The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

0
votes
1answer
18 views

Applocker Execution Prevention Bypass - Session parameter

I am still new to Metasploit and I am trying to explore the following module: 1- Module Name: exploit/windows/local/applocker_bypass I did: 1- use exploit/windows/local/applocker_bypass 2- set ...
7
votes
4answers
902 views

Where to publicly report a vulnerability, after developer ignores it? [duplicate]

If I've discovered a vulnerability, and disclosed it to the website/app's developer, how should I disclose it publicly? I gave the developer ample time to address the issue, as recommended by this. ...
0
votes
0answers
35 views

How to adapt my exploit strategy when “00” is part of the targeted return address and the victim uses strcpy

I intend to exploit the following program on an x86 Linux machine with NX enabled (ASLR and stack canary disabled). The goal is to get a shell. //vuln.c #include <stdio.h> #include <string....
0
votes
1answer
21 views

Offset in Stack

Offsets in buffer overflows I can't seem to get a grasp on. Here is a quote from the book I am reading about this topic. The address of the variable "i" in main()'s stack frame is used as a point ...
0
votes
0answers
15 views

Bypassing SafeSEH in application without unprotected modules

I'm trying to write an exploit for a vulnerable Win32 application, which has DEP, SafeSEH and stack cookies enabled. I can write anything to the stack, as there is buffer overflow vulnerability in an ...
0
votes
1answer
29 views

Metasploit INFILENAME

I am learning *MSF on Kali but I ran into a problem. I am trying a simple adobe_pdf_embedded_exe and when I set INFILENAME to something simple such as nutrition.pdf it cannot find the file, so ...
0
votes
1answer
76 views

Is a rootkit not an exploit?

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
0
votes
3answers
112 views

How a professional hacker would penetrate a computer in a network?

Which kinds of vulnerabilities or security holes a hacker would use to penetrate and take over a computer in a network, like a normal PC in a default network (Wireless-LAN). I often hear that the ...
0
votes
0answers
44 views

What is the Linux Kernel attack surface? [on hold]

What is the full Linux Kernel attack surface ? meaning what are the vectors through which untrusted or unprivileged access interacts with the Kernel. For instance, system calls are an attack vector, /...
9
votes
4answers
3k views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
1
vote
2answers
86 views

SQL injection to login when there's no record in the database

I have a question to solve. Well there's no records of username and password in the database and so one cannot Log in without inserting any records. Is there anyway to exploit the following code and ...
2
votes
1answer
81 views

Control flow integrity and data flow integrity

Many exploits nowadays can be prevented by control flow integrity (CFI). However, there are also data only exploits such as Heartbleed, read arbitrary data/keys which can be prevented by data flow ...
-3
votes
1answer
47 views

Which WYSIWYG editor has the best security reputation? [closed]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
2
votes
2answers
65 views

Is this integer overflow vulnerability exploitable?

Is this integer overflow exploitable and if the answer is yes, how can i exploit it? char buffer[20]; int len = atoi(argv[1]); if(len < 20) memcpy(buffer,argv[2],len); If I set len to -1 the ...
3
votes
1answer
110 views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
-1
votes
2answers
91 views

Are these queries vulnerable to injection in mysql

The queries below show SQL injection in appscans for MySQL. Is there a way to do a proof of concept or otherwise to how can they be exploited? INSERT INTO cscart_sessions (session_id, expiry) values('...
-1
votes
3answers
61 views

Why is netapi obsolete [closed]

Why is the ms08_067_netapi exploit obsolete? Are there alternatives to this exploit that can help me inject payloads to more recent version of windows?
0
votes
1answer
162 views

How does the ERAD device gain access to your personal bank account?

I am trying to get specifics on how exactly this ERAD device is able to access and withdraw from personal bank accounts. http://www.dailykos.com/stories/2016/6/8/1536190/-Oklahoma-has-started-using-...
1
vote
1answer
136 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
3
votes
2answers
91 views

What does EIP stand for?

There are a ton of questions on here that make reference to the eip: How can I partially overwrite the EIP in order to bypass ASLR? Unable to overwrite EIP register Do I always have to overwrite EIP ...
0
votes
1answer
76 views

Random persistent Gmail password requests from Google

I am trying to figure out something for my father in law. This persistent popup keeps interrupting anything anyone is doing on his desktop by requesting he put in his password. I told him not to. It ...
2
votes
1answer
216 views

How can non-secure or non-HTTP-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and HTTP-only and remaining 5 are neither. In this scenario, in what ways can we ...
4
votes
2answers
408 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in Java when I noticed a strange thing. On compiling the program my antivirus detected it as trojan and deleted the jar file. Further it is not allowing me ...
1
vote
1answer
76 views

Can you get a virus from sending a GET or POST request? [duplicate]

If I need to fix up my question in any way please let me know, this is my first question on the site So there's a game development website I use where you can develop with other people, and within ...
18
votes
3answers
1k views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
0
votes
1answer
452 views

Windows CTF/war games/reverse engineering/exploit challenges

War Games are fun but mainly deal with Linux reverse engineering. Example: http://blackbox.smashthestack.org:85/ Does anyone know of similar online games for Windows security?
-1
votes
2answers
47 views

Launching SQL injection in MD5 with mysqli_real_escape_string()?

Can we exploit the MD5() and mysqli_real_escape_string() methods in this case to perform SQL injection? Here is the code snippet: $pwd = mysqli_real_escape_string($conn,MD5($_POST['pwd'])); $login = ...
7
votes
0answers
199 views

Are shatter attacks still possible in the days of User Interface Privilege Isolation?

Before Windows introduced User Interface Privilege Isolation, any application could send all kinds of window messages to any window on the same desktop (a shatter attack), allowing elevation of ...
18
votes
3answers
10k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
4
votes
4answers
189 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
1
vote
1answer
147 views

Notification or report for security problem of unix systems? [duplicate]

I have Unix systems (Solaris, Oracle,.Redhat etc.). I have to control all systems for security problem,bugs,patch,vulnerabilities. I'm looking for security information for all security issues. After ...
7
votes
4answers
198 views

I anonymously submitted a security vulnerability, but it was not resolved. What now?

This is more or less a continuation of my previous question: As a student, how do I safely and responsibly disclose a serious security issue in a school environment? More than four months on after I ...
16
votes
2answers
2k views

Could you write custom data to a file of a specific extension and use it to hack a program once it opens the file?

From what I understand file extensions don't really affect the data contained within them at all. They just give your computer a hint of what the data is, how it's structured and your computer then ...
1
vote
1answer
43 views

How does the recent discovered PowerPoint exploit work?

One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files. But I do not understand how the rounding up to the length of the cache can ...
0
votes
1answer
81 views

return-to-libc can't get the system function address

I'm trying to exploit my own code, just to learn how the "return-to-libc" technique works. I'm following a tutorial which basically says that to use this, I must find the address of the function I ...
-2
votes
1answer
627 views

Can this code be expoited using Buffer Overflow?

I have a piece of code which contains an obvious buffer overflow at strcpy(buf, x) since it doesn't check if buf is large enough to fit the string x. I'm wondering how to actually exploit this bug. ...
0
votes
1answer
197 views

Exploiting buffer overflow

When I download a copy of a vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload), it works. However, when I made a same type of vulnerable program ...
90
votes
4answers
36k views

I was tricked on Facebook into downloading an obfuscated script

I got a notification on Facebook: "(a friend of mine) mentioned you in a comment". However, when I clicked it, Firefox tried to download the following file: comment_24016875.jse This is an ...
15
votes
7answers
3k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
7
votes
3answers
2k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the Nessus scanner and I found some high severity vulnerabilities that are related to HP System Management Homepage. The CVE-numbers are: CVE-2010-...
3
votes
2answers
383 views

How does binary code execution vulnerability work on a modern OS?

In a modern OS I think that: the .text section where binary assembled CPU instructions are stored cannot be modified the .data/.bss section is marked as no-execute so that the information there will ...
10
votes
3answers
11k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
0
votes
0answers
6 views

Can Data Flow Integrity prevent all memory errors from being exploited?

Memory errors can occur in basically every program. Since memory errors are pretty much unavoidable, I wonder what a program needs to be at least impossible to exploit. A lot of research focuses on ...
33
votes
5answers
20k views

Can a powered down cell phone be turned on remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion referenced a bug that could track/listen in on the subject "whether the phone was powered on or off," although that may have been ...
9
votes
1answer
2k views

iPhone 5/6 RAM security

I'm interested in how the RAM can be exploited in iPhone 5+, iOS 8+. I've previously discussed general iPhone encryption and from the response it reads: There are many exploits over the years ...
2
votes
1answer
72 views

Is it possible to encode a Flash exploit with msfencode?

I am using a Flash exploit from metasploit, exploit/multi/browser/adobe_flash_hacking_team_uaf. The Cisco FirePOWER services notice these signatures and drop the packets. I was wondering about the ...
39
votes
7answers
5k views

Exploiting MD5 vulnerability in this PHP form?

I've been practicing in security-related topics and I came upon this problem which I don't understand at all. You receive a form with one input named pass, and this is the code you need to bypass: &...
1
vote
1answer
55 views

What is the difference between vulnerability identification and exploitation?

Are strings like AND '1' = '2 and <script>alert('xss')</script> used to identify SQL injection and XSS vulnerability exploits? If so, when black-box testing a house made web application, ...
0
votes
0answers
33 views

Developing exploit with limited buffer space on Windows XP SP1

I am working on an exploit that has a very limited buffer space on Windows XP. DEP is disabled. The binary is a socket server that has a accepts commands, in one of those commands there is a stack ...
3
votes
2answers
192 views

Can't get a reverse shell on port 80

In a pentest, I have found a RFI and the endpoint looks like: https://xxx.com/file.php?page={localhost/evilcode.txt} Port 80 isn't open. 22,443 are only open ports Now, I am using php reverse ...