The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

3
votes
2answers
1k views

Reverse shell connections

Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice. Would not most servers restrict outgoing ...
5
votes
0answers
36 views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation” [duplicate]

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
3
votes
1answer
616 views

How can the OpenSSL CCS Injection vulnerability (CVE-2014-0224) be exploited?

Just curious how this one works in practice and if it's as much of a risk as has been made out? It says you actively require a MiTM scenario, which is understandable, but then what are the steps to ...
0
votes
0answers
122 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...
13
votes
1answer
1k views

Return-oriented programming: how to find a stack pivot

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
5
votes
3answers
360 views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
2
votes
2answers
141 views

How do I make a working example of a “Dangling Pointers” exploit? (or where do I find it online)

I was recently reading about buffer overflows and dangling pointers. I read "Smashing the stack for fun and Profit " by Aleph1 and that paper was really clear and concise in explaination. On the ...
-2
votes
1answer
81 views

Proccess to exploit an OS vulnerability [closed]

What are the steps to use an exploit on an OS vulnerability? I tried the popular ms08-067 on an XP machine, following a guide found on the internet, discovering Metasploit etc., but I can't figure ...
0
votes
1answer
72 views

Is API hooking done by a process in a shared page, visible to all other processes?

Assume, I have an executable which hooks the API CreateFileW located in Kernel32.dll which is shared globally across the system for all other processes. From hooking I mean, that I have overwritten ...
2
votes
2answers
326 views

I've found security vulnerability in current linux distribution. What next?

I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of ...
47
votes
7answers
5k views

Can “cat-ing” a file be a potential security risk?

I often use cat on the console to view the contents of files, and every now and then I accidentally cat a binary file which basically produces gibberish and system beeps. However today I've ...
0
votes
2answers
58 views

What type of probing sends GET /“ data ” to a server?

During monitoring of webserver logs I've stumbled upon those standard probings for wordpress exploits etc, like No route found for "GET /wp-login.php" (uncaught exception) No route found for "GET ...
0
votes
1answer
96 views

Fomat String vulnerability used to display data outside the function stack frame?

if we run the following code using the input "hi", the output will simply be "hi" main(int argc, char **argv) { char *secret = "This is a secret 1\n"; char *secret2 = "This is ...
1
vote
4answers
288 views

How do exploits and payloads work together?

I knew about the metasploit framework since a few good years ago, but I never really got into it. I have some knowledge when it comes to networks, but I am not a PRO. I've tested some things with ...
1
vote
2answers
203 views

Is it illegal to publish an exploit against a known vulnerability in US?

Is it illegal to publish an exploit against a known vulnerability in US? The exploit could be published in one's blog or places like exploit-DB. It seems that in countries like Germany and France such ...
1
vote
3answers
87 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
2
votes
3answers
306 views

How dangerous is the security hole CVE-2014-019?

There is a security hole CVE-2014-019 in the Linux kernel since 2.6.31-rc3 which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges How ...
0
votes
3answers
132 views

Practicing pentesting locally

After watching videos and downloading just about every possible pen-testing tool out there to play around with and learn. How do you setup test beds and practice scenarios to crack? With RE people ...
1
vote
1answer
328 views

Exploiting XP SP3 with local privilege escalation [closed]

I'm trying to exploit my virtual machine (windows xp sp3) by cve-2013-5065. I created exe from python script and ran on my virtual machine. It successfully spawned new shell but cmd.exe was not with ...
1
vote
2answers
132 views

Heap spray against 64-bit processes - possible?

Are heap spray exploits possible, if the process we're attacking is a 64-bit process? Naively, it seems like the 64-bit address makes it difficult to mount a heap spray: to fill all (or a significant ...
31
votes
7answers
2k views

Is there a difference between GET and POST for web application security?

I have 2 choices in sending data between 2 web applications. I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters. ...
31
votes
3answers
11k views

How do you stop a hacker when their IP address is 0.0.0.0?

Wordfence reports the following visitor: An unknown location at IP 0.0.0.0 visited 4 hours 45 mins ago IP: 0.0.0.0 Browser: Baiduspider version 2.0 Mozilla/5.0 (compatible; Baiduspider/2.0; ...
5
votes
1answer
144 views

Information disclosure attack, using a heap overflow

A typical strategy for defeating ASLR is to find both a buffer overflow bug and an information disclosure bug. But when attacking servers that are automatically restarted whenever they crash/die, is ...
76
votes
8answers
81k views

Can webcams be turned on without the indicator light?

I want to know how secure I am. I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a ...
3
votes
3answers
247 views

Memory Corruption in C/C++

I'm doing a study on Memory Corruption. I need to compile a list of all the exploitable memory corruption issues that have been recognized till date and provide a sample vulnerable code for it. I ...
1
vote
1answer
180 views

Metasploit generating strange shellcode

So I just used metasploit to generate the payload/linux/x86/shell_bind_tcp payload without null bytes (generate -t raw -b '\x00' -f shellcode). Here's the shellcode: $ xxd -p shellcode ...
1
vote
1answer
167 views

Exploiting Writeable SNMP

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches). I'm aware of the ...
0
votes
1answer
44 views

8 extra bytes in stack

i am new to buffer overflow and learning from securitytube.net website but in 7th video i got stucked Buffer Overflow Primer Part 7 (Exploiting A Program Demo) In this when the value of egg is passed ...
0
votes
1answer
104 views

Automatic exploit searches

How to automatically search and download exploits which matches for example with kernel release ? Is there for example a public REST web service which provide data in XML or JSON format to a client ...
0
votes
0answers
92 views

exploiting buffer overflow

when i download a copy of vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload) it works. but when i made a same type of vulnerable program in c i am ...
0
votes
2answers
261 views

Is possible to exploit C#, Java, Python or any language that is running inside VM (i.e. managed runtime)

Is it possible to exploit a vulnerable application that is running inside a process virtual machine? Let's say that we have buffer overflow vulnerability in a Java application but the JVM isn't ...
0
votes
1answer
92 views

How is a process forced to execute binary code?

I want to understand how a vulnerable internet facing process on some computer is exploited to run arbitrary binary code. I understand how buffer overflows could be used to overwrite the return ...
1
vote
1answer
347 views

DNS settings compromised from WAN on Edimax ADSL router

My home network Edimax AR-7084gB ADSL modem/router with firmware verison 2.9.5.0(RUE0.C2A)3.5.18.0 was exploited from WAN few days ago. The attacker changed DNS server settings - primary server to ...
3
votes
1answer
108 views

How does binary code execution vulnerability work on a modern OS?

In a modern OS I think that: the .text section where binary assembled CPU instructions are stored cannot be modified the .data/.bss section is marked as no-execute so that the information there will ...
2
votes
1answer
71 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b ...
4
votes
2answers
215 views

What happens if my ISP gives me an IP address that's already being used [closed]

Like the title says, what happens if my ISP gives my connection (by accident/on purpose) a public IP address that someone else is currently using to browse the web or send an email or pay his bills? ...
1
vote
0answers
36 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
0
votes
1answer
129 views

compromising DVRs to become bitcoin mining bot [duplicate]

I read this article, about an exploit which highjacks a DVR to become a "bitcoin mining bot". The heart of the attack is to send a binary using just echo comands to the device, which acts as a ...
2
votes
2answers
268 views

Specific security concerns with (now unupdatable) Win XP [duplicate]

I'm trying to quantify the exact risk I'm subjecting my PC to if leaving it with Windows XP as opposed to upgrading it to e.g. Windows 7, an upgrade that would be very time-costly in my case. I don't ...
-4
votes
2answers
142 views

What types of software vulnerabilities are out there? [closed]

I have search a lot in the internet and I didn't find anything that is directly answer my question. What type of vulnerabilities are out there. I mean vulnerabilities like buffer overrun, not like XSS ...
2
votes
1answer
61 views

Similar products to MS EMET [closed]

Following the weekend announcement from Microsoft regarding the vulnerability in IE I have been looking at additional security defences for our endpoints. I've read some technical documentation and ...
1
vote
1answer
92 views

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
11
votes
4answers
1k views

Are exploits platform dependent?

Looking over an overview of the newest published IE exploit, I noticed what I think is assembly. I don't know anything about exploit development, but I know a little about assembly. Seeing that ...
6
votes
2answers
255 views

Zero-Day Exploit targeting Internet Explorer Versions 9 through 11

Few days ago, FireEye has found a vulnerability, which affects all versions of IE (even the latest 11). Microsoft has official statement regarding this issue. FireEye wrote a technical article on ...
5
votes
2answers
435 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS ...
2
votes
0answers
107 views

Is there a way to get msfpayload to generate a regular cmd.exe reverse tcp shell? [closed]

It looks like msfpayload now generates a powershell-based payload when you pass it windows/reverse_tcp_shell. Is there a way to generate a regular cmd.exe reverse shell instead? Thanks!
13
votes
2answers
577 views

Getting exploit reliability when using the off by one framepointer overwrite on linux

We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian ...
0
votes
1answer
170 views

how can I secure my static ip router?

hi I have a static ip and someone is hacking my computer trought it I tried to format my computer and making a clean install but he keeps penetrating it this time i tried to install the AV before ...
108
votes
5answers
55k views

What should a website operator do about the Heartbleed OpenSSL exploit?

CVE-2014-0160 http://heartbleed.com This is supposed to be a canonical question on dealing with the Heartbeat exploit. I run an Apache web server with OpenSSL, as well as a few other utilities ...
1
vote
0answers
64 views

Local lan drive by download

Basically, I'm testing a local network, on which I'm able to use ARP spoofing. I now want to try and infect one of the Windows boxes on the network with a backdoor. I could inject an iframe into their ...