The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

1
vote
0answers
64 views

How to exploit a stack-overflow without setting -mpreferred-stack-boundary=2

I have been playing with some wargames and I ported some of then on my Linux machine as well. I noticed that when not using -mpreferred-stack-boundary=2, gcc might compile "main" with an interesting ...
3
votes
1answer
656 views

Is my server vulnerable to a perl exploit?

I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable. Firstly, the following seems to fail, receiving a 404 response: ...
125
votes
5answers
5k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
3
votes
1answer
158 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
1
vote
0answers
84 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
5
votes
4answers
259 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
4
votes
2answers
448 views

Preventing unvalidated redirects and forwards

Suppose you have a redirect page where the client is redirected to a URL from the query string: http://victim/redirect.aspx?url=http://evil/ You really need to be able to redirect to a another page ...
-1
votes
1answer
46 views

ROP: Use return value of function

Is it possible to call a function and store its return value in the next stack frame? So: call foo(); // int foo(); store return value of foo in next stack frame; call bar(int);
5
votes
2answers
1k views

Can you describe a real-life scenario of exploiting sticky bits?

Sticky bit are mentioned in every UNIX security book, but I couldn't find anyone that describes the exploitation of Sticky Bit set on a file. Can you?
12
votes
3answers
2k views

How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?

There are several commercial exploit kits available containing 0day vulnerabilities: White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml Agora Exploit Pack ...
5
votes
2answers
140 views

Is it possible become root through a broken symlink owned by root and globally writeable?

I'm looking for a vulnerability on a server. I'm looking in the /var directory and I get something like this: drwxr-xr-x 3 root root 4.0K Aug 14 21:02 kerberos drwxr-xr-x 12 root root 4.0K Nov 11 ...
4
votes
3answers
523 views

Ysoserial and Jenkins commons collection exploit - what can you do?

I have read about the Jenkins exploit of the Commons Collections vulnerability. I've tested this (legitimately) on a system, but I'm not very good at this, so I can't seem to achieve much. What is the ...
2
votes
0answers
51 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
2
votes
2answers
187 views

XSS in JavaScript

I was recently figuring out thing in a web application and found that the URL is reflected among the source of the page, which make it bit obvious for XSS, but the input from URL which is reflected on ...
1
vote
3answers
146 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
3
votes
4answers
214 views

Simple tools for searching process memory for MSSQL connection strings

I'm working with a piece of software that handles all permissions in a Windows client binary on the user's computer. The software connects to a backend database using the sa account. The sa password ...
2
votes
4answers
3k views

Can CVE-2015-4852 be exploited against WebLogic servers after a load balancer?

I have Java applications served by Oracle WebLogic servers that are after a load balancer. The WebLogic t3 protocol (vulnerable) is not tunneled to the WebLogic servers, only the HTTP requests. In ...
1
vote
0answers
74 views

Exploit Development Road-map [closed]

this days i am trying some exploit development practices, i already learned assembly, c, python, immunity debugger, corelan articles, pentester academy exploit development, now i can bypass DEP, ASLR, ...
3
votes
2answers
172 views

Javascript injection in email address as username?

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that ...
10
votes
4answers
3k views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
7
votes
3answers
2k views

MSFConsole/Kali Linux - gain root access to unix system

I am messing around with Kali Linux, MSFConsole and DVWA (Damn Vulnerable Web Application). I have successfully been able to get into the system (Raspberry Pi) by creating a PHP backdoor and uploaded ...
1
vote
0answers
75 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
1
vote
1answer
98 views

Any ways to exploit PHP through an echo'd parameter?

I was wondering, lets say we have a page like this. <?php if(isset($_GET['example'])){ echo $_GET['example']; } Would there be any way to exploit this page into doing something such as executing ...
0
votes
0answers
64 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
-2
votes
1answer
203 views

Concerns about intercepting HTTPS

I've developed a content filtering system and am considering adding the ability to transparently intercept and filter HTTPS traffic, at the users request of course. I understand that I need to install ...
5
votes
2answers
208 views

“Memory Sinkhole” attack and virtual machines?

Recently a design flaw in some Intel X86 processors was revealed at Blackhat. The flaw enables malicious code to gain access to SMM. The flaw can be exploited by an attacker with administrator ...
0
votes
1answer
128 views

What attacks or exploits are possible when MAC address, IP, and Port of a WiFi access point are known? [closed]

I just accepted a position at a small firm and was testing the previous WiFi setup for flaws and exploits that were possible. We have two AP's for business and guest connections, everything checks out ...
-1
votes
1answer
117 views

how to execute /bin/sh at stdout

Below is objdump output of a C program (source code at bottom of this post) where I am doing buffer overflow to overwrite the group offset table (GOT) entry: -$ objdump -R ./vuln ./vuln: file ...
5
votes
2answers
282 views

MySQL BACKRONYM (CVE-2015-3152) only affects MySQL client?

I read the CVE-2015-3152 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152) named BACKRONYM (http://backronym.fail/), and what I understood (ELI5 style) was the following: Attacker ...
2
votes
2answers
1k views

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command ...
1
vote
3answers
480 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
1
vote
1answer
96 views

how to circumvent ASLR without pointer leaks

is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to ...
0
votes
0answers
36 views

Is it appropriate to request a bounty for finding exploit on major site? [duplicate]

Long story short, I found an easily reproducible, very easy, and honestly embarrassing exploit on a major (yes, major) financial institution's online banking site today. It's not directly tied to ...
20
votes
4answers
4k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
2
votes
1answer
81 views

Run fuzzer on any service or process in Linux

I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
3
votes
1answer
883 views

USB OTG DMA Attack vector, any information about that?

In that paper: http://www.delaat.net/rp/2011-2012/p14/report.pdf[1] is reported that USB OTG can be used to have direct DMA memory access and as a consequence have access to all the content of the ...
91
votes
7answers
17k views

Why do I hear about so many Java insecurities? Are other languages more secure?

I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
3
votes
2answers
236 views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: ...
3
votes
3answers
121 views

How dangerous is the remote Jeep Cherokee attack?

Recently two researchers working with a Wired Magazine reporter have demonstrated a serious vulnerability in UConnect, the software that powers the onboard entertainment systems of all Chrysler group ...
2
votes
2answers
231 views

Good book about general methods of exploit [closed]

I suppose that a lot of users hate this type of 'noob' questions, but I really eager to become a Cyber Security specialist and I need a little advice. As for now I'm learning Networking/Routing ...
4
votes
1answer
149 views

Never heard of compiler vulnerabilities when compiling?

Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code. ...
0
votes
0answers
77 views

Is sharing with Direct Connect DC++ secure?

As I have some useful software that I want to share with friends and I don't like to get involved with torrents, DC++ (P2P client for sharing and chatting) seems a good way to do it, but I'm not sure ...
1
vote
2answers
34 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
1
vote
0answers
92 views

Where can I find live browser exploits to test my sandbox? [closed]

I've just built a custom sandbox, and I'm happy with the way it processes samples that I upload directly. Now I'd like to work on "drive-by" browser exploits, but I'm not sure how to go about testing ...
3
votes
2answers
312 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in java when I noticed a strange thing.......... On Compiling the program My antivirus detected it as trojan and deleted the jar file....... Further it is not ...
0
votes
1answer
452 views

Openvas - exploiting result

I am an IT administrator and I try at present to secure my network. I have made an analysis of safety with OpenVAS on one computer, and I have difficulty exploiting the result : Vulnerability ...
4
votes
4answers
4k views

What's a good fuzzing framework for fuzzing a local standalone application?

I have been looking for guides and tutorials about how to fuzz and so far everything I have seen has been for web servers. If I wanted to fuzz something along the lines of calc.exe or a program that ...
1
vote
0answers
219 views

Converting Metasploit module to standalone Python script [closed]

How easy is to convert Ruby code to Python code and to change Metasploit module into standalone Python script for Linux?
0
votes
3answers
220 views

How can i prevent my phone from spying through sms

Recently while reading up a article over here ,The following were the summary : hacking suite dubbed Smurf Suite, it can hack any mobile by sending an encrypted text message So based on the ...
1
vote
2answers
352 views

Meterpreter and staged payloads

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions A staged ...