The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

2
votes
1answer
8k views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
12
votes
6answers
1k views

Can a website determine what OS or webbrowser a visitor is using if the useragent is blanked/changed?

Assume that a visitor to a website has changed his useragent to something like the following, but he's using linux: Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0 Assume that the ...
4
votes
1answer
177 views

Storing product keys on same server as shop?

Situation: An e-commerce system (specifically: PrestaShop) which is used to sell virtual products (specifically: product license keys). To accelerate order processing, a cronjob is supposed to be ...
1
vote
2answers
1k views

How does the stack cookie protect return address from being overwrite [duplicate]

/GS compiler option Micorsoft developed added an extra cookie before the return address and before returning the cookie is checked, if it is intact then return address is safe why ever would ...
4
votes
1answer
336 views

What are the major vulns that affect the Dalvik VM of Android?

I frequently hear about the security risks of using Android. But few people who write articles on this subject ever identify what parts of Android are at fault, nor do they identify design flaws. Can ...
-1
votes
2answers
1k views

How much are 0-days worth? [closed]

I got discussing this topic with someone recently and we couldn't reach a consensus so I thought I should ask here. There are commonly thrown around figures regarding the cost of buying a remotely-...
18
votes
1answer
2k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
0
votes
1answer
1k views

How do Java applet exploits work? [closed]

Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to? My understanding is that a ...
3
votes
3answers
1k views

What stops a hacker from installing it's own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, ...
3
votes
1answer
853 views

Is there a way to evade -Wformat-security?

I am trying to learn about format string bugs and I found the gcc option -Wformat-security to raise a warning when a potential format string bug is found. I would like to know if there is a way to ...
0
votes
1answer
796 views

Comprehensive & current book on native application exploit research & development [closed]

Is there a 'must read', comprenhensive book on native application exploit development? Covering the process of finding vulnerabilities (fuzzing, reverse engineering, code analysis, etc...) & ...
6
votes
8answers
4k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
0
votes
2answers
505 views

Transmitting malicious code over audio speakers

In a post that reads like science-fiction, a security researcher claims that malicious code was being passed between computers. A few quotes: ... "badBIOS," as Ruiu dubbed the malware, has the ...
1
vote
1answer
1k views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...
4
votes
2answers
1k views

Smashing the stack if it grows upwards

As we know that on most of the processor architectures, the stack grows downwards. Hence, memory exploits involving smashing of stack and buffer overflow and their explanation make sense. Just ...
1
vote
2answers
2k views

Disabling SMEP on x86_64

I have recently been doing some research into kernel exploitation on X86_64. A problem I have run into is that I have found Intel's SMEP to be killing my contrived example of a kernel NULL pointer ...
3
votes
1answer
129 views

What's malicious about file links?

Why did Chrome and Firefox disallow file:/// links? I can imagine an iframe opening a local resource, but which resource is the scary one? They could have just disabled iframes to file:///? Ajax ...
11
votes
1answer
844 views

Help in understanding an application's crash - exploitable?

Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
0
votes
1answer
2k views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
1
vote
2answers
387 views

Preventing exploits like ROP and Return-to-libc in modern Operating systems

As I was reading about the advanced exploits such as Return Oriented Programming (ROP), Retun-to-libc, etc., I came across many defenses to these attacks including techniques like ASLR, kBouncer, ROP ...
0
votes
2answers
901 views

Can I read/write canary values from %gs register?

I would like to know if it is possible to read (or write) the canary values from %gs register. If "yes", how; and if "no", why? Also, I have been reading somewhere that the canary values are stored ...
3
votes
1answer
1k views

Fuzzer causes crash. Now what?

Can anyone point me in the direction of some good tutorials regarding how to identify the type of vulnerability as reported by !exploitable and where to go from there? Essentially I've got myself a ...
3
votes
1answer
141 views

Exploiting memory corruption issues using a DLL file

I was listening to a talk on Return Oriented Exploitation from the Black Hat 2010 conference. The speaker mentioned something about using the DLLs to exploit some of the memory corruption issues. I ...
6
votes
2answers
425 views

Continuous Integration for Exploit Development

I have been thinking about this subject a lot. Exploit Development is nearly the same as normal development, you need to test quite a lot of platforms (eg. Windows XP, Windows Vista, x64, x86, Chinese,...
-1
votes
2answers
337 views

Android OS Security [closed]

I am somewhat confused in terms of how secure Android OS is and how updates work on Android. Are there security fixes on each release? How can I keep track for Android exploits and what are the most ...
2
votes
3answers
750 views

Insert string to memory with null character

I'm trying to implement return-to-libc, here's the code void func(const char *str) { char buf[4]; strcpy(buf,str); printf("you entered [%s]\n",buf); } int main(int argc, char *argv[]) { ...
242
votes
3answers
55k views

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
-6
votes
1answer
265 views

Reverse shell in gzip

I got a box I am trying to pop (boot and root) that has an upload form on its website for logged in users that will take a .gzip file and extract it to the users home directory on the server. I am ...
0
votes
1answer
256 views

Abusing write permission on Apache logs dir to escalete privileges

I have just come across this sentence on apache log files documentation: Anyone who can write to the directory where Apache is writing a log file can almost certainly gain access to the uid that ...
0
votes
2answers
1k views

Exploiting an Open Redirect in POST body?

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after ...
3
votes
2answers
436 views

Encoding an Address that contains a null byte in a payload

I am working on an SEH exploit. the problem I am facing here that all POP/POP/RETN addresses end with null bytes, so everything placed after it gets corrupted. Is it possible to use Metasploit ...
0
votes
1answer
184 views

What vulnerabilities does a malware exploit? [closed]

I have a malware sample. I want to know what vulnerabilities does it exploit (and of which software). I tried analyzing it in IDA Free and it seems that the code was developed in Visual C/C++ runtime. ...
6
votes
2answers
218 views

Security Researchers: How do you choose what services or software you are going to audit next?

Security Researchers: How do you choose what services or software you are going to audit next? I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
3
votes
4answers
805 views

Open exploits database, with structured data (CMS name, version, etc.)

For a web security app I'm working on, I want to list all the exploits that a certain Wordpress version have. (and hopefully the same for other CMSs) I found some (open) exploits databases that list ...
2
votes
1answer
1k views

How to find the pharmacy hack in a Joomla website?

We've discovered today that our Joomla website has been hacked by a pharmacy trojan. It was difficult to discover because most users don't see it when visiting our website. One user reported about 2 ...
0
votes
2answers
8k views

Windows user: Is having many active TCP connections normal?

Is this normal? Can any ports be "dangerous"? I have 9 tcp's in a listening state, 4 in a close_wait state, and 4 in an established state. Some of them route to odd procceses using PID such as ...
-4
votes
2answers
664 views

Is it possible to make a living selling exploits? [closed]

Is it possible to make a living (say $75k+ a year) finding and selling vulnerabilities? It doesn't matter (for the sake of this question) whether it means selling purely to a bug bounty program or ...
26
votes
6answers
7k views

Most secure way to partition linux?

I recently acquired a netbook to play with, and I want to install Kali Linux so I can start learning about network security and exploit development. I want to use this to learn as much about security ...
0
votes
1answer
3k views

Stack buffer overflow confusion

I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique. Reading some articles and watching videos brought me to a confusion which can be ...
45
votes
3answers
4k views

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var _0x352a=["\x31\x31\x34\x2E\x34\x35\x2E\x32\x31\x37\x2E\x33\x33\x2F\x76\x6C\x6B\x2E\x70\...
6
votes
2answers
974 views

buffer overflow attack scripts

I saw various different scripts for a buffer overflow attack. Many of the scripts include lines that look like this: char code[] = "\xdb\xd7\xd9\x74\x24\xf4\xb8\x79\xc4\x64\xb7\x33\xc9\xb1\x38" "\x5d\...
1
vote
1answer
145 views

Notification or report for security problem of unix systems? [duplicate]

I have unix systems(Solaris,Oracle,Redhat vs).I have to control all system for security problem,bugs,patch,vulnerabilities I'm looking for securty information for all security issue After that I'll ...
3
votes
1answer
391 views

Converting Negative Decimal to Hex

I came through a post on Offensive Security and while reading , the author stated that: At next SEH (when using a SE Handler address that starts with a null byte), we usually will put some code to ...
-8
votes
1answer
3k views

What are the vulnerabilities on port 23? [closed]

I'm working on a pen-testing project and still in the beginning but I faced a switch with only 80 & 23 ports opened. How can I use these ports to attack that switch ?
6
votes
2answers
185 views

How does sensitive information leak assist in exploit development?

According to this bug report, the first vulnerability can leak sensitive information. But since it doesn't mention what information to leak, I guess it would be the stack? And how could this help in ...
5
votes
2answers
2k views

possible exploits through avahi daemon

It is always recommended to disable Avahi daemon, for security reasons, when not in use. So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we ...
4
votes
1answer
216 views

Securing a Site: Diversity over Simplicity?

This question was derived from my off-topic questioning here: Does Centralisation Decrease the Probability but Increase the Damage of Exploits? Like before, I suspect this may be overly abstract as a ...
2
votes
3answers
468 views

Is + as an alternative to %20 an attack vector?

I was reading a Q&A on enabling + characters in URLs for Sitecore CMS, and the answer states: ASPNET application does not allow using “+” from the security point of view e.g. preventing SQL or ...
2
votes
1answer
4k views

How to check if your computer has a backdoor installed on it? [closed]

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM): I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking svchost....
7
votes
1answer
564 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...