The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

1
vote
1answer
180 views

Metasploit generating strange shellcode

So I just used metasploit to generate the payload/linux/x86/shell_bind_tcp payload without null bytes (generate -t raw -b '\x00' -f shellcode). Here's the shellcode: $ xxd -p shellcode ...
1
vote
1answer
167 views

Exploiting Writeable SNMP

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches). I'm aware of the ...
0
votes
1answer
59 views

3 byte address of system call and exit call

i am trying to exploit a buffer overflow vulnerability in ubuntu (kernel version 3.0.0-12 generic i686) by using the method return to libc and the stack is not exploiting ? By while exploiting i ...
0
votes
1answer
44 views

8 extra bytes in stack

i am new to buffer overflow and learning from securitytube.net website but in 7th video i got stucked Buffer Overflow Primer Part 7 (Exploiting A Program Demo) In this when the value of egg is passed ...
3
votes
3answers
247 views

Memory Corruption in C/C++

I'm doing a study on Memory Corruption. I need to compile a list of all the exploitable memory corruption issues that have been recognized till date and provide a sample vulnerable code for it. I ...
0
votes
0answers
92 views

exploiting buffer overflow

when i download a copy of vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload) it works. but when i made a same type of vulnerable program in c i am ...
0
votes
2answers
261 views

Is possible to exploit C#, Java, Python or any language that is running inside VM (i.e. managed runtime)

Is it possible to exploit a vulnerable application that is running inside a process virtual machine? Let's say that we have buffer overflow vulnerability in a Java application but the JVM isn't ...
0
votes
1answer
92 views

How is a process forced to execute binary code?

I want to understand how a vulnerable internet facing process on some computer is exploited to run arbitrary binary code. I understand how buffer overflows could be used to overwrite the return ...
1
vote
1answer
347 views

DNS settings compromised from WAN on Edimax ADSL router

My home network Edimax AR-7084gB ADSL modem/router with firmware verison 2.9.5.0(RUE0.C2A)3.5.18.0 was exploited from WAN few days ago. The attacker changed DNS server settings - primary server to ...
2
votes
3answers
306 views

How dangerous is the security hole CVE-2014-019?

There is a security hole CVE-2014-019 in the Linux kernel since 2.6.31-rc3 which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges How ...
3
votes
1answer
108 views

How does binary code execution vulnerability work on a modern OS?

In a modern OS I think that: the .text section where binary assembled CPU instructions are stored cannot be modified the .data/.bss section is marked as no-execute so that the information there will ...
2
votes
1answer
71 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b ...
4
votes
2answers
215 views

What happens if my ISP gives me an IP address that's already being used [closed]

Like the title says, what happens if my ISP gives my connection (by accident/on purpose) a public IP address that someone else is currently using to browse the web or send an email or pay his bills? ...
77
votes
7answers
9k views

Why do I hear about so many Java insecurities? Are other languages more secure?

I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
1
vote
0answers
36 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
0
votes
1answer
129 views

compromising DVRs to become bitcoin mining bot [duplicate]

I read this article, about an exploit which highjacks a DVR to become a "bitcoin mining bot". The heart of the attack is to send a binary using just echo comands to the device, which acts as a ...
2
votes
2answers
268 views

Specific security concerns with (now unupdatable) Win XP [duplicate]

I'm trying to quantify the exact risk I'm subjecting my PC to if leaving it with Windows XP as opposed to upgrading it to e.g. Windows 7, an upgrade that would be very time-costly in my case. I don't ...
-4
votes
2answers
142 views

What types of software vulnerabilities are out there? [closed]

I have search a lot in the internet and I didn't find anything that is directly answer my question. What type of vulnerabilities are out there. I mean vulnerabilities like buffer overrun, not like XSS ...
2
votes
2answers
326 views

I've found security vulnerability in current linux distribution. What next?

I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of ...
2
votes
1answer
61 views

Similar products to MS EMET [closed]

Following the weekend announcement from Microsoft regarding the vulnerability in IE I have been looking at additional security defences for our endpoints. I've read some technical documentation and ...
1
vote
1answer
92 views

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
11
votes
4answers
1k views

Are exploits platform dependent?

Looking over an overview of the newest published IE exploit, I noticed what I think is assembly. I don't know anything about exploit development, but I know a little about assembly. Seeing that ...
6
votes
2answers
255 views

Zero-Day Exploit targeting Internet Explorer Versions 9 through 11

Few days ago, FireEye has found a vulnerability, which affects all versions of IE (even the latest 11). Microsoft has official statement regarding this issue. FireEye wrote a technical article on ...
0
votes
1answer
96 views

Fomat String vulnerability used to display data outside the function stack frame?

if we run the following code using the input "hi", the output will simply be "hi" main(int argc, char **argv) { char *secret = "This is a secret 1\n"; char *secret2 = "This is ...
3
votes
2answers
203 views

Small, Vulnerable apps for exploit training

I'm looking for some really small apps on Ubuntu for some bufferoverflow exploitation training. I don't want to start off with some huge apps. I know some sites like http://www.oldversion.com.de/ ...
47
votes
7answers
5k views

Can “cat-ing” a file be a potential security risk?

I often use cat on the console to view the contents of files, and every now and then I accidentally cat a binary file which basically produces gibberish and system beeps. However today I've ...
2
votes
0answers
107 views

Is there a way to get msfpayload to generate a regular cmd.exe reverse tcp shell? [closed]

It looks like msfpayload now generates a powershell-based payload when you pass it windows/reverse_tcp_shell. Is there a way to generate a regular cmd.exe reverse shell instead? Thanks!
5
votes
2answers
434 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS ...
1
vote
0answers
64 views

Local lan drive by download

Basically, I'm testing a local network, on which I'm able to use ARP spoofing. I now want to try and infect one of the Windows boxes on the network with a backdoor. I could inject an iframe into their ...
0
votes
2answers
739 views

Heartbleed client side attack: What can the attacker obtain? [duplicate]

If I have got this right in my head it would be a simple enough task to combine arp spoofing on a public WiFi to redirect clients to an evil SSL server which sends malformed heartbeat requests or to ...
5
votes
1answer
873 views

Does xkcd.com/1353 overstate heartbleed's capability?

Today's xkcd has characters discussing heartbleed: Megan: I mean, this bug isn't just broken encryption. Megan: It lets website visitors make a server dispense random memory contents. Megan: It's ...
1
vote
1answer
221 views

OpenSSL exploit [closed]

I have read about recent vulnerability in openssl. I tried to exploit one of my cloud servers where I run my web sites. I managed to get 64 KB of data. But what I managed to get was only HTML, CSS, ...
108
votes
5answers
55k views

What should a website operator do about the Heartbleed OpenSSL exploit?

CVE-2014-0160 http://heartbleed.com This is supposed to be a canonical question on dealing with the Heartbeat exploit. I run an Apache web server with OpenSSL, as well as a few other utilities ...
1
vote
1answer
81 views

Is it possible to use a .Net payload with metasploit?

I'm not exactly sure how metasploit works when exploiting a target machine, and it has been a while since of played with it, so forgive me. Instead of using meterpreter as a payload in metasploit, ...
1
vote
2answers
690 views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
0
votes
3answers
426 views

Windows DLL Injection

In the past recent years of mine, I have been doing a lot of DLL injection with a few indie games and MMORPGs. I fully understand how to do it, and how it works for allowing these games to work not as ...
1
vote
1answer
134 views

How can I verify my machine is not vulnerable from a specific exploit?

I'm running Ubuntu 8.04 TLS linux 2.6.24-23, I find that CVE-2009-2692 which exploits by using sock_sendpage() null pointer dereference. It describes this exploit affects linux version prior to 2.6.31 ...
1
vote
1answer
149 views

WordPress Private Expoit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
1
vote
1answer
145 views

A renamed exe automatically running

We are currently developing a web app that allows users to upload files to act as attachments to information they provide. Obviously allowing users to upload any file types is very dangerous, ...
19
votes
8answers
3k views

How could someone exploit the OS an ATM is running?

As I'm sure many of you have heard, the end of support for Windows XP is the supposed apocalypse for ATM's worldwide. I am cognizant of the fact that this ensures that no more patches are issued, and ...
1
vote
3answers
2k views

Exploiting through a filtered port

I'm doing some pentesting against a machine the lecturer set up in the lab. NMAP shows port 445 to be filtered and Nessus confirms the ms08_067 vulnerability is present on that machine. I tried ...
5
votes
1answer
1k views

Recent Fritz Box exploit

Background info: About 50% of the ADSL and cable internet access in Germany (and presumably parts of the EU) goes over AVM Fritz routers, either verbatim or rebranded as e.g. "1&1 Home Server" or ...
1
vote
1answer
328 views

Exploiting XP SP3 with local privilege escalation [closed]

I'm trying to exploit my virtual machine (windows xp sp3) by cve-2013-5065. I created exe from python script and ran on my virtual machine. It successfully spawned new shell but cmd.exe was not with ...
-1
votes
1answer
243 views

Can this code be expoited using Buffer Overflow?

I have a piece of code which contains an obvious buffer overflow at strcpy(buf, x) since it doesn't check if buf is large enough to fit the string x. I'm wondering how to actually exploit this bug. ...
0
votes
1answer
104 views

Automatic exploit searches

How to automatically search and download exploits which matches for example with kernel release ? Is there for example a public REST web service which provide data in XML or JSON format to a client ...
1
vote
2answers
369 views

Python exploit question?

Can someone please explain how and why this struct.pack code is used in the below exploit? I'm trying to understand how it triggers the vulnerability. I understand the buffer overflow aspect, I'm ...
1
vote
1answer
77 views

Why stack is not at the same address when exec running in GDB

During writing some basic challenges, I discover that the exploits are not working if not launched in GDB. To test this behavior, the following program print register values and code address: ...
-6
votes
1answer
103 views

How can mp3blaster vulnerability affect my linux OS? [closed]

Mp3blaster is a terminal mp3 player running a UNIX-like operating system, e.g. Linux, Free/Net/OpenBSD, etc. I usually use this player for playing my music, but yesterday I found a blog which claim ...
0
votes
1answer
87 views

Looking For Compiled Version of Metasploit Local Windows Exploits [closed]

I am looking to have a standalone compiled exploits for all local windows exploits that Metasploit has right now. I was wondering if somebody has done this before or know a place that has these ...
4
votes
1answer
175 views

Why would a user agent string be executed?

I'm having trouble understanding how a particular XSS vulnerability might arise in the real world. Guides for two of the exercises on hackthissite.org: ...