The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

0
votes
1answer
95 views

Unauthorized credit card payment

I have a debit card which links to my savings account in a let's call it Bank A. I had never used it for online purchases/transactions (not even interbank transfer). After a while, I purchased virtual ...
1
vote
0answers
63 views

How to remotely upload a file on linux and windows (without netcat or ssh)

With meterpreter from metasploit, there is an option (windows or linux victim) to upload files on the victim device. I searched in the metasploit-framework in order to find the script that does the "...
1
vote
3answers
151 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to download/...
8
votes
3answers
980 views

Is a HTML form tag more exploitable than a HTML link in user submitted content?

I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application. The editor component I have used automatically removes any script ...
7
votes
3answers
165 views

I anonymously submitted a security vulnerability, but it was not resolved. What now?

This is more or less a continuation of my previous question: As a student, how do I safely and responsibly disclose a serious security issue in a school environment? More than four months on after I ...
8
votes
1answer
180 views

Bluetooth vulnerabilities for Internet of Things demo

For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it ...
-1
votes
3answers
59 views

What is the future of exploitations? [closed]

With the advent of "Safe" languages like Rust, the prevalence of Software Correctness, and improved type checking in existing systems, memory based exploits are very hard if not possible at all, to ...
-1
votes
1answer
61 views

Does it make sense to restrict the usage of Metasploit in Penetration testing exams ? [closed]

In some PT exams (mainly Offensive Security's) they restrict the usage of Metasploit or any automated attacking tool and allow only for manually written\compiled codes from public exploit sites such ...
2
votes
0answers
35 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
6
votes
2answers
1k views

Exploiting Writeable SNMP

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches). I'm aware of the ...
3
votes
1answer
81 views

ROP chain on x64, get rid of nulls

So I have this ROP chain for x64 architecture: 0x0000000000400b60: pop rdi; ret; 0x482cf5 0x68732f6e69622f ('/bin/sh') 0x401550 <system> In Payload: \x60\x0b\40\x00\x00\x00\x00\x00\xf5\x2c\...
6
votes
1answer
121 views

Shared clipboard on Linux without keylogging, etc. vulnerabilities?

X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using ...
16
votes
2answers
2k views

Could you write custom data to a file of a specific extension and use it to hack a program once it opens the file?

From what I understand file extensions don't really affect the data contained within them at all. They just give your computer a hint of what the data is, how it's structured and your computer then ...
2
votes
0answers
149 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
0
votes
1answer
33 views

What do the [-], [+], [!] line prefixes mean in exploit outputs?

When you're using exploits, in the output, every line is prefixed with a symbol inside a set of square brackets. For example: [+] Set arguments. [-] Running exploit. [!] Warning server returned 404. ...
4
votes
1answer
556 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
2
votes
1answer
588 views

With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? [closed]

So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs ...
0
votes
1answer
1k views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
3
votes
2answers
90 views

Is it possible to crack g++ rand()?

So, I have this: I know that some code was used to generate a random sequence, and it looked roughly like this: #include <iostream> #include <string> int main() { const std::string ...
2
votes
2answers
133 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
111
votes
9answers
131k views

Can webcams be turned on without the indicator light?

I've made a series of penetration tests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a stealth thing, but what ...
0
votes
1answer
52 views

Malicious tracking script being served from google server to circumvent block lists

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit. Thing is, its stored on a google server in a directory it really shouldnt be. ...
2
votes
3answers
73 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
-3
votes
2answers
144 views

How to find Use-After-Free vulnerbilities? [closed]

I followed a lot of tutorials about the exploitation of UAF vulnerabilities, but there was never explained how to find and detect uaf vulnerabilities in javascript or html (i.e. with a static analysis ...
6
votes
2answers
198 views

Cost of finding vulnerabilities vs developing exploits

From the perspective of someone who wants to develop a zero-day exploit against some software application or target, there are broadly speaking two tasks that the attacker must do: (1) find a new ...
1
vote
2answers
62 views

Is it possible to plan for race conditions?

Is it possible to plan for race conditions, so that you can execute specific commands at a specific time? For example, the following code is vulnerable to a race condition. Is it possible to modify ...
1
vote
0answers
77 views

Windows 7 remote desktop access to utilman or stickykeys?

Is anyone aware of a windows 7 procedure where the attacker is able to access the host machine remotely via RDP on port 3389, and implement the utilman and/or stickykey exploit? afaik the utilman ...
2
votes
1answer
137 views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
3
votes
2answers
179 views

Should ability to access login page after authentication be considered a security flaw?

On one of the recent engagements, I bumped into something I have not seen before: after successful authentication attempt the user still can access the login web page and login as another user. It ...
0
votes
2answers
116 views

Are regular expressions vulnerable to code injection?

Aside from having an excessive input length, is there a way of doing an exploit with a regular expression (assuming the underlying language/platform is secure)? Practically I was wondering if the ...
46
votes
3answers
38k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
4
votes
1answer
82 views

Armitage check exploit

I am with all fairness not the most experienced penetration tester, I am doing an industry placement where I can improve my skills. I am using Armitage in Kali Linux to check for vulnerabilities in ...
4
votes
2answers
451 views

I think my site was hacked. Can someone explain the “GET / HTTP/1.0” garbage in my Apache log, and what it's doing?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! ...
32
votes
10answers
7k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
14
votes
3answers
962 views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
2
votes
1answer
95 views

Sqlmap, how to move forward? [duplicate]

So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and ...
1
vote
1answer
39 views

What purpose is served by repeated connection resets?

My server logs are being filled with Connection Reset by xxx.xxx.xxx.xxx [preauth]: $ cat /var/log/auth.log | grep 'Connection Reset' Mar 13 19:52:30 server sshd[29366]: Connection reset by xxx.xxx....
0
votes
0answers
64 views

How can I partially overwrite the EIP in order to bypass ASLR?

As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my ...
3
votes
2answers
137 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
1
vote
0answers
62 views

Encrypted Malicious Traffic Database

I was working on a little research project to correctly identify the encrypted traffic pattern generated by various tools/applications for example metasploit (or increase the success rate). I have ...
1
vote
1answer
47 views

How do you remotely BOF without knowing source code? [closed]

I have two questions. Note that I have very basic understanding of how BOF works, but don't know the exact mechanism or anything beyond what an ordinary computer user knows. My understanding of BOF ...
0
votes
0answers
24 views

GDB trace questions regarding register overflow. Anybody can explain it?

GDB Traces on x64 machine (gdb) disassemble main Dump of assembler code for function main: 0x000000000040050c <+0>: push %rbp 0x000000000040050d <+1>: mov %rsp,%rbp ...
0
votes
1answer
171 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
4
votes
4answers
172 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
-4
votes
1answer
121 views

How is it technically possible for Apple to unlock the San Bernardino shooter's iPhone? [duplicate]

If the iPhone of the San Bernadino shooters is locked, how would it even be possible for Apple to acquiesce to the FBI's request for them to unlock the phone? Does that mean Apple has some kind of "...
1
vote
1answer
92 views

Exploit Stack Based buffer overflow (x64) while controlling rbx register

I can control these registers: (gdb) i r rax 0x1 1 rbx 0x4141414141414141 4702111234474983745 rcx 0x7ffff760cf90 140737343704976 rdx ...
7
votes
0answers
502 views

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

This is the AddressSanitizer output, for different input I get READ and WRITE errors. From Heap Buffer Overflow perspective which are more interesting? I want to execute my shellcode. Can somebody ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
1
vote
1answer
91 views

Controlling where a program crashes

I'm missing a part of the process for preparing a payload for an overflow exploit. To crash a program using an overflow vulnerability, lets say the heap. How can we control the memory address it ...
-1
votes
2answers
79 views

Guidance towards exploit development and exploring codes [closed]

I am familiar with intel assembly ,c programming ,perl and linux kernel internals. I want to explore more through fuzzing , analyzing source code and developing exploits as well as proper safety ...