The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

0
votes
0answers
36 views

Is it appropriate to request a bounty for finding exploit on major site? [duplicate]

Long story short, I found an easily reproducible, very easy, and honestly embarrassing exploit on a major (yes, major) financial institution's online banking site today. It's not directly tied to ...
19
votes
4answers
3k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
2
votes
1answer
72 views

Run fuzzer on any service or process in Linux

I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
3
votes
1answer
728 views

USB OTG DMA Attack vector, any information about that?

In that paper: http://www.delaat.net/rp/2011-2012/p14/report.pdf[1] is reported that USB OTG can be used to have direct DMA memory access and as a consequence have access to all the content of the ...
90
votes
7answers
15k views

Why do I hear about so many Java insecurities? Are other languages more secure?

I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
3
votes
2answers
132 views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: ...
3
votes
3answers
108 views

How dangerous is the remote Jeep Cherokee attack?

Recently two researchers working with a Wired Magazine reporter have demonstrated a serious vulnerability in UConnect, the software that powers the onboard entertainment systems of all Chrysler group ...
1
vote
2answers
189 views

Good book about general methods of exploit [closed]

I suppose that a lot of users hate this type of 'noob' questions, but I really eager to become a Cyber Security specialist and I need a little advice. As for now I'm learning Networking/Routing ...
4
votes
1answer
106 views

Never heard of compiler vulnerabilities when compiling?

Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code. ...
0
votes
0answers
54 views

Is sharing with Direct Connect DC++ secure?

As I have some useful software that I want to share with friends and I don't like to get involved with torrents, DC++ (P2P client for sharing and chatting) seems a good way to do it, but I'm not sure ...
1
vote
2answers
32 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
1
vote
0answers
62 views

Where can I find live browser exploits to test my sandbox? [closed]

I've just built a custom sandbox, and I'm happy with the way it processes samples that I upload directly. Now I'd like to work on "drive-by" browser exploits, but I'm not sure how to go about testing ...
3
votes
2answers
204 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in java when I noticed a strange thing.......... On Compiling the program My antivirus detected it as trojan and deleted the jar file....... Further it is not ...
0
votes
1answer
191 views

Openvas - exploiting result

I am an IT administrator and I try at present to secure my network. I have made an analysis of safety with OpenVAS on one computer, and I have difficulty exploiting the result : Vulnerability ...
3
votes
4answers
3k views

What's a good fuzzing framework for fuzzing a local standalone application?

I have been looking for guides and tutorials about how to fuzz and so far everything I have seen has been for web servers. If I wanted to fuzz something along the lines of calc.exe or a program that ...
1
vote
0answers
121 views

Converting Metasploit module to standalone Python script [closed]

How easy is to convert Ruby code to Python code and to change Metasploit module into standalone Python script for Linux?
0
votes
3answers
165 views

How can i prevent my phone from spying through sms

Recently while reading up a article over here ,The following were the summary : hacking suite dubbed Smurf Suite, it can hack any mobile by sending an encrypted text message So based on the ...
1
vote
2answers
262 views

Meterpreter and staged payloads

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions A staged ...
1
vote
1answer
67 views

Privilege escalation from exploit

What is the connection between an exploit to the point of privelage escalation and opening a reverse shell? I understand certain parts of the process but not how they are tied together. E.g. If a ...
1
vote
1answer
75 views

(Theoretically) intercepting GCHQ's smartphone exploit

In the lastest Snowden interview, it was revealed that GCHQ used an exploit sent via SMS to gain access to smartphones, and that this 'exploit' goes unnoticed to the handset user. I was wondering if ...
3
votes
1answer
36 views

Systematic exploitation of software components [closed]

My question is rather generic. People are likely to downvote the question and admins will be tempted to close it at off-topic etc. But, I couldn't help myself asking the question to seek some fruitful ...
2
votes
1answer
101 views

Can MITMf exploit SSL CCS vulnerability (CVE-2014-0224)?

I just wonder if MITMf (https://github.com/byt3bl33d3r/MITMf) can be used to exploit the 2014 early CCS bug, or is there a tool out there which can (preferably open source, so I will be able to ...
3
votes
1answer
51 views

What harm can this bug in base32 implementation cause?

There is a bug in Base32 implementation in Apache Commons Codecs: Example, there is no byte array value that can be encoded into the string "C5CYMIHWQUUZMKUGZHGEOSJSQDE4L===", but the existing ...
2
votes
1answer
168 views

Why is this version of OpenSSL (1.0.1e) not vulnerable to Heartbleed?

I recently ran into a requirement that needed a web server set up with SSL, to show that its possible to extract the private key from a server with a vulnerable version of OpenSSL (Heartbleed). Hence, ...
3
votes
0answers
188 views

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I ...
2
votes
0answers
442 views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
4
votes
1answer
102 views

Building a project on ARM Cortex-M, anything I can do to keep IP secure? Dealing with Chinese knockoffs and sick of it

Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still. There are sites ...
12
votes
3answers
215 views

As a student, how do I safely and responsibly disclose a serious security issue in a school environment?

I am a student at my local school. About eight months ago, I stumbled upon a security hole that could allow any user to discover any student's ID in the entire district, and I am aware that the IT ...
0
votes
2answers
134 views

Malicious favicon icon?

Is it possible for a favicon icon to be malicious so that you get the virus by just looking at the icon in the search results of a search engine like DuckDuckGo that displays the favicon icons for all ...
3
votes
1answer
68 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
41
votes
5answers
11k views

Accidentally came across the source code for some malware, what to do?

I accidentally, the other day, went to a dodgy site, and today I discovered that in my cache there lay a text file. And after reading the contents of the file, I have deduced that it is the source ...
3
votes
2answers
249 views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...
1
vote
3answers
130 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: ...
0
votes
0answers
32 views

Disguising as another computer using SMB Relay?

I've got a server that constantly checks for the existence of certain parameters on every PC in the web using SMB, if it fails to find those parameters it marks it as a rogue PC. I've understood that ...
3
votes
1answer
289 views

Can you exploit an Internet IP adress just like a LAN IP address?

Is exploiting an Internet IP address as simple as exploiting a LAN IP address? i.e.: Scan that IP for vulnerabilities and open ports using tools like nmap or nikto Use a vulnerability and set the ...
2
votes
2answers
92 views

Is a precompiled Java program affected by Java vulnerabilities?

We know that Oracle publishes Java updates due to vulnerabilities / security issues and therefore we should make sure that we have installed the latest version of Java. Now there exist programs like ...
-3
votes
1answer
93 views

Why are discovered vulnerabilities of suspicious/illegal online software published? [closed]

For example, the Tor network has recently been hit by a reveal of a major exploit in a research paper. Isn’t publishing the details on the exploits completely counter-productive as the developers of ...
5
votes
2answers
97 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to ...
4
votes
1answer
347 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
-2
votes
1answer
154 views

How to check if your phone got hacked [closed]

Since the Stagefright exploit is very common on many devices I wanted to ask if there is any way to check if someone has used this exploit on a given device. Like check the processes for unknown ...
4
votes
1answer
171 views

Bash Shellshock

I am trying to find out if my devices are vulnerable to bash shellshock. I have run the commands found on https://shellshocker.net. It seems my devices are both susceptible to only one of the ...
3
votes
2answers
123 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
1
vote
1answer
333 views

Why Skype discloses my IP address to anybody? [closed]

Apparently there is a Skype exploit that allows people to obtain your IP address through your Skype username if you're online. The problem has existed since 2012. There exists countless websites which ...
-3
votes
2answers
364 views

Does Microsoft EMET protect against latest Hacking Team Adobe Flash 0-day exploit?

If I were to not update Adobe Flash and instead used the old version (from before the Hacking Team 0-day exploit was published in the internet), in that case, would Microsoft EMET protect me from the ...
8
votes
2answers
91 views

Is using separate stacks for return addresses and function arguments a viable security measure?

As far as I know, many exploits rely on overwriting return address of the function they try to exploit. They do it by buffer overruns. But what if the compiler set up two separate stacks far from each ...
0
votes
0answers
24 views

Is there any risk in allowing clients to be fed opengl shaders?

I'm working on a project that may eventually involve server specified fragment and vertex shaders. What are the possible risks of allowing a third party to send fragment/vertex shaders and execute ...
1
vote
2answers
143 views

Is this exploit on household appliances really as bad as it sounds?

CNN article link. The article claims that a household appliance can be hacked by reprogramming the circuits inside of it to release electromagnetic waves that could release system information, but ...
9
votes
2answers
579 views

Is allowing unfiltered curl request from a website a vulnerability?

Recently I was on a website which provided some non-sense feature: Enter a URL Press enter HTML source of a given URL is displayed It basically fetched a URL and just dumped the contents of it. ...
3
votes
0answers
57 views

How to analyse a suspicious Encapsulated Postscript file?

How can you analyze an encapsulated PostScript file that has a standard header, but is way too big? There is a EPS file which has a size of 1.8MB. When it is reconverted to EPS, the resulting file is ...
2
votes
1answer
88 views

Simple exploit leads to wrong EIP and EBP

I have a simple program: void bug(char *arg1) { char name[128]; strcpy(name, arg1); printf("Hello %s\n", name); } int main(int argc, char **argv) { if (argc < 2) { ...