The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

3
votes
2answers
90 views

Is it possible to crack g++ rand()?

So, I have this: I know that some code was used to generate a random sequence, and it looked roughly like this: #include <iostream> #include <string> int main() { const std::string ...
2
votes
2answers
134 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
0
votes
1answer
52 views

Malicious tracking script being served from google server to circumvent block lists

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit. Thing is, its stored on a google server in a directory it really shouldnt be. ...
2
votes
3answers
73 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
-3
votes
2answers
144 views

How to find Use-After-Free vulnerbilities? [closed]

I followed a lot of tutorials about the exploitation of UAF vulnerabilities, but there was never explained how to find and detect uaf vulnerabilities in javascript or html (i.e. with a static analysis ...
1
vote
0answers
77 views

Windows 7 remote desktop access to utilman or stickykeys?

Is anyone aware of a windows 7 procedure where the attacker is able to access the host machine remotely via RDP on port 3389, and implement the utilman and/or stickykey exploit? afaik the utilman ...
1
vote
2answers
62 views

Is it possible to plan for race conditions?

Is it possible to plan for race conditions, so that you can execute specific commands at a specific time? For example, the following code is vulnerable to a race condition. Is it possible to modify ...
6
votes
2answers
199 views

Cost of finding vulnerabilities vs developing exploits

From the perspective of someone who wants to develop a zero-day exploit against some software application or target, there are broadly speaking two tasks that the attacker must do: (1) find a new ...
2
votes
1answer
137 views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
3
votes
2answers
179 views

Should ability to access login page after authentication be considered a security flaw?

On one of the recent engagements, I bumped into something I have not seen before: after successful authentication attempt the user still can access the login web page and login as another user. It ...
0
votes
2answers
116 views

Are regular expressions vulnerable to code injection?

Aside from having an excessive input length, is there a way of doing an exploit with a regular expression (assuming the underlying language/platform is secure)? Practically I was wondering if the ...
4
votes
1answer
82 views

Armitage check exploit

I am with all fairness not the most experienced penetration tester, I am doing an industry placement where I can improve my skills. I am using Armitage in Kali Linux to check for vulnerabilities in ...
4
votes
2answers
453 views

I think my site was hacked. Can someone explain the “GET / HTTP/1.0” garbage in my Apache log, and what it's doing?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! ...
1
vote
1answer
39 views

What purpose is served by repeated connection resets?

My server logs are being filled with Connection Reset by xxx.xxx.xxx.xxx [preauth]: $ cat /var/log/auth.log | grep 'Connection Reset' Mar 13 19:52:30 server sshd[29366]: Connection reset by xxx.xxx....
2
votes
1answer
96 views

Sqlmap, how to move forward? [duplicate]

So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and ...
0
votes
0answers
64 views

How can I partially overwrite the EIP in order to bypass ASLR?

As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my ...
3
votes
2answers
138 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
3
votes
1answer
81 views

ROP chain on x64, get rid of nulls

So I have this ROP chain for x64 architecture: 0x0000000000400b60: pop rdi; ret; 0x482cf5 0x68732f6e69622f ('/bin/sh') 0x401550 <system> In Payload: \x60\x0b\40\x00\x00\x00\x00\x00\xf5\x2c\...
1
vote
0answers
62 views

Encrypted Malicious Traffic Database

I was working on a little research project to correctly identify the encrypted traffic pattern generated by various tools/applications for example metasploit (or increase the success rate). I have ...
1
vote
1answer
115 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
1
vote
1answer
47 views

How do you remotely BOF without knowing source code? [closed]

I have two questions. Note that I have very basic understanding of how BOF works, but don't know the exact mechanism or anything beyond what an ordinary computer user knows. My understanding of BOF ...
4
votes
2answers
90 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
0
votes
0answers
24 views

GDB trace questions regarding register overflow. Anybody can explain it?

GDB Traces on x64 machine (gdb) disassemble main Dump of assembler code for function main: 0x000000000040050c <+0>: push %rbp 0x000000000040050d <+1>: mov %rsp,%rbp ...
-4
votes
1answer
121 views

How is it technically possible for Apple to unlock the San Bernardino shooter's iPhone? [duplicate]

If the iPhone of the San Bernadino shooters is locked, how would it even be possible for Apple to acquiesce to the FBI's request for them to unlock the phone? Does that mean Apple has some kind of "...
0
votes
1answer
171 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
4
votes
4answers
172 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
1
vote
1answer
92 views

Exploit Stack Based buffer overflow (x64) while controlling rbx register

I can control these registers: (gdb) i r rax 0x1 1 rbx 0x4141414141414141 4702111234474983745 rcx 0x7ffff760cf90 140737343704976 rdx ...
7
votes
0answers
504 views

Heap Buffer Overflow - AddressSanitizer output - what is needed to exploit this condition?

This is the AddressSanitizer output, for different input I get READ and WRITE errors. From Heap Buffer Overflow perspective which are more interesting? I want to execute my shellcode. Can somebody ...
-1
votes
2answers
79 views

Guidance towards exploit development and exploring codes [closed]

I am familiar with intel assembly ,c programming ,perl and linux kernel internals. I want to explore more through fuzzing , analyzing source code and developing exploits as well as proper safety ...
12
votes
5answers
2k views

Unknown process on my ubuntu machine communicating over multiple ports with UDP proto

I have a Django web application where the web app and the postgresql database are hosted on two separate Ubuntu-based machines. On my Database machine (and not my web application), if I run sudo ...
2
votes
2answers
104 views

why can't i overwrite stack frame

I'm currently reading Gray Hat Hacking The Ethical Hacker's Handbook, Fourth Edition and I have a question with an exercise in the book. The lab "Lab 10 - 1 Overflow of meet.c" is a lab in which we ...
3
votes
0answers
24 views

using “mount -o bind” in chroot

I have to provide a few, reasonably complete, chrooted ssh accesses to a very small system where disk space is at a premium. I was considering doing something along the lines: mkdir -p newroot/usr ...
2
votes
3answers
82 views

Can a curl request to an arbitrary url made sufficiently safe?

This is a follow up of another topic (Is allowing unfiltered curl request from a website a vulnerability?) on which I am doing some private research. Given: A publicly reachable webservice that ...
3
votes
2answers
85 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
0
votes
2answers
49 views

Need some help on Wordpress issue

When I am accessing my Wordpress website, for example: https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php it's returning a page containing zero. Is ...
3
votes
1answer
119 views

return-to-libc attack

I was trying to attempt at return-to-libc buffer overflow attack for my Computer Software Security assignment. As far as my understanding goes, we can do these kind of attacks regardless of stack ...
0
votes
2answers
183 views

Computer Security vs Privacy

Probably this is a redundent post but in fact I have been searching online about a precise clear distinction between computer security and privacy. I'd like to know the difference of between them ...
0
votes
1answer
33 views

Exploit by overwriting relative address?

I see a lot of exploits overwrite an absolute address to gain code execution. I wonder if there are vulnerabilities which offer the possibility to overwrite relative addresses. Can you imagine a ...
4
votes
3answers
189 views

How often do high-end attackers actually use zero-day exploits?

Earlier this week the head of the NSA's Tailored Access Operations unit rather remarkably gave a presentation at the USENIX Enigma security conference. (News coverege here and here; video of the talk ...
3
votes
2answers
114 views

metasploit exploits and payloads documentation

Where can i found the documentation of the exploits and payloads available in metasploit. I am looking for a documentation that tells what does the exploit or the payload do, and possibly a ...
5
votes
2answers
2k views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
3
votes
1answer
673 views

Is my server vulnerable to a perl exploit?

I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable. Firstly, the following seems to fail, receiving a 404 response: [15/Jan/2016:10:27:...
8
votes
1answer
181 views

Bluetooth vulnerabilities for Internet of Things demo

For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it ...
0
votes
0answers
46 views

Encode metasploit

Using metasploit I generated an exploit exploit/windows/fileformat/ms14_017_rtf for windows 7 with windows/shell_reverse_tcp payload. In show advanced, I use option EnableContextEncoding true and it's ...
1
vote
0answers
80 views

How to exploit a stack-overflow without setting -mpreferred-stack-boundary=2

I have been playing with some wargames and I ported some of then on my Linux machine as well. I noticed that when not using -mpreferred-stack-boundary=2, gcc might compile "main" with an interesting ...
1
vote
0answers
85 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
4
votes
2answers
528 views

Preventing unvalidated redirects and forwards

Suppose you have a redirect page where the client is redirected to a URL from the query string: http://victim/redirect.aspx?url=http://evil/ You really need to be able to redirect to a another page ...
2
votes
0answers
51 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
4
votes
3answers
603 views

Ysoserial and Jenkins commons collection exploit - what can you do?

I have read about the Jenkins exploit of the Commons Collections vulnerability. I've tested this (legitimately) on a system, but I'm not very good at this, so I can't seem to achieve much. What is the ...
1
vote
1answer
91 views

Controlling where a program crashes

I'm missing a part of the process for preparing a payload for an overflow exploit. To crash a program using an overflow vulnerability, lets say the heap. How can we control the memory address it ...