The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

3
votes
5answers
415 views

Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?

This is a multi-part question.... In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better? ...
7
votes
4answers
671 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
12
votes
3answers
1k views

Bypassing Address Space Layout Randomization

How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
8
votes
6answers
545 views

Doing a demo about open wireless networks exploiting with Firesheep

A collegue and I have been asked to do a demo where we show off stealing Facebook sessions with Firesheep. I've never used Firesheep before myself, but I reckon it should be a simple task. I know the ...
3
votes
5answers
2k views

What programming language does this code use?

Watching this article: http://www.exploit-db.com/exploits/13474/ I can see this: /* * NetBSD * execve() of /bin/sh by humble of Rhino9 */ char shellcode[] = "\xeb\x23" "\x5e" "\x8d\x1e" ...
7
votes
3answers
716 views

Remote return into libc attack

It is often shown that non-executable data segemnts are possible to bypass through return-to-libc attacks. It's evident on /bin/sh but is it also possible to invoke a remote shell?
2
votes
3answers
452 views

Security Implications of setting passwd as suid

When the passwd command is executed, it runs as the root user. Can't this be exploited? If not, why?
3
votes
1answer
124 views

How can one gain additional privileges from being able to read kernel memory?

Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of ...
3
votes
1answer
597 views

Two questions about learning Linux exploit development fundamentals

getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information. First, I plan on reading "Understanding the Linux ...
5
votes
1answer
101 views

Modeling vectors of an unknown exploit

Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an ...
6
votes
3answers
225 views

Spamming exploits without user detection

So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
3
votes
2answers
653 views

Found some malicious Javascript - how did it get there?

Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're ...
5
votes
1answer
211 views

xml library vulnerabilities, regarding post-exploitation

there was some arbitrary code execution that occurred on my os x 10.5 system. this came as a result of opening an xls file with excel for mac. the vnc type program that came with office for mac was ...
2
votes
1answer
161 views

Can a bad guy be judged for gaining access to sensitive information?

Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
4
votes
2answers
3k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
12
votes
3answers
620 views

How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?

There are several commercial exploit kits available containing 0day vulnerabilities: White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml Agora Exploit Pack ...
13
votes
5answers
592 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
3
votes
2answers
3k views

Is it possible to change the admin user/password remotely on a router without logging in?

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
10
votes
2answers
829 views

Why is Firesheep Unable to Session Hijack over SSL?

Why is Firesheep unable to session hijack when a user is using SSL?