The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.
3
votes
2answers
278 views
ASLR and how a program can actually call its functions
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment.
As far as I know ASLR works by randomizing part of the imagebase address when ...
5
votes
3answers
298 views
Setting up a security CTF server
I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges.
To sum it all up in a simple one-sentence question: How do you set up a server ...
-2
votes
6answers
930 views
Use PHP to check uploaded image file for malware?
I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k.
Is there any way for me to check uploaded ...
4
votes
2answers
209 views
What exploit types do I need to protect against in PHP?
I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
6
votes
2answers
178 views
Example of malware in the wild?
I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
5
votes
3answers
161 views
Risk Control - Ignored risks and accepted risks
Some say that ignored risks as part of an organization's behavior are much worse than accepted risks.
I would like to test that axiom (in the eyes of some).
When I am handling a risk and I choose to ...
5
votes
1answer
222 views
ROP Exploitation on ARM
I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture.
Are there any tools, such as mona.py ...
2
votes
2answers
278 views
How was pentest performed in the era with no frameworks like Metasploit?
I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
0
votes
1answer
99 views
Manually monitoring your PC for Java (Oracle) exploits?
Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
3
votes
1answer
175 views
How did the Tumblr worm spread?
Recently Tumblr was hit by a fast-spreading worm.
How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
9
votes
4answers
223 views
What to do about companies that refuse to fix their security vulnerabilities
While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform ...
0
votes
1answer
116 views
Can TLS Compression be enabled on 3rd party CDN sites that have no authentication?
In this answer, @Thomas Pornin talks about remediating the CRIME attack and says:
(It is a shame to have to remove SSL compression, because it is very
useful to lower bandwidth requirements, ...
4
votes
2answers
83 views
Using format string to control the flow of a process?
I was cleaning up some code today on the advice of someone I know, and was made aware of the potential for a hacker to gain control over the flow of the process using format strings, particularly the ...
2
votes
2answers
431 views
Stack Overflow on ARM : Null Bytes Issue
I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link
For the simple stack overflow exploitation, the code is :
#include <stdio.h>
#include <string.h>
...
0
votes
0answers
302 views
Exploit Double free() Vulnerability PoC [closed]
I don't understand about this bug very much
This is something that I know about this bug
If use free() with freed pointer it can trigged this bug
Need to have at least 2 pointer with allocate memory
...
2
votes
1answer
170 views
solaris equivalent of /proc/self/environ LFI
I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it.
Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
1
vote
1answer
56 views
sigsegv in php5.3.10
I found an overflow situation in php5.3.10.
Probably it's not 'something new', but if I can understand this,
it will help me to find this kind of bug faster in the future.
What can I do to check ...
8
votes
3answers
773 views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
1
vote
1answer
195 views
SafeSEH and x64
I read here that
/SAFESEH is only valid when linking for x86 targets. /SAFESEH is not
supported for platforms that already have the exception handlers
noted. For example, on x64 and Itanium, ...
8
votes
4answers
621 views
Nessus Scan Port ID mapped to Metasploit Vulnerability exploits
My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities?
My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
3
votes
1answer
142 views
Stack canaries protection and ROP
As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return.
My question is: if I overwrite both EIP and stack ...
3
votes
2answers
254 views
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
9
votes
2answers
1k views
How “leaking pointers” to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This ...
2
votes
1answer
137 views
amd64 safer than 686-pae?
Apart from stronger ALSR entropy...
Is a system using amd64 any safer than 686-pae?
What are the advantages, if any?
4
votes
3answers
343 views
What are methods for preventing browser hooking / drive-by downloads?
This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this.
With the advent of BeEF and more and more of the computers in networks being infected just by ...
1
vote
3answers
748 views
How to exploit DRUPAL-SA-CORE-2012-003
I have read the security notices and understand that it "would allow an attacker to reinstall an existing Drupal site with an external database server and then execute custom PHP code". According to ...
3
votes
3answers
301 views
Can malware on my computer infect my phone?
Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this?
Relevance: Some banks use two-factor ...
4
votes
2answers
759 views
How to get this to buffer overflow?
I'm trying to understand buffer overflow, and am working with a simple piece of code, as below.
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *str)
{
...
4
votes
1answer
279 views
Need help on understanding obfuscated code in CVE-2012-4969 exploit
As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code.
Is it necessary to use obfuscation ...
1
vote
2answers
205 views
DVWA vulnerability list or guide?
Is there a list of vulnerabilities for DVWA, I cannot seem to find a vulnerability list or guide.
By guide I mean an exhaustive list of vulnerabilities to work through.
0
votes
1answer
272 views
Windows exploits that still work? [closed]
I was reading how exploits usually work and how they have been used in the past etc etc.
I wanted to know, if there are still some exploits that can work with minimal user allowed access?
For ...
7
votes
2answers
207 views
How a malware executes remote payload
Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
3
votes
1answer
254 views
In the light of recent information about RarVM, can we still trust RAR files?
See:
http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html
https://github.com/taviso/rarvmtools
It would seem according to these two sources that rar files can contain custom ...
2
votes
1answer
104 views
Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?
There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
7
votes
3answers
851 views
How does BeEF work? (working understanding)
I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
1
vote
2answers
108 views
What's the right way to prevent shell bounce back?
When an exploit was successfully executed, is there a way to block the user from bouncing back a shell?
I would like to know about this on both Windows and Linux machines.
1
vote
1answer
425 views
NGINX / HTTP TRACE
I have a http server Nginx with HTTP TRACE Enabled.
A single nmap --script=http-methods.nse host.name give this result :
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
[...]
...
4
votes
2answers
210 views
Does anyone know about how LinkedIn was compromised?
I know some super basic stuff about website security (e.g. using HTTPS, escaping user input), but hearing about high profile sites getting compromised makes me wonder in what way they were broken ...
3
votes
2answers
120 views
Taking action for exploit attempts
Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
2
votes
1answer
160 views
How to achieve interactive shell attack?
Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell.
So when I call FTP interactive client, shell fails.
Is there any way I can do ...
1
vote
3answers
153 views
Java class type parameter vulnerability
In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
14
votes
3answers
4k views
Stack Overflows - Defeating Canaries, ASLR, DEP, NX
To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
-4
votes
1answer
330 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
2
votes
2answers
750 views
How to hack linux via Local File Inclusion vulnerability?
During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB.
I tried to exploit the ...
151
votes
3answers
33k views
CRIME - How to beat the BEAST successor?
With the advent of CRIME, BEASTs successor, what is possible protection is available for an individual and / or system owner in order to protect themselves and their users against this new attack on ...
4
votes
2answers
262 views
Webservices exploitation / axis/services/AdminService?Method=AdminService
I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services.
I have a sandbox (can't post live URLs...)
I'm trying some stuff to try to ...
0
votes
1answer
241 views
apache mod_isapi public exploits
In public apache mod_isapi exploits, they ask for dlls, and I am unsure what I should put in dll.
I am having a hard time understanding exploits.. How does all of dlls connect to manipulating ...
1
vote
1answer
310 views
Apache mod_rewrite vulnerability
The public exploits of apache mod_rewrite asks for the rewrite path in order to work, and I am unsure what the rewrite path is referring to. What should I supply in rewrite path?
1
vote
2answers
256 views
vulnerabilities in a machine that detects vulnerability scanners
I currently have a machine (set by another person) that has (according to nmap) open ports as:
FreeBSD ftpd 6.00LS where anonymous login is possible
OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0)
...
4
votes
3answers
673 views
Are there any tools that focus on shellcode analysis?
Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
