The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

2
votes
3answers
113 views

How can I execute shell in this CTF exercise?

I am playing a CTF wargame and unfortunatley got stuck at this level, so I want to "crowdsource" it. No need for complete answer, but hints would be enough. How can I: Make strcmp to be 0 (evaluate ...
1
vote
1answer
47 views

What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features: The file contained Swf.Exploit.CVE_2015_0323-1 It required ...
1
vote
0answers
36 views

“Rollback process” for different penetration testing in case of something goes wrong?

In some extent, different kind of vulnerability assessment and penetration testing may impact on target system. I am looking for the solution/rollback process if something goes wrong during test. ...
5
votes
1answer
40 views

Are Heap addresses randomized by ASLR?

I have been reading this article about an Internet Explorer exploit and I am a little confused about why the memory addresses effected by the heap-spray "work". The paper states that the attack uses ...
0
votes
0answers
24 views

How to create meterpreter session with multi/handler for WAN without LPORT, over VPN?

Actually, my router's WAN IP address is private so i cannot port forward. Is there any way to create metasploit's meterpreter session without specifying LPORT using VPN (i have hotspot shield ) or ...
1
vote
1answer
74 views

XSS works when I save generated HTML to file, but not directly in browser

The hints of XSS game's level2 say that Entering a tag on this level will not work. Try an element with a JavaScript attribute instead. When entering <script>alert(1)</script> ...
1
vote
2answers
152 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
0
votes
0answers
40 views

Deciding on payload

I am new to penetration testing and I am trying to understand how to choose a payload and why. For example I set up 2 virtual machines 1 with Kali Linux and a Windows XP SP2. On a previous experience ...
0
votes
0answers
29 views

Why there is no shell prompt by exploiting this script?

I tried to get a shell prompt in the following vulnerable code, I think that I found the vulnerability, actually it is a simple stack buffer overflow, but now I have a problem with exploiting the ...
0
votes
0answers
39 views

How to put specific hex characters in terminal to exploit the script [migrated]

I try to exploit a simple vulnerability in the following code, but I'm not successful, because I can't put the specific characters in the terminal by hand. For e.g. if the application read a character ...
0
votes
2answers
64 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
4
votes
0answers
89 views

Are shatter attacks still possible in the days of User Interface Privilege Isolation?

Before Windows introduced User Interface Privilege Isolation, any application could send all kinds of window messages to any window on the same desktop (a shatter attack), allowing elevation of ...
7
votes
2answers
282 views

Example of malware in the wild?

I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
4
votes
2answers
81 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
2
votes
3answers
224 views

Install a vulnerable service for Windows 7

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell. I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
1
vote
1answer
95 views

How to detect a silent .pdf exploit without opening the file?

I have suspicions that a file is using a silent .pdf exploit. How can I confirm them without opening the file?
9
votes
1answer
2k views

iPhone 5/6 RAM security

I'm interested in how the RAM can be exploited in iPhone 5+, iOS 8+. I've previously discussed general iPhone encryption and from the response it reads: There are many exploits over the years ...
4
votes
1answer
79 views

Steps to recommend after people connect Android devices to questionable open WiFi access points

What are the appropriate steps to recommend for people to take after they connect their Android device to questionable open WiFi access points? When I say "people", I mean friends and colleagues. I ...
22
votes
3answers
4k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
0
votes
1answer
45 views

return-to-libc can't get the system function address

I'm trying to exploit my own code, just to learn how the "return-to-libc" technique works. I'm following a tutorial which basically says that to use this, I must find the address of the function I ...
1
vote
1answer
30 views

What can an attacker do with an exploited program?

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? Would it be able to only change data in Internet Explorer, could it modify anything on ...
13
votes
4answers
9k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
8
votes
2answers
119 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
1
vote
0answers
93 views

SS7 exploit on the wiretapping part

Wondering if there are info/source code/guide on the SS7 wiretapping part (SMS interception). I had a look on the track any mobile by a German researcher, and on PTsecurity about how the structure ...
5
votes
2answers
96 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
2
votes
1answer
28 views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
4
votes
1answer
68 views

Unable to overwrite EIP register

Source code for both programs at the end of the post So, I've working through Hacking: The Art Of Exploitation, and so far so good. I've managed to control EIP in the vulnerable program notesearch.c. ...
0
votes
1answer
84 views

Unauthorized credit card payment

I have a debit card which links to my savings account in a let's call it Bank A. I had never used it for online purchases/transactions (not even interbank transfer). After a while, I purchased virtual ...
1
vote
0answers
55 views

How to remotely upload a file on linux and windows (without netcat or ssh)

With meterpreter from metasploit, there is an option (windows or linux victim) to upload files on the victim device. I searched in the metasploit-framework in order to find the script that does the ...
1
vote
3answers
148 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
8
votes
3answers
973 views

Is a HTML form tag more exploitable than a HTML link in user submitted content?

I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application. The editor component I have used automatically removes any script ...
7
votes
3answers
140 views

I anonymously submitted a security vulnerability, but it was not resolved. What now?

This is more or less a continuation of my previous question: As a student, how do I safely and responsibly disclose a serious security issue in a school environment? More than four months on after I ...
8
votes
1answer
165 views

Bluetooth vulnerabilities for Internet of Things demo

For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it ...
-1
votes
3answers
55 views

What is the future of exploitations? [closed]

With the advent of "Safe" languages like Rust, the prevalence of Software Correctness, and improved type checking in existing systems, memory based exploits are very hard if not possible at all, to ...
-1
votes
1answer
61 views

Does it make sense to restrict the usage of Metasploit in Penetration testing exams ? [closed]

In some PT exams (mainly Offensive Security's) they restrict the usage of Metasploit or any automated attacking tool and allow only for manually written\compiled codes from public exploit sites such ...
2
votes
0answers
33 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
6
votes
2answers
1k views

Exploiting Writeable SNMP

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches). I'm aware of the ...
3
votes
1answer
75 views

ROP chain on x64, get rid of nulls

So I have this ROP chain for x64 architecture: 0x0000000000400b60: pop rdi; ret; 0x482cf5 0x68732f6e69622f ('/bin/sh') 0x401550 <system> In Payload: ...
6
votes
1answer
115 views

Shared clipboard on Linux without keylogging, etc. vulnerabilities?

X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using ...
2
votes
0answers
53 views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
16
votes
2answers
2k views

Could you write custom data to a file of a specific extension and use it to hack a program once it opens the file?

From what I understand file extensions don't really affect the data contained within them at all. They just give your computer a hint of what the data is, how it's structured and your computer then ...
2
votes
0answers
142 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
0
votes
1answer
30 views

What do the [-], [+], [!] line prefixes mean in exploit outputs?

When you're using exploits, in the output, every line is prefixed with a symbol inside a set of square brackets. For example: [+] Set arguments. [-] Running exploit. [!] Warning server returned 404. ...
3
votes
1answer
476 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
-3
votes
1answer
139 views

With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? [closed]

So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs ...
0
votes
1answer
1k views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
3
votes
2answers
86 views

Is it possible to crack g++ rand()?

So, I have this: I know that some code was used to generate a random sequence, and it looked roughly like this: #include <iostream> #include <string> int main() { const std::string ...
2
votes
2answers
103 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
111
votes
9answers
128k views

Can webcams be turned on without the indicator light?

I've made a series of penetration tests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a stealth thing, but what ...
0
votes
1answer
47 views

Malicious tracking script being served from google server to circumvent block lists

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit. Thing is, its stored on a google server in a directory it really shouldnt be. ...