The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

4
votes
1answer
175 views

Why would a user agent string be executed?

I'm having trouble understanding how a particular XSS vulnerability might arise in the real world. Guides for two of the exercises on hackthissite.org: ...
-2
votes
1answer
57 views

websites with vulnerabilities INFO [duplicate]

Websites like http://www.cvedetails.com/ http://www.securityfocus.com This websites show information about vulnerabilities and exploits, which other sites are similar?
2
votes
3answers
196 views

Does the principle of the CRIME & BEAST attack affect VPNs?

I was recently reading about the attacks on SSL/TLS that CRIME and BEAST were able to exploit by attacking the compression in the secure session. Upon reading this I remembered that OpenVPN has ...
0
votes
1answer
94 views

Why does this buffer overflow have payload &system-&exit-&BINSH

I'm following a tutorial to write a simple buffer overflow. I have (basic) knowledge of assembly, and the stack. I've written a stack based buffer overflow before and understood it. The program I'm ...
8
votes
2answers
368 views

Are userid and password needed in order to pentest a website?

We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
-1
votes
2answers
869 views

Automatically search Metasploit for useable exploits based on vulnerabilties in the database

Is it possible to automatically search the Metasploit database for usable exploits based on information about the vulnerabilities on the hosts? Searching in Metasploit for each CVE number to see if ...
0
votes
1answer
73 views

Installing a custom SSL Certificate For Local Proxy. Safe?

I've been writing some software for over a year that is a sort of browsing security/privacy application. One of the features of this software is that it uses a local HTTP proxy for some content ...
1
vote
1answer
509 views

Reverse TCP connection from exploited SearchIndexer.exe failing

I'm working on a tool that exploits SearchIndexer.exe on Windows 7 x86 and connects back to a metasploit multi/handler, using standard metasploit reverse TCP stagers. The exploit seems to function as ...
4
votes
1answer
888 views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
0
votes
2answers
374 views

Can I exploit Windows kernel from user-mode application?

In this document is detailed technique of exploiting Windows kernel. But writer is talking about accessing kernel memory & doing exploit from user-mode application at the same time. Can I do this ...
0
votes
1answer
154 views

Using buffer overflow on word with macro injection

I know how a buffer overflow works on a local network against an application running on a TCP port, assuming it doesn't drop the connection, but I would like some advice on an "exploit" I would like ...
11
votes
7answers
2k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
2
votes
1answer
326 views

List of NSA spyware - remote bios exploits [closed]

Found this rather detailed list of the NSA's latest spyware gadgets, with several different remote bios exploits that once installed are virtually undetectable and can survive reinstall of the OS: ...
0
votes
2answers
2k views

Ways to completely spoof browser user agent and hiding OS to a webserver

This is a follow-up to the following question: Can a website determine what OS or web browser a visitor is using if the useragent is blanked/changed? If I have understood the answers correctly, a ...
2
votes
2answers
456 views

NX bit: does it protect the stack?

I once heard the NX bit was a panacea, then that it was not. One detail I've wondered about though: Does the NX (no execute) bit protect against code inserted into the stack and executed there? It ...
2
votes
2answers
344 views

What hacking risks a site has if it has no input boxes?

I recently posted a question about recovery of website from XSS attacks, http://stackoverflow.com/questions/20759081/how-to-recover-a-site-after-an-xss-attack... Doing a bit more digging online, i ...
2
votes
1answer
1k views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
11
votes
6answers
499 views

Can a website determine what OS or webbrowser a visitor is using if the useragent is blanked/changed?

Assume that a visitor to a website has changed his useragent to something like the following, but he's using linux: Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0 Assume that the ...
3
votes
1answer
118 views

Storing product keys on same server as shop?

Situation: An e-commerce system (specifically: PrestaShop) which is used to sell virtual products (specifically: product license keys). To accelerate order processing, a cronjob is supposed to be ...
1
vote
2answers
185 views

How does the stack cookie protect return address from being overwrite [duplicate]

/GS compiler option Micorsoft developed added an extra cookie before the return address and before returning the cookie is checked, if it is intact then return address is safe why ever would ...
4
votes
1answer
165 views

What are the major vulns that affect the Dalvik VM of Android?

I frequently hear about the security risks of using Android. But few people who write articles on this subject ever identify what parts of Android are at fault, nor do they identify design flaws. Can ...
4
votes
1answer
124 views

ROP resistant gadgetless binaries

G-Free: defeating return-oriented programming through gadget-less binaries This paper describes what seems like a really cool technique to prevent ROP attacks if the source is availible. They use an ...
1
vote
2answers
194 views

How do arbitrary payloads execute on the remote machine?

I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command ...
-1
votes
2answers
579 views

How much are 0-days worth? [closed]

I got discussing this topic with someone recently and we couldn't reach a consensus so I thought I should ask here. There are commonly thrown around figures regarding the cost of buying a ...
5
votes
1answer
412 views

Suspicious activity on contact form, what are their intentions?

I've just started receiving several emails per second and I think it's likely someone is trying to exploit my contact form. I've taken steps to protect my site, I'm just curious what it is they're ...
0
votes
1answer
170 views

how can I secure my static ip router?

hi I have a static ip and someone is hacking my computer trought it I tried to format my computer and making a clean install but he keeps penetrating it this time i tried to install the AV before ...
4
votes
1answer
232 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
0
votes
1answer
882 views

How do Java applet exploits work? [closed]

Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to? My understanding is that a ...
2
votes
1answer
319 views

Is there a way to evade -Wformat-security?

I am trying to learn about format string bugs and I found the gcc option -Wformat-security to raise a warning when a potential format string bug is found. I would like to know if there is a way to ...
0
votes
1answer
472 views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...
0
votes
2answers
370 views

Transmitting malicious code over audio speakers

In a post that reads like science-fiction, a security researcher claims that malicious code was being passed between computers. A few quotes: ... "badBIOS," as Ruiu dubbed the malware, has the ...
4
votes
2answers
389 views

Smashing the stack if it grows upwards

As we know that on most of the processor architectures, the stack grows downwards. Hence, memory exploits involving smashing of stack and buffer overflow and their explanation make sense. Just ...
3
votes
1answer
109 views

What's malicious about file links?

Why did Chrome and Firefox disallow file:/// links? I can imagine an iframe opening a local resource, but which resource is the scary one? They could have just disabled iframes to file:///? Ajax ...
0
votes
1answer
1k views

Is this a security issue at the Remote Host or the Local Host?

The problem is as follows: In the local host machine (let's call it 'A'), there is a apache server hosting some web application. A user use the local host machine to access a web application site ...
0
votes
2answers
468 views

Disabling SMEP on x86_64

I have recently been doing some research into kernel exploitation on X86_64. A problem I have run into is that I have found Intel's SMEP to be killing my contrived example of a kernel NULL pointer ...
3
votes
3answers
611 views

What stops a hacker from installing it's own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, ...
13
votes
1answer
1k views

Return-oriented programming: how to find a stack pivot

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
0
votes
2answers
176 views

Preventing exploits like ROP and Return-to-libc in modern Operating systems

As I was reading about the advanced exploits such as Return Oriented Programming (ROP), Retun-to-libc, etc., I came across many defenses to these attacks including techniques like ASLR, kBouncer, ROP ...
0
votes
1answer
557 views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
1
vote
1answer
445 views

Fuzzer causes crash. Now what?

Can anyone point me in the direction of some good tutorials regarding how to identify the type of vulnerability as reported by !exploitable and where to go from there? Essentially I've got myself a ...
0
votes
2answers
285 views

Can I read/write canary values from %gs register?

I would like to know if it is possible to read (or write) the canary values from %gs register. If "yes", how; and if "no", why? Also, I have been reading somewhere that the canary values are stored ...
3
votes
1answer
96 views

Exploiting memory corruption issues using a DLL file

I was listening to a talk on Return Oriented Exploitation from the Black Hat 2010 conference. The speaker mentioned something about using the DLLs to exploit some of the memory corruption issues. I ...
-1
votes
2answers
182 views

Android OS Security [closed]

I am somewhat confused in terms of how secure Android OS is and how updates work on Android. Are there security fixes on each release? How can I keep track for Android exploits and what are the most ...
2
votes
3answers
253 views

Insert string to memory with null character

I'm trying to implement return-to-libc, here's the code void func(const char *str) { char buf[4]; strcpy(buf,str); printf("you entered [%s]\n",buf); } int main(int argc, char *argv[]) { ...
2
votes
1answer
3k views

Create netcat listener and execute reverse shell in the same script

I'm coding an exploit in python that exploits a command injection vulnerability for a CTF and I'm wondering how could I start a netcat listener and then send the payload to the remote host and once ...
6
votes
2answers
340 views

Continuous Integration for Exploit Development

I have been thinking about this subject a lot. Exploit Development is nearly the same as normal development, you need to test quite a lot of platforms (eg. Windows XP, Windows Vista, x64, x86, ...
-6
votes
1answer
175 views

Reverse shell in gzip

I got a box I am trying to pop (boot and root) that has an upload form on its website for logged in users that will take a .gzip file and extract it to the users home directory on the server. I am ...
0
votes
1answer
145 views

Abusing write permission on Apache logs dir to escalete privileges

I have just come across this sentence on apache log files documentation: Anyone who can write to the directory where Apache is writing a log file can almost certainly gain access to the uid that ...
3
votes
1answer
396 views

How does SEH based exploit bypass DEP and ASLR?

I am new to structured exception handling based exploits. Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH) Can anybody explain the reason of ...
0
votes
2answers
389 views

Exploiting an Open Redirect in POST body?

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after ...