The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

-1
votes
1answer
271 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
0
votes
2answers
323 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
3
votes
2answers
94 views

Found this textarea with PHP in it. Might it be malicious/exploitable?

I came across this textarea on the website of a Medical Center. Clients enter sensitive medical data here. What users see: HTML: <textarea name="message">&lt;?php echo ...
5
votes
2answers
520 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
1
vote
2answers
62 views

Why Wordpress doesn't filter post_title?

Today, when I did some tests and found out that Wordpress doesn't filter the post_title. Respectively, I make posts with the titles: <?php while ( have_posts() ) : the_post(); echo 'Post Title'; ...
2
votes
2answers
190 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
1
vote
2answers
66 views

Potential worm damage on a physically isolated Tor system

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), and I'm concerned about methods a worm could use to infect my OS. In the ...
2
votes
0answers
117 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
0
votes
1answer
123 views

Why is Parallels Plesk running on port 8443 > 1023?

Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for ...
-2
votes
1answer
58 views

Are exploits 1:1 with vulnerabilities? [closed]

I know that for the most part, there are some small differences between thoughts on a lot of matters in terms of definitions in security. What I am asking about is whether exploits are considered to ...
0
votes
3answers
96 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
10
votes
1answer
880 views

Legality of writing exploits for educational purposes (USA, Canada) [closed]

Is it legal for me to write a small exploit (possibly to a closed issue) and put it up on the internet for everyone to see (as a tutorial)? I have been researching the legality of exploiting ...
13
votes
4answers
721 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...
2
votes
1answer
134 views

Buffer Overflow EDI but not EIP

Is possible to exploit a program if you can only overwrite ESI or EDI register without EIP? Program in question does seg fault and overwrite EDI, ESI and ECX but can't get it to overflow EIP. Anyone ...
9
votes
2answers
1k views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
6
votes
2answers
139 views

Modify C code with buffer overflow vulnerability to skip code

I'm trying to find a way to exploit the buffer overflow vulnerability in the following source code so the line, printf("x is 1") will be skipped: #include <stdio.h> #include <stdlib.h> ...
1
vote
2answers
952 views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
2
votes
2answers
145 views

Questions regarding Bad USB exploit

I own a Netbook and my external DVD Drive is possibly infected with Bad USB. If I install Ubuntu using this infected DVD drive, could my system be taken over during installation process or later when ...
0
votes
1answer
202 views

Java desktop app vs web service [closed]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
1
vote
2answers
145 views

Meterpreter and staged payloads

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions A staged ...
5
votes
1answer
165 views

Return oriented programming without int 0x80

I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location. However, this region does not ...
4
votes
2answers
97 views

Are there methods for determining the exploitability of bugs, after a crash is found in fuzzing?

I have found this, https://msdn.microsoft.com/en-us/magazine/cc163311.aspx It says that only "a full root-cause analysis can ensure that you have correctly diagnosed whether a given crash is ...
2
votes
1answer
181 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
1
vote
0answers
89 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
1
vote
0answers
42 views

Possible exploit while MPLS parsing with Bottom of Stack bit

My current task to parse MPLS label in a packet and store them in to a list. When I check packets with MPLS: One can understand it is the last MPLS header by checking Bottom of Stack bit. If ...
12
votes
9answers
4k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...
2
votes
1answer
119 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
4
votes
1answer
141 views

Bash Shellshock

I am trying to find out if my devices are vulnerable to bash shellshock. I have run the commands found on https://shellshocker.net. It seems my devices are both susceptible to only one of the ...
1
vote
1answer
82 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
8
votes
4answers
697 views

Evading IDS in exploit development

In the context of buffer overflow exploit development, I was asked: Discuss how your exploit may be modified to evade an Intrusion Detection System. I'm not asking for my homework to be done, but ...
3
votes
3answers
96 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character in real time so when I input the following code: <input onclick=alert(document.cookie)> there ...
1
vote
0answers
41 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
2
votes
1answer
120 views

Resources to learn about Windows systems exploitation [closed]

I'm a beginner in penetration testing, and I'm struggling with finding decent material to learn. I used book about nmap, Metasploit, exploit writing etc..., but they contained too much information ...
-1
votes
1answer
224 views

Possible Injection to PHP PDO

Expert says that PDO is one of secure scripting from mysql injection. I have read the manual about it and do some little research. And here, I'm trying to get ID value from URL paramater, as in: ...
4
votes
1answer
115 views

Realistic: Exploiting a computer on BIOS/ hardware level in less than an hour? (Infinite preparation time)

I wonder how hard it it to infect a laptop or netbook in 60 minutes or less in a way the victim cannot easily clean their machine by wiping hard disk drives. Let's assume the following: The ...
13
votes
3answers
520 views

remote desktop connection to a potentially compromised machine

I am using rdesktop client on Linux to connect to windows machines. If some of these machines were compromised by some evil malware/virus/worm/trojan, is there any way for the malware to "jump" to my ...
1
vote
5answers
174 views

How to analyze spam email URLs to detect exploits?

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside ...
3
votes
1answer
202 views

SMB/CIFS shares on HP-UX vulnerabilities

So, I've run an unauthenticated Nessus scan against a critical piece of infrastructure as part of a pen-test but I'm getting back some weird stuff and i can't seem to re-create the issue to ...
1
vote
1answer
58 views

Are Sun/Oracle's SPARC processors invulnerable to buffer overrun exploits?

We all use Intel architectures these days, in small part because Oracle has totally dropped the ball regarding SPARC CPU development. But with so many now saying that protection against viruses is ...
14
votes
7answers
2k views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
1
vote
1answer
310 views

How do I prevent tampering with form submission data, and changing the details for any account?

Although this is something that only employees can use, I'd like to prevent the tampering anyway. I don't like insecure code, and this is hideously insecure. Here's an example link: <a href="#' + ...
4
votes
1answer
277 views

How did GamerFood hack the Starcraft IEM Taipei Tournament? [closed]

During the recently completed professional Starcraft tournament, Intel Extreme Masters (IEM) Taipei 2015, the notorious cheat software company Team Gamer Food hacked the cast somehow. How did they do ...
-1
votes
1answer
342 views

Hack to change the webpage of a website? [closed]

Recently, there is a website by Malaysia Airline got hacked and their main page has been defaced, below is a link to that article ...
0
votes
1answer
93 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
6
votes
3answers
203 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
0
votes
3answers
161 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
0
votes
1answer
86 views

Are firefox bugs cross platform? [duplicate]

I use Ubuntu and last firefox version. I opened an image with firefox, and a crash occurred. Let's assume it's a crafted jpg to run an exploit, and execute arbitrary code. To sum up: (1) Firefox ...
1
vote
0answers
63 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
10
votes
2answers
267 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
1
vote
2answers
99 views

Reasonable source of old proof-of-concept attacks

I am relatively new to the area of cyber security but have a reasonable knowledge of several programming languages, assembly (x86 in particular) and scripting. In light of the recent Shellshock and ...