The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

3
votes
2answers
126 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
3
votes
1answer
75 views

ROP chain on x64, get rid of nulls

So I have this ROP chain for x64 architecture: 0x0000000000400b60: pop rdi; ret; 0x482cf5 0x68732f6e69622f ('/bin/sh') 0x401550 <system> In Payload: ...
1
vote
0answers
59 views

Encrypted Malicious Traffic Database

I was working on a little research project to correctly identify the encrypted traffic pattern generated by various tools/applications for example metasploit (or increase the success rate). I have ...
1
vote
0answers
84 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
1
vote
1answer
43 views

How do you remotely BOF without knowing source code? [closed]

I have two questions. Note that I have very basic understanding of how BOF works, but don't know the exact mechanism or anything beyond what an ordinary computer user knows. My understanding of BOF ...
4
votes
2answers
81 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
0
votes
0answers
21 views

GDB trace questions regarding register overflow. Anybody can explain it?

GDB Traces on x64 machine (gdb) disassemble main Dump of assembler code for function main: 0x000000000040050c <+0>: push %rbp 0x000000000040050d <+1>: mov %rsp,%rbp ...
-4
votes
1answer
118 views

How is it technically possible for Apple to unlock the San Bernardino shooter's iPhone? [duplicate]

If the iPhone of the San Bernadino shooters is locked, how would it even be possible for Apple to acquiesce to the FBI's request for them to unlock the phone? Does that mean Apple has some kind of ...
0
votes
1answer
149 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
4
votes
4answers
165 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
1
vote
1answer
89 views

Exploit Stack Based buffer overflow (x64) while controlling rbx register

I can control these registers: (gdb) i r rax 0x1 1 rbx 0x4141414141414141 4702111234474983745 rcx 0x7ffff760cf90 140737343704976 rdx ...
7
votes
0answers
397 views

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

This is the AddressSanitizer output, for different input I get READ and WRITE errors. From Heap Buffer Overflow perspective which are more interesting? I want to execute my shellcode. Can somebody ...
-1
votes
2answers
71 views

Guidance towards exploit development and exploring codes [closed]

I am familiar with intel assembly ,c programming ,perl and linux kernel internals. I want to explore more through fuzzing , analyzing source code and developing exploits as well as proper safety ...
12
votes
5answers
2k views

Unknown process on my ubuntu machine communicating over multiple ports with UDP proto

I have a Django web application where the web app and the postgresql database are hosted on two separate Ubuntu-based machines. On my Database machine (and not my web application), if I run sudo ...
2
votes
2answers
99 views

why can't i overwrite stack frame

I'm currently reading Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition and I have a question with an exercise in the book. The lab "Lab 10 - 1 Overflow of meet.c" is a lab in which we ...
3
votes
0answers
23 views

using “mount -o bind” in chroot

I have to provide a few, reasonably complete, chrooted ssh accesses to a very small system where disk space is at a premium. I was considering doing something along the lines: mkdir -p newroot/usr ...
2
votes
3answers
75 views

Can a curl request to an arbitrary url made sufficiently safe?

This is a follow up of another topic (Is allowing unfiltered curl request from a website a vulnerability?) on which I am doing some private research. Given: A publicly reachable webservice that ...
3
votes
2answers
82 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
0
votes
2answers
49 views

Need some help on Wordpress issue

When I am accessing my Wordpress website, for example: https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php it's returning a page containing zero. Is ...
3
votes
1answer
109 views

return-to-libc attack

I was trying to attempt at return-to-libc buffer overflow attack for my Computer Software Security assignment. As far as my understanding goes, we can do these kind of attacks regardless of stack ...
0
votes
2answers
170 views

Computer Security vs Privacy

Probably this is a redundent post but in fact I have been searching online about a precise clear distinction between computer security and privacy. I'd like to know the difference of between them ...
0
votes
1answer
32 views

Exploit by overwriting relative address?

I see a lot of exploits overwrite an absolute address to gain code execution. I wonder if there are vulnerabilities which offer the possibility to overwrite relative addresses. Can you imagine a ...
4
votes
3answers
181 views

How often do high-end attackers actually use zero-day exploits?

Earlier this week the head of the NSA's Tailored Access Operations unit rather remarkably gave a presentation at the USENIX Enigma security conference. (News coverege here and here; video of the talk ...
3
votes
2answers
102 views

metasploit exploits and payloads documentation

Where can i found the documentation of the exploits and payloads available in metasploit. I am looking for a documentation that tells what does the exploit or the payload do, and possibly a ...
5
votes
2answers
959 views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
3
votes
1answer
657 views

Is my server vulnerable to a perl exploit?

I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable. Firstly, the following seems to fail, receiving a 404 response: ...
8
votes
1answer
166 views

Bluetooth vulnerabilities for Internet of Things demo

For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it ...
0
votes
0answers
41 views

Encode metasploit

Using metasploit I generated an exploit exploit/windows/fileformat/ms14_017_rtf for windows 7 with windows/shell_reverse_tcp payload. In show advanced, I use option EnableContextEncoding true and it's ...
1
vote
0answers
65 views

How to exploit a stack-overflow without setting -mpreferred-stack-boundary=2

I have been playing with some wargames and I ported some of then on my Linux machine as well. I noticed that when not using -mpreferred-stack-boundary=2, gcc might compile "main" with an interesting ...
1
vote
0answers
84 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
4
votes
2answers
450 views

Preventing unvalidated redirects and forwards

Suppose you have a redirect page where the client is redirected to a URL from the query string: http://victim/redirect.aspx?url=http://evil/ You really need to be able to redirect to a another page ...
2
votes
0answers
51 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
4
votes
3answers
525 views

Ysoserial and Jenkins commons collection exploit - what can you do?

I have read about the Jenkins exploit of the Commons Collections vulnerability. I've tested this (legitimately) on a system, but I'm not very good at this, so I can't seem to achieve much. What is the ...
1
vote
0answers
74 views

Exploit Development Road-map [closed]

this days i am trying some exploit development practices, i already learned assembly, c, python, immunity debugger, corelan articles, pentester academy exploit development, now i can bypass DEP, ASLR, ...
1
vote
1answer
90 views

Controlling where a program crashes

I'm missing a part of the process for preparing a payload for an overflow exploit. To crash a program using an overflow vulnerability, lets say the heap. How can we control the memory address it ...
3
votes
2answers
172 views

Javascript injection in email address as username?

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that ...
3
votes
4answers
214 views

Simple tools for searching process memory for MSSQL connection strings

I'm working with a piece of software that handles all permissions in a Windows client binary on the user's computer. The software connects to a backend database using the sa account. The sa password ...
1
vote
1answer
99 views

Any ways to exploit PHP through an echo'd parameter?

I was wondering, lets say we have a page like this. <?php if(isset($_GET['example'])){ echo $_GET['example']; } Would there be any way to exploit this page into doing something such as executing ...
0
votes
0answers
64 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
-1
votes
1answer
46 views

ROP: Use return value of function

Is it possible to call a function and store its return value in the next stack frame? So: call foo(); // int foo(); store return value of foo in next stack frame; call bar(int);
9
votes
1answer
2k views

iPhone 5/6 RAM security

I'm interested in how the RAM can be exploited in iPhone 5+, iOS 8+. I've previously discussed general iPhone encryption and from the response it reads: There are many exploits over the years ...
0
votes
1answer
128 views

What attacks or exploits are possible when MAC address, IP, and Port of a WiFi access point are known? [closed]

I just accepted a position at a small firm and was testing the previous WiFi setup for flaws and exploits that were possible. We have two AP's for business and guest connections, everything checks out ...
5
votes
2answers
140 views

Is it possible become root through a broken symlink owned by root and globally writeable?

I'm looking for a vulnerability on a server. I'm looking in the /var directory and I get something like this: drwxr-xr-x 3 root root 4.0K Aug 14 21:02 kerberos drwxr-xr-x 12 root root 4.0K Nov 11 ...
3
votes
1answer
158 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
2
votes
4answers
3k views

Can CVE-2015-4852 be exploited against WebLogic servers after a load balancer?

I have Java applications served by Oracle WebLogic servers that are after a load balancer. The WebLogic t3 protocol (vulnerable) is not tunneled to the WebLogic servers, only the HTTP requests. In ...
-1
votes
1answer
117 views

how to execute /bin/sh at stdout

Below is objdump output of a C program (source code at bottom of this post) where I am doing buffer overflow to overwrite the group offset table (GOT) entry: -$ objdump -R ./vuln ./vuln: file ...
1
vote
3answers
146 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
1
vote
3answers
481 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
1
vote
1answer
99 views

how to circumvent ASLR without pointer leaks

is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to ...
1
vote
0answers
75 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...