The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.
3
votes
2answers
195 views
What exploit types do I need to protect against in PHP?
I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
4
votes
3answers
144 views
Risk Control - Ignored risks and accepted risks
Some say that ignored risks as part of an organization's behavior are much worse than accepted risks.
I would like to test that axiom (in the eyes of some).
When I am handling a risk and I choose to ...
6
votes
2answers
176 views
Example of malware in the wild?
I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
5
votes
1answer
148 views
Hardware enforced DEP on different CPUs
Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)?
Are there any significant differences how hardware DEP works on x86 ...
2
votes
2answers
369 views
Stack Overflow on ARM : Null Bytes Issue
I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link
For the simple stack overflow exploitation, the code is :
#include <stdio.h>
#include <string.h>
...
2
votes
2answers
268 views
How was pentest performed in the era with no frameworks like Metasploit?
I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
0
votes
1answer
95 views
Manually monitoring your PC for Java (Oracle) exploits?
Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
0
votes
1answer
226 views
apache mod_isapi public exploits
In public apache mod_isapi exploits, they ask for dlls, and I am unsure what I should put in dll.
I am having a hard time understanding exploits.. How does all of dlls connect to manipulating ...
3
votes
1answer
169 views
How did the Tumblr worm spread?
Recently Tumblr was hit by a fast-spreading worm.
How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
9
votes
4answers
222 views
What to do about companies that refuse to fix their security vulnerabilities
While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform ...
0
votes
1answer
112 views
Can TLS Compression be enabled on 3rd party CDN sites that have no authentication?
In this answer, @Thomas Pornin talks about remediating the CRIME attack and says:
(It is a shame to have to remove SSL compression, because it is very
useful to lower bandwidth requirements, ...
4
votes
2answers
77 views
Using format string to control the flow of a process?
I was cleaning up some code today on the advice of someone I know, and was made aware of the potential for a hacker to gain control over the flow of the process using format strings, particularly the ...
1
vote
2answers
2k views
Find the hack in the Apache2 logs?
The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss).
So I looked in the Apache2 logs and ...
11
votes
2answers
317 views
Where to report malicious URLs, phishing, and malicious web sites?
I recently discovered that my web designer was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked.
Check this ...
5
votes
5answers
2k views
What kind of attacks against home router's NAT do exist?
I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
4
votes
3answers
612 views
Are there any tools that focus on shellcode analysis?
Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
2
votes
1answer
163 views
solaris equivalent of /proc/self/environ LFI
I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it.
Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
0
votes
0answers
278 views
Exploit Double free() Vulnerability PoC [closed]
I don't understand about this bug very much
This is something that I know about this bug
If use free() with freed pointer it can trigged this bug
Need to have at least 2 pointer with allocate memory
...
7
votes
4answers
346 views
How should I escalate a vulnerability that is dismissed by the vendor?
I've come across a vulnerability that secure@microsoft does not think is worth pursuing.
I would estimate that there are many, many customers affected by this issue.
I do not want to start a ...
7
votes
3answers
752 views
How does BeEF work? (working understanding)
I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
1
vote
1answer
251 views
Shellcode for higher file privileges
I'm learning exploits from the book Hacking: The Art of Exploitation. The shellcode below was written to enable higher privilege access to files.
\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80
...
1
vote
1answer
55 views
sigsegv in php5.3.10
I found an overflow situation in php5.3.10.
Probably it's not 'something new', but if I can understand this,
it will help me to find this kind of bug faster in the future.
What can I do to check ...
8
votes
3answers
693 views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
1
vote
1answer
182 views
SafeSEH and x64
I read here that
/SAFESEH is only valid when linking for x86 targets. /SAFESEH is not
supported for platforms that already have the exception handlers
noted. For example, on x64 and Itanium, ...
1
vote
3answers
692 views
How to exploit DRUPAL-SA-CORE-2012-003
I have read the security notices and understand that it "would allow an attacker to reinstall an existing Drupal site with an external database server and then execute custom PHP code". According to ...
8
votes
4answers
571 views
Nessus Scan Port ID mapped to Metasploit Vulnerability exploits
My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities?
My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
3
votes
1answer
134 views
Stack canaries protection and ROP
As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return.
My question is: if I overwrite both EIP and stack ...
4
votes
1answer
277 views
Need help on understanding obfuscated code in CVE-2012-4969 exploit
As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code.
Is it necessary to use obfuscation ...
2
votes
2answers
692 views
How to hack linux via Local File Inclusion vulnerability?
During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB.
I tried to exploit the ...
3
votes
2answers
221 views
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
9
votes
2answers
886 views
How “leaking pointers” to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This ...
2
votes
1answer
133 views
amd64 safer than 686-pae?
Apart from stronger ALSR entropy...
Is a system using amd64 any safer than 686-pae?
What are the advantages, if any?
4
votes
3answers
325 views
What are methods for preventing browser hooking / drive-by downloads?
This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this.
With the advent of BeEF and more and more of the computers in networks being infected just by ...
3
votes
3answers
279 views
Can malware on my computer infect my phone?
Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this?
Relevance: Some banks use two-factor ...
3
votes
2answers
118 views
Taking action for exploit attempts
Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
4
votes
2answers
693 views
How to get this to buffer overflow?
I'm trying to understand buffer overflow, and am working with a simple piece of code, as below.
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *str)
{
...
1
vote
2answers
185 views
DVWA vulnerability list or guide?
Is there a list of vulnerabilities for DVWA, I cannot seem to find a vulnerability list or guide.
By guide I mean an exhaustive list of vulnerabilities to work through.
1
vote
2answers
937 views
SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? [closed]
Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that ...
2
votes
3answers
420 views
Are there known hacks or security problems on broadband USB dongles?
USB broadband dongles seem to be common everywhere now though I'm not sure what the most widely accepted name for them is. In case I'm using poor terminology I'm referring to USB sticks which contain ...
0
votes
1answer
262 views
Windows exploits that still work? [closed]
I was reading how exploits usually work and how they have been used in the past etc etc.
I wanted to know, if there are still some exploits that can work with minimal user allowed access?
For ...
7
votes
2answers
202 views
How a malware executes remote payload
Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
3
votes
1answer
251 views
In the light of recent information about RarVM, can we still trust RAR files?
See:
http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html
https://github.com/taviso/rarvmtools
It would seem according to these two sources that rar files can contain custom ...
2
votes
1answer
92 views
Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?
There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
4
votes
2answers
209 views
Does anyone know about how LinkedIn was compromised?
I know some super basic stuff about website security (e.g. using HTTPS, escaping user input), but hearing about high profile sites getting compromised makes me wonder in what way they were broken ...
1
vote
2answers
107 views
What's the right way to prevent shell bounce back?
When an exploit was successfully executed, is there a way to block the user from bouncing back a shell?
I would like to know about this on both Windows and Linux machines.
1
vote
1answer
397 views
NGINX / HTTP TRACE
I have a http server Nginx with HTTP TRACE Enabled.
A single nmap --script=http-methods.nse host.name give this result :
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
[...]
...
1
vote
3answers
148 views
Java class type parameter vulnerability
In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
2
votes
1answer
146 views
How to achieve interactive shell attack?
Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell.
So when I call FTP interactive client, shell fails.
Is there any way I can do ...
-4
votes
1answer
314 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
147
votes
3answers
32k views
CRIME - How to beat the BEAST successor?
With the advent of CRIME, BEASTs successor, what is possible protection is available for an individual and / or system owner in order to protect themselves and their users against this new attack on ...
