The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.
2
votes
2answers
366 views
Stack Overflow on ARM : Null Bytes Issue
I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link
For the simple stack overflow exploitation, the code is :
#include <stdio.h>
#include <string.h>
...
0
votes
0answers
276 views
Exploit Double free() Vulnerability PoC [closed]
I don't understand about this bug very much
This is something that I know about this bug
If use free() with freed pointer it can trigged this bug
Need to have at least 2 pointer with allocate memory
...
2
votes
1answer
163 views
solaris equivalent of /proc/self/environ LFI
I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it.
Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
1
vote
1answer
55 views
sigsegv in php5.3.10
I found an overflow situation in php5.3.10.
Probably it's not 'something new', but if I can understand this,
it will help me to find this kind of bug faster in the future.
What can I do to check ...
8
votes
3answers
689 views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
1
vote
1answer
182 views
SafeSEH and x64
I read here that
/SAFESEH is only valid when linking for x86 targets. /SAFESEH is not
supported for platforms that already have the exception handlers
noted. For example, on x64 and Itanium, ...
8
votes
4answers
567 views
Nessus Scan Port ID mapped to Metasploit Vulnerability exploits
My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities?
My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
3
votes
1answer
134 views
Stack canaries protection and ROP
As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return.
My question is: if I overwrite both EIP and stack ...
3
votes
2answers
220 views
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
9
votes
2answers
875 views
How “leaking pointers” to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This ...
2
votes
1answer
133 views
amd64 safer than 686-pae?
Apart from stronger ALSR entropy...
Is a system using amd64 any safer than 686-pae?
What are the advantages, if any?
4
votes
3answers
324 views
What are methods for preventing browser hooking / drive-by downloads?
This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this.
With the advent of BeEF and more and more of the computers in networks being infected just by ...
1
vote
3answers
691 views
How to exploit DRUPAL-SA-CORE-2012-003
I have read the security notices and understand that it "would allow an attacker to reinstall an existing Drupal site with an external database server and then execute custom PHP code". According to ...
3
votes
3answers
277 views
Can malware on my computer infect my phone?
Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this?
Relevance: Some banks use two-factor ...
4
votes
2answers
691 views
How to get this to buffer overflow?
I'm trying to understand buffer overflow, and am working with a simple piece of code, as below.
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *str)
{
...
4
votes
1answer
277 views
Need help on understanding obfuscated code in CVE-2012-4969 exploit
As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code.
Is it necessary to use obfuscation ...
1
vote
2answers
185 views
DVWA vulnerability list or guide?
Is there a list of vulnerabilities for DVWA, I cannot seem to find a vulnerability list or guide.
By guide I mean an exhaustive list of vulnerabilities to work through.
0
votes
1answer
260 views
Windows exploits that still work? [closed]
I was reading how exploits usually work and how they have been used in the past etc etc.
I wanted to know, if there are still some exploits that can work with minimal user allowed access?
For ...
7
votes
2answers
202 views
How a malware executes remote payload
Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
3
votes
1answer
251 views
In the light of recent information about RarVM, can we still trust RAR files?
See:
http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html
https://github.com/taviso/rarvmtools
It would seem according to these two sources that rar files can contain custom ...
2
votes
1answer
91 views
Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?
There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
7
votes
3answers
747 views
How does BeEF work? (working understanding)
I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
1
vote
2answers
107 views
What's the right way to prevent shell bounce back?
When an exploit was successfully executed, is there a way to block the user from bouncing back a shell?
I would like to know about this on both Windows and Linux machines.
1
vote
1answer
396 views
NGINX / HTTP TRACE
I have a http server Nginx with HTTP TRACE Enabled.
A single nmap --script=http-methods.nse host.name give this result :
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
[...]
...
4
votes
2answers
209 views
Does anyone know about how LinkedIn was compromised?
I know some super basic stuff about website security (e.g. using HTTPS, escaping user input), but hearing about high profile sites getting compromised makes me wonder in what way they were broken ...
3
votes
2answers
118 views
Taking action for exploit attempts
Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
2
votes
1answer
146 views
How to achieve interactive shell attack?
Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell.
So when I call FTP interactive client, shell fails.
Is there any way I can do ...
1
vote
3answers
148 views
Java class type parameter vulnerability
In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
12
votes
3answers
3k views
Stack Overflows - Defeating Canaries, ASLR, DEP, NX
To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
-4
votes
1answer
314 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
2
votes
2answers
688 views
How to hack linux via Local File Inclusion vulnerability?
During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB.
I tried to exploit the ...
147
votes
3answers
32k views
CRIME - How to beat the BEAST successor?
With the advent of CRIME, BEASTs successor, what is possible protection is available for an individual and / or system owner in order to protect themselves and their users against this new attack on ...
4
votes
2answers
247 views
Webservices exploitation / axis/services/AdminService?Method=AdminService
I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services.
I have a sandbox (can't post live URLs...)
I'm trying some stuff to try to ...
0
votes
1answer
226 views
apache mod_isapi public exploits
In public apache mod_isapi exploits, they ask for dlls, and I am unsure what I should put in dll.
I am having a hard time understanding exploits.. How does all of dlls connect to manipulating ...
1
vote
1answer
281 views
Apache mod_rewrite vulnerability
The public exploits of apache mod_rewrite asks for the rewrite path in order to work, and I am unsure what the rewrite path is referring to. What should I supply in rewrite path?
1
vote
2answers
248 views
vulnerabilities in a machine that detects vulnerability scanners
I currently have a machine (set by another person) that has (according to nmap) open ports as:
FreeBSD ftpd 6.00LS where anonymous login is possible
OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0)
...
4
votes
3answers
610 views
Are there any tools that focus on shellcode analysis?
Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
5
votes
1answer
148 views
Hardware enforced DEP on different CPUs
Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)?
Are there any significant differences how hardware DEP works on x86 ...
-4
votes
1answer
353 views
How to exploit a windows server when you have read-only filesystem access [closed]
I found a vulnerability in a site that can allow the download of any file of the server. I tested it by succesfully downloading boot.ini and autoexec.bat.
I have no access to source code or file ...
7
votes
2answers
794 views
Why is 0x41414141 associated with security exploits?
This article and this search suggest that the 32-bit word 0x41414141 is associated to security exploits.
Why is 0x41414141 associated to security exploits?
21
votes
2answers
3k views
How do ASLR and DEP work?
How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
1
vote
1answer
225 views
Lots of 'unidentified exploits' detected with w3af
I've been running some scans across a few different networks and on certain sites I will get a flag about an unidentified exploit in the log. When I review what the exploit is, most of the time its a ...
1
vote
1answer
53 views
Dangers of a vulnerability in a local installer?
I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code.
Other than the fact that if ...
1
vote
1answer
3k views
known public exploits for vsftpd 2.0.1/2.0.5
I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits.
The server I am working on has vsftpd 2.0.5 ...
2
votes
4answers
252 views
Writing exploit code that bypasses IPS detection
Suppose that Network IPS/IDS can detect an exploit, however, the application server itself is still vulnerable to that exploit.
If I modify the exploit code, are there IPS/IDS which will still ...
3
votes
3answers
4k views
How can I use this path bypass/exploit Local File Inclusion?
I have tried to run a vulnerability scanning script (Uniscan 6.0) on some websites and then I found a site which is exploitable with this following path. (included a word "invalid" , params/website ...
10
votes
2answers
389 views
How to analyze a rootkit?
The other a friend of mine sent me a rootkit/code he found on a server that was exploited (php cgi exploit).
Now I was thinking of having a look at it, but I was wondering if there are some basic ...
4
votes
2answers
360 views
Possible arbitrary file download vulnerablity
I am auditing a possible vulnerable piece of ASP code on a Windows enviroment. The code is as follows:
If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then
Basicly it is ...
1
vote
1answer
157 views
A simple example for showing the use of Data Execution Prevention (DEP) security feature
I am finding it really hard to figure out why we need a DEP!
Microsoft states this about DEP:
The primary benefit of DEP is to help prevent code execution from data
pages.
Typically, code ...
2
votes
2answers
434 views
Possible website hack?
I have been receiving some strange requests on my website from foreign countries. For example, 218.83.152.252/judge112233.php, /www.travelimgusa.com/ip.php, //59.53.91.9/httpproxy/proxyheader.php, ...
