing into the direction, that mksh is more secure. How to come to that conclusion? By looking which code was more audited ...
0
votes
1answer
125 views

Add third party exploit to metasploit under kali linux 1.0.6

I want to add custom exploits in metasploit running inside kali linux system version 1.0.6. I start using this methode : cd /root/.msf4 cd modules mkdir -p exploits/windows/browser mv ...
1
vote
0answers
47 views

Shared clipboard on Linux without keylogging, etc. vulnerabilities?

X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using ...
2
votes
4answers
181 views

BadUSB exploit - can it be prevented?

Over the past weeks I have become a fan of this stackexchange and started to get interested in computer security. First of all a big thank-you to all of you guys, I learned a lot from reading tons of ...
2
votes
4answers
194 views

How should I defend against zero-day attack on SSH?

Vulnerabilities are discovered everyday. The recent Heart bleed attack caught many people off guard. I was wondering if a serious flaw was to be discovered that allows unfettered access to SSH, how ...
2
votes
1answer
141 views

is computrace a permanent backdoor?

I was reading about CompuTrace and this thing is pretty much a backdoor and irremovable. It's in the firmware, in the BIOS and survives formatting and even hard drive change and OS reinstalls. Some ...
1
vote
1answer
136 views

How do you stop a hacker with no IP and a dot for their HOST

The entry below is from the visitors log in c-panel Host: . /specific legimate-wordpress-post/ Http Code: 503 Date: Jul 24 09:28:06 Http Version: HTTP/1.1 Size in Bytes: 1118 Referer: ...
1
vote
2answers
102 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
0
votes
0answers
114 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...
3
votes
1answer
380 views

How can the OpenSSL CCS Injection vulnerability (CVE-2014-0224) be exploited?

Just curious how this one works in practice and if it's as much of a risk as has been made out? It says you actively require a MiTM scenario, which is understandable, but then what are the steps to ...
5
votes
3answers
264 views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
5
votes
0answers
30 views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation” [duplicate]

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
2
votes
2answers
112 views

How do I make a working example of a “Dangling Pointers” exploit? (or where do I find it online)

I was recently reading about buffer overflows and dangling pointers. I read "Smashing the stack for fun and Profit " by Aleph1 and that paper was really clear and concise in explaination. On the ...
0
votes
1answer
91 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
0
votes
1answer
61 views

Is API hooking done by a process in a shared page, visible to all other processes?

Assume, I have an executable which hooks the API CreateFileW located in Kernel32.dll which is shared globally across the system for all other processes. From hooking I mean, that I have overwritten ...
-2
votes
1answer
73 views

Proccess to exploit an OS vulnerability [closed]

What are the steps to use an exploit on an OS vulnerability? I tried the popular ms08-067 on an XP machine, following a guide found on the internet, discovering Metasploit etc., but I can't figure ...
0
votes
2answers
56 views

What type of probing sends GET /“ data ” to a server?

During monitoring of webserver logs I've stumbled upon those standard probings for wordpress exploits etc, like No route found for "GET /wp-login.php" (uncaught exception) No route found for "GET ...
1
vote
3answers
85 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
1
vote
2answers
179 views

Is it illegal to publish an exploit against a known vulnerability in US?

Is it illegal to publish an exploit against a known vulnerability in US? The exploit could be published in one's blog or places like exploit-DB. It seems that in countries like Germany and France such ...
2
votes
2answers
1k views

Is OpenSSL CCS Injection (CVE-2014-0224) critical?

Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. It allows man-in-the-middle attackers to consequently hijack sessions ...
1
vote
4answers
254 views

How do exploits and payloads work together?

I knew about the metasploit framework since a few good years ago, but I never really got into it. I have some knowledge when it comes to networks, but I am not a PRO. I've tested some things with ...
0
votes
3answers
117 views

Practicing pentesting locally

After watching videos and downloading just about every possible pen-testing tool out there to play around with and learn. How do you setup test beds and practice scenarios to crack? With RE people ...
1
vote
2answers
116 views

Heap spray against 64-bit processes - possible?

Are heap spray exploits possible, if the process we're attacking is a 64-bit process? Naively, it seems like the 64-bit address makes it difficult to mount a heap spray: to fill all (or a significant ...
30
votes
3answers
11k views

How do you stop a hacker when their IP address is 0.0.0.0?

Wordfence reports the following visitor: An unknown location at IP 0.0.0.0 visited 4 hours 45 mins ago IP: 0.0.0.0 Browser: Baiduspider version 2.0 Mozilla/5.0 (compatible; Baiduspider/2.0; ...
5
votes
1answer
125 views

Information disclosure attack, using a heap overflow

A typical strategy for defeating ASLR is to find both a buffer overflow bug and an information disclosure bug. But when attacking servers that are automatically restarted whenever they crash/die, is ...
1
vote
1answer
147 views

Metasploit generating strange shellcode

So I just used metasploit to generate the payload/linux/x86/shell_bind_tcp payload without null bytes (generate -t raw -b '\x00' -f shellcode). Here's the shellcode: $ xxd -p shellcode ...
1
vote
1answer
126 views

Exploiting Writeable SNMP

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches). I'm aware of the ...
0
votes
1answer
54 views

3 byte address of system call and exit call

i am trying to exploit a buffer overflow vulnerability in ubuntu (kernel version 3.0.0-12 generic i686) by using the method return to libc and the stack is not exploiting ? By while exploiting i ...
0
votes
1answer
43 views

8 extra bytes in stack

i am new to buffer overflow and learning from securitytube.net website but in 7th video i got stucked Buffer Overflow Primer Part 7 (Exploiting A Program Demo) In this when the value of egg is passed ...
2
votes
3answers
186 views

Memory Corruption in C/C++

I'm doing a study on Memory Corruption. I need to compile a list of all the exploitable memory corruption issues that have been recognized till date and provide a sample vulnerable code for it. I ...
0
votes
0answers
86 views

exploiting buffer overflow

when i download a copy of vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload) it works. but when i made a same type of vulnerable program in c i am ...
0
votes
2answers
211 views

Is possible to exploit C#, Java, Python or any language that is running inside VM (i.e. managed runtime)

Is it possible to exploit a vulnerable application that is running inside a process virtual machine? Let's say that we have buffer overflow vulnerability in a Java application but the JVM isn't ...
0
votes
1answer
86 views

How is a process forced to execute binary code?

I want to understand how a vulnerable internet facing process on some computer is exploited to run arbitrary binary code. I understand how buffer overflows could be used to overwrite the return ...
1
vote
1answer
294 views

DNS settings compromised from WAN on Edimax ADSL router

My home network Edimax AR-7084gB ADSL modem/router with firmware verison 2.9.5.0(RUE0.C2A)3.5.18.0 was exploited from WAN few days ago. The attacker changed DNS server settings - primary server to ...
2
votes
3answers
289 views

How dangerous is the security hole CVE-2014-019?

There is a security hole CVE-2014-019 in the Linux kernel since 2.6.31-rc3 which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges How ...
3
votes
1answer
106 views

How does binary code execution vulnerability work on a modern OS?

In a modern OS I think that: the .text section where binary assembled CPU instructions are stored cannot be modified the .data/.bss section is marked as no-execute so that the information there will ...
2
votes
1answer
67 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b ...
4
votes
2answers
212 views

What happens if my ISP gives me an IP address that's already being used [closed]

Like the title says, what happens if my ISP gives my connection (by accident/on purpose) a public IP address that someone else is currently using to browse the web or send an email or pay his bills? ...
76
votes
7answers
9k views

Why do I hear about so many Java insecurities? Are other languages more secure?

I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
1
vote
0answers
34 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
1
vote
1answer
128 views

compromising DVRs to become bitcoin mining bot [duplicate]

I read this article, about an exploit which highjacks a DVR to become a "bitcoin mining bot". The heart of the attack is to send a binary using just echo comands to the device, which acts as a ...