I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
As I was reading about the advanced exploits such as Return Oriented Programming (ROP), Retun-to-libc, etc., I came across many defenses to these attacks including techniques like ASLR, kBouncer, ROP ...
I am somewhat confused in terms of how secure Android OS is and how updates work on Android. Are there security fixes on each release? How can I keep track for Android exploits and what are the most ...
This question was derived from my off-topic questioning here: Does Centralisation Decrease the Probability but Increase the Damage of Exploits? Like before, I suspect this may be overly abstract as a ...
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user. My question is this: I can create application that is guaranteed to be run by the ...
It is often shown that non-executable data segemnts are possible to bypass through return-to-libc attacks. It's evident on /bin/sh but is it also possible to invoke a remote shell?
Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of ...
In computer security, my areas of interest include x86 processors, binary exploitation and reverse engineering. I'm also interested in the certain aspects of the minix and the linux kernel(memory ...
Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?