11
votes
7answers
1k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
0
votes
2answers
138 views

Preventing exploits like ROP and Return-to-libc in modern Operating systems

As I was reading about the advanced exploits such as Return Oriented Programming (ROP), Retun-to-libc, etc., I came across many defenses to these attacks including techniques like ASLR, kBouncer, ROP ...
-1
votes
2answers
169 views

Android OS Security [closed]

I am somewhat confused in terms of how secure Android OS is and how updates work on Android. Are there security fixes on each release? How can I keep track for Android exploits and what are the most ...
4
votes
1answer
157 views

Securing a Site: Diversity over Simplicity?

This question was derived from my off-topic questioning here: Does Centralisation Decrease the Probability but Increase the Damage of Exploits? Like before, I suspect this may be overly abstract as a ...
3
votes
2answers
522 views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
7
votes
3answers
470 views

How to gain a shell?

I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user. My question is this: I can create application that is guaranteed to be run by the ...
6
votes
3answers
568 views

Remote return into libc attack

It is often shown that non-executable data segemnts are possible to bypass through return-to-libc attacks. It's evident on /bin/sh but is it also possible to invoke a remote shell?
3
votes
1answer
104 views

How can one gain additional privileges from being able to read kernel memory?

Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of ...
6
votes
5answers
1k views

Suggested reading list: OS exploits

In computer security, my areas of interest include x86 processors, binary exploitation and reverse engineering. I'm also interested in the certain aspects of the minix and the linux kernel(memory ...
12
votes
5answers
541 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
5
votes
8answers
2k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
22
votes
10answers
3k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?