The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

-3
votes
0answers
22 views

Can BitTorrent be exploited? With the help of Immunity debugger or other methods? [on hold]

I need help in this question for my college project. Please help I just need the code for exploiting bittorrent.
1
vote
0answers
19 views

How to disable Symbolic link creation option to users in cPanel server? [on hold]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
5
votes
2answers
244 views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
0
votes
0answers
27 views

Can a subprocess launched from a parent executable access the memory of its parent? [migrated]

Given a system() call with user controlled input, is it possible to read the virtual memory of the parent program? Assume that the system call is made with dropped privileges, and that running ...
0
votes
2answers
50 views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
1
vote
2answers
62 views

Questions regarding Bad USB exploit

I own a Netbook and my external DVD Drive is possibly infected with Bad USB. If i install Ubuntu using this infected DVD drive could my system be taken over during installation process or later when ...
0
votes
1answer
64 views

Java desktop app vs web service [closed]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
1
vote
2answers
51 views

Meterpreter and staged payloads

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions A staged ...
5
votes
1answer
65 views

Return oriented programming without int 0x80

I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location. However, this region does not ...
4
votes
2answers
53 views

Are there methods for determining the exploitability of bugs, after a crash is found in fuzzing?

I have found this, https://msdn.microsoft.com/en-us/magazine/cc163311.aspx It says that only "a full root-cause analysis can ensure that you have correctly diagnosed whether a given crash is ...
2
votes
1answer
70 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
1
vote
0answers
33 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
1
vote
0answers
17 views

Possible exploit while MPLS parsing with Bottom of Stack bit

My current task to parse MPLS label in a packet and store them in to a list. When I check packets with MPLS: One can understand it is the last MPLS header by checking Bottom of Stack bit. If ...
12
votes
9answers
4k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...
2
votes
1answer
68 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
1
vote
0answers
54 views

Bash Shellshock

I am trying to find out if my devices are vulnerable to bash shellshock. I have run the commands found on https://shellshocker.net. It seems my devices are both susceptible to only one of the ...
1
vote
1answer
73 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
8
votes
3answers
590 views

Evading IDS in exploit development

In the context of buffer overflow exploit development, I was asked: Discuss how your exploit may be modified to evade an Intrusion Detection System. I'm not asking for my homework to be done, but ...
2
votes
2answers
51 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character on realtime so when i input the following code: <input onclick=alert(document.cookie)> there ...
2
votes
1answer
83 views

Resources to learn about Windows systems exploitation [closed]

I'm a beginner in penetration testing, and I'm struggling with finding decent material to learn. I used book about nmap, Metasploit, exploit writing etc..., but they contained too much information ...
-2
votes
1answer
93 views

Possible Injection to PHP PDO

Expert says that PDO is one of secure scripting from mysql injection. I have read the manual about it and do some little research. And here, I'm trying to get ID value from URL paramater, as in: ...
4
votes
1answer
81 views

Realistic: Exploiting a computer on BIOS/ hardware level in less than an hour? (Infinite preparation time)

I wonder how hard it it to infect a laptop or netbook in 60 minutes or less in a way the victim cannot easily clean their machine by wiping hard disk drives. Let's assume the following: The ...
13
votes
3answers
372 views

remote desktop connection to a potentially compromised machine

I am using rdesktop client on Linux to connect to windows machines. If some of these machines were compromised by some evil malware/virus/worm/trojan, is there any way for the malware to "jump" to my ...
1
vote
5answers
98 views

How to analyze spam email URLs to detect exploits?

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside ...
2
votes
1answer
92 views

SMB/CIFS shares on HP-UX vulnerabilities

So, I've run an unauthenticated Nessus scan against a critical piece of infrastructure as part of a pen-test but I'm getting back some weird stuff and i can't seem to re-create the issue to ...
1
vote
1answer
45 views

Are Sun/Oracle's SPARC processors invulnerable to buffer overrun exploits?

We all use Intel architectures these days, in small part because Oracle has totally dropped the ball regarding SPARC CPU development. But with so many now saying that protection against viruses is ...
14
votes
7answers
788 views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
1
vote
2answers
125 views

How do I prevent tampering with form submission data, and changing the details for any account?

Although this is something that only employees can use, I'd like to prevent the tampering anyway. I don't like insecure code, and this is hideously insecure. Here's an example link: <a href="#' + ...
4
votes
1answer
177 views

How did GamerFood hack the Starcraft IEM Taipei Tournament? [closed]

During the recently completed professional Starcraft tournament, Intel Extreme Masters (IEM) Taipei 2015, the notorious cheat software company Team Gamer Food hacked the cast somehow. How did they do ...
-1
votes
1answer
131 views

Hack to change the webpage of a website? [closed]

Recently, there is a website by Malaysia Airline got hacked and their main page has been defaced, below is a link to that article ...
0
votes
1answer
57 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
4
votes
2answers
113 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
1
vote
3answers
96 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
0
votes
1answer
71 views

Are firefox bugs cross platform? [duplicate]

I use Ubuntu and last firefox version. I opened an image with firefox, and a crash occurred. Let's assume it's a crafted jpg to run an exploit, and execute arbitrary code. To sum up: (1) Firefox ...
1
vote
0answers
52 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
9
votes
2answers
161 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
1
vote
2answers
84 views

Reasonable source of old proof-of-concept attacks

I am relatively new to the area of cyber security but have a reasonable knowledge of several programming languages, assembly (x86 in particular) and scripting. In light of the recent Shellshock and ...
0
votes
1answer
28 views

Getting a DEP exception when trying to call SetProcessDEPException(false)

I'm demonstrating an exploit for an old app. On Windows XP SP3 32bit (EN), the address of SetProcessDEPPolicy() is usually 0x7C8622A4. I have that version of Windows (in English as well) and I've ...
2
votes
0answers
83 views

Case Studies of high profile hacks [closed]

Every hack happens because of a form of security vulnerability or another, and I feel that the best way to avoid/fix these vulnerabilities is to learn about them. Is there anywhere on the internet ...
1
vote
1answer
99 views

Printf inject 0x00

When performing a format string exploit, how do you inject an address that contains 0x00? #include<stdio.h> int main(int argc,char *argv[]) { char buf[80]; snprintf(buf, 79, argv[1]); ...
0
votes
2answers
61 views

Web/App vulnerability responsibility [closed]

While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development ...
1
vote
0answers
65 views

SET tool autopwn website type penetration [closed]

I tried to hack my second computer and phone in my local network. I am not very experienced so instead of picking the particular options and payloads i just pressed autopwn to use them all instantly. ...
10
votes
5answers
264 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
2
votes
3answers
153 views

Parallel systems, in case any of two has known exploits

As software becomes more and more complex it's harder and harder to keep it secure down the entire line. Discussing this problem with a friend we were opting some pretty extreme solutions and wondered ...
1
vote
2answers
563 views

MS08_067 with Metasploit [closed]

I'm learning how to use Metasploit. I'm using VirtualBox to run a VM with Kali Linux (192.168.56.101) and another with Windows XP SP1 (192.168.56.103). The two VMs can ping each other and Windows ...
0
votes
0answers
23 views

Execute form environmental variable while stack is not executable

Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG; I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this ...
2
votes
2answers
104 views

How does infection through web surfing work?

Often I read about compromise due to visit a malicious site which download some exploit to your computer. I've never seen a detailed process, all books/tutorials I read just say sentences like "once ...
0
votes
2answers
102 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
0
votes
2answers
139 views

Bad USB and other Exploits of USB Devices

Can every USB device and most of the chips in other hardware be reprogrammed like it works with the Bad USB hack to inject malware into the operating system? For example i got a DVD burner that i ...
4
votes
2answers
107 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...