The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

3
votes
1answer
75 views

Can you exploit an Internet IP adress just like a LAN IP address?

Is exploiting an Internet IP address as simple as exploiting a LAN IP address? i.e.: Scan that IP for vulnerabilities and open ports using tools like nmap or nikto Use a vulnerability and set the ...
2
votes
2answers
53 views

Is a precompiled Java program affected by Java vulnerabilities?

We know that Oracle publishes Java updates due to vulnerabilities / security issues and therefore we should make sure that we have installed the latest version of Java. Now there exist programs like ...
0
votes
0answers
24 views

How can the CVE-2008-5100 vulnerability be exploited [on hold]

I cant get the way to exploit or understand this vulnerability CVE-2008-5100 Retrieved x-aspnet-version header: 2.0.50727 need to know the specific way
-3
votes
1answer
75 views

Why are discovered vulnerabilities of suspicious/illegal online software published? [on hold]

For example, the Tor network has recently been hit by a reveal of a major exploit in a research paper. Isn’t publishing the details on the exploits completely counter-productive as the developers of ...
5
votes
2answers
78 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to ...
4
votes
1answer
148 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
-3
votes
0answers
38 views

Proof of Concept file for a trial work around

I found a work around in the trial system of a piece of software. What should I include in the Proof of Concept file assuming that the trial system can be exploited just by changing a string within a ...
3
votes
1answer
66 views

“Memory Sinkhole” attack and virtual machines?

Recently a design flaw in some Intel X86 processors was revealed at Blackhat. The flaw enables malicious code to gain access to SMM. The flaw can be exploited by an attacker with administrator ...
-2
votes
1answer
89 views

How to check if your phone got hacked [closed]

Since the Stagefright exploit is very common on many devices I wanted to ask if there is any way to check if someone has used this exploit on a given device. Like check the processes for unknown ...
2
votes
2answers
75 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
2
votes
1answer
234 views

Why Skype discloses my IP address to anybody? [closed]

Apparently there is a Skype exploit that allows people to obtain your IP address through your Skype username if you're online. The problem has existed since 2012. There exists countless websites which ...
0
votes
0answers
4 views

Perl doesn't print 0x00 [migrated]

I wanted to experiment with the NOP SLED technique. I got the sled and the shellcode into an environment variable and I got its address. So i wanted to execute the vulnerable program and as an ...
7
votes
3answers
152 views

MSFConsole/Kali Linux - gain root access to unix system

I am messing around with Kali Linux, MSFConsole and DVWA (Damn Vulnerable Web Application). I have successfully been able to get into the system (Raspberry Pi) by creating a PHP backdoor and uploaded ...
-3
votes
2answers
185 views

Does Microsoft EMET protect against latest Hacking Team Adobe Flash 0-day exploit?

If I were to not update Adobe Flash and instead used the old version (from before the Hacking Team 0-day exploit was published in the internet), in that case, would Microsoft EMET protect me from the ...
6
votes
2answers
45 views

Is using separate stacks for return addresses and function arguments a viable security measure?

As far as I know, many exploits rely on overwriting return address of the function they try to exploit. They do it by buffer overruns. But what if the compiler set up two separate stacks far from each ...
0
votes
0answers
16 views

Is there any risk in allowing clients to be fed opengl shaders?

I'm working on a project that may eventually involve server specified fragment and vertex shaders. What are the possible risks of allowing a third party to send fragment/vertex shaders and execute ...
2
votes
2answers
135 views

Is this exploit on household appliances really as bad as it sounds?

CNN article link. The article claims that a household appliance can be hacked by reprogramming the circuits inside of it to release electromagnetic waves that could release system information, but ...
8
votes
2answers
443 views

Is allowing unfiltered curl request from a website a vulnerability?

Recently I was on a website which provided some non-sense feature: Enter a URL Press enter HTML source of a given URL is displayed It basically fetched a URL and just dumped the contents of it. ...
2
votes
0answers
25 views

How to analyse a suspicious Encapsulated Postscript file?

How can you analyze an encapsulated PostScript file that has a standard header, but is way too big? There is a EPS file which has a size of 1.8MB. When it is reconverted to EPS, the resulting file is ...
2
votes
1answer
75 views

Simple exploit leads to wrong EIP and EBP

I have a simple program: void bug(char *arg1) { char name[128]; strcpy(name, arg1); printf("Hello %s\n", name); } int main(int argc, char **argv) { if (argc < 2) { ...
4
votes
4answers
135 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
5
votes
2answers
90 views

Is it possible to encode bytes in an buffer overflow exploit that bypass string functions?

Disclaimer: this exploit is purely for educational use. In this exploit I play the role of the victim and the software exploited is written by me alone. I have a simple HTTP server that I want to ...
2
votes
0answers
70 views

Using .apk files to reverse_tcp and exploit on android? [closed]

I have been able to install and run the application that I plan on exploiting. Once the app is running I am able to exploit the application. In my testing environment I am able to do this just fine. ...
4
votes
1answer
121 views

gray hat hacking 4th edition question

Example Using find.c Using find.c as an example, how would this manual source code auditing process work? We need to start with user data entering the program. As seen in the preceding ITS4 output, a ...
3
votes
0answers
48 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
33
votes
5answers
3k views

Can malicious code trigger without the user executing or opening the file?

If a file is downloaded from the Internet, and saved on disk, but is not opened by a user (if we keep autorun off), are there any chances that malicious code (e.g. a virus) in the file could trigger? ...
0
votes
0answers
37 views

Unable to execute shellcode in stack with no DEP

Here is the simplest example to show my problem. Everything is in WinXp sp3 with DEP disabled. char f() { // shellcode starting with some NOPs, char shellcode[400]= { 0x90, 0x90, ...
3
votes
3answers
109 views

Browser as Honey-Pot, is there?

I'm watching all this movement around Metasploit project, the great number of different exploitation plugins, and thousands of exploit packs. Now, it is real truth, anyone could configure his own ...
0
votes
1answer
50 views

What kinds of attacks can VLAN's mitigate? [closed]

Assuming these very basic kinds of attacks: Header based Protocol based Authentication based Traffic based What would using a VLAN mitigate? Several people seem to be overthinking the question. ...
1
vote
2answers
55 views

Trusted vulnerability database source [closed]

Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product ...
3
votes
1answer
140 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
1
vote
0answers
59 views

How to notify Adobe about a software issue

Recently, I stumbled upon a way to reset the software trial of any product under the adobe suite. It's as simple as changing some attributes within a few files. I'm assuming that it can be deemed an ...
0
votes
0answers
36 views

Passing arrays to a function call (Bufer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
3
votes
2answers
154 views

Why are Adobe Flash exploits found so often? [closed]

Over the last couple of years Adobe Flash published bug fixes for (zero-day) exploits so often, that the installation is already annoying. But why are exploits so often found in this particular ...
1
vote
0answers
78 views

Metasploit new exploits failed [closed]

Why can't I use new exploits like exploit/multi/browser/adobe_flash_nellymoser_bof ? I tried to access it, but I can't even find it in MSF search Adobe or Flash or anything like this. What should I ...
1
vote
3answers
214 views

Why not fix Android root exploit? [closed]

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
9
votes
3answers
620 views

Can an attacker “simulate” a private IP address?

I have a SSH server with a rule that does not allow password connections outside the local network. So people already on the local network, either physically or via VPN, are allowed to connect with ...
3
votes
2answers
81 views

How to sanitize archive files?

I am looking for a way to make sure that a particular archive file does not contain any sort of malicious code. From time to time new vulnerabilities pop up (e.g. gzip, 7zip) so I though a good idea ...
2
votes
2answers
70 views

How to overwrite ebp on stack alignment?

I want to exploit a simple program #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buf[128]; strcpy(buf, argv[1]); return 0; } The disassembly ...
0
votes
1answer
98 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?
5
votes
2answers
191 views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
2
votes
0answers
77 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
3
votes
2answers
170 views

Attack vector, attack surface, vulnerability, exploit: Where is the difference?

I have difficulties to pinpoint the difference between attack vector / attack surface / vulnerability and exploit. I think the difference between a vulnerability and an exploit is the following: A ...
3
votes
1answer
71 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
5
votes
1answer
871 views

What is the “Moose” worm and how can I protect myself from it?

I have heard from others that there is a new worm called "moose". This actively targets and exploits home routers. What are the effects of this exploit? How can I protect myself from this? Can I ...
2
votes
0answers
102 views

MySQL BACKRONYM (CVE-2015-3152) only affects MySQL client?

I read the CVE-2015-3152 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152) named BACKRONYM (http://backronym.fail/), and what I understood (ELI5 style) was the following: Attacker ...
1
vote
1answer
86 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
0
votes
1answer
102 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
6
votes
2answers
534 views

How does getting a remote shell via exploiting a vulnerability really work?

I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
-1
votes
1answer
167 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...