The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.
0
votes
3answers
178 views
How to rewrite config files using SNMP?
I scanned a router and found that the community string is public. The write access is also enabled. Now I want to change the configuration of the router. Can anybody tell me about tools and tutorials ...
6
votes
4answers
554 views
if the hypervisor is hacked are all guests affected as well?
I'm guessing that all guests would be screwed, if the hypervisor is hacked. I found this article, but it seems to be more focused on privilege escalation of guests. I'm more interested to hear about ...
2
votes
3answers
119 views
I want to implement a new type of security feature over several platforms
I want to make a security feature that will go farther in discouraging people from looking through a secure system or server than what I have seen being implemented.
Specifically, is there a way (or ...
4
votes
1answer
243 views
How do I check the code of a Chrome extension to make sure it's not stealing my info?
I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
10
votes
1answer
371 views
SCADA / PLC exploit code was released in metasploit. Now what?
Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities.
They say it's so easy, the ...
6
votes
2answers
341 views
Videos and visual tutorials on Format String Vulnerabilities
Anyone know of good format string vulnerability tutorials/videos that demo how to test on a web app, such as modifying the URL. I've watched Vivek's videos from securitytube and another from ...
5
votes
3answers
1k views
Where can I find exploit code?
I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are:
2010-1917,
...
8
votes
2answers
1k views
Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?
My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
0
votes
1answer
492 views
Can you describe a real-life scenario of exploiting sticky bits?
Sticky bit are mentioned in every UNIX security book, but I couldn't find anyone that describes the exploitation of Sticky Bit set on a file.
Can you?
11
votes
3answers
974 views
How can I be protected from pictures vulnerabilities?
I've just read this question What is the corrupted image vulnerability? How does it work?
(GIFAR, EXIF data with javascript, etc..)
I'm asking myself how can I protect myself and my website's users.
...
13
votes
4answers
1k views
What is the corrupted image vulnerability? How does it work?
What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
7
votes
2answers
332 views
Local File Download vulnerability - What files can be downloaded to potentially compromise a windows system?
On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which ...
3
votes
5answers
318 views
Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?
This is a multi-part question....
In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better?
...
6
votes
4answers
454 views
Is Stonesoft's “advanced evasion technique” a major problem?
A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques.
With these techniques, they claim to be capable of launching attacks on a network ...
12
votes
3answers
731 views
Bypassing Address Space Layout Randomization
How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
8
votes
6answers
416 views
Doing a demo about open wireless networks exploiting with Firesheep
A collegue and I have been asked to do a demo where we show off stealing Facebook sessions with Firesheep. I've never used Firesheep before myself, but I reckon it should be a simple task.
I know the ...
3
votes
5answers
993 views
What programming language does this code use?
Watching this article:
http://www.exploit-db.com/exploits/13474/
I can see this:
/*
* NetBSD
* execve() of /bin/sh by humble of Rhino9
*/
char shellcode[] =
"\xeb\x23"
"\x5e"
"\x8d\x1e"
...
3
votes
2answers
549 views
Reverse shell connections
Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice.
Would not most servers restrict outgoing ...
6
votes
3answers
425 views
Remote return into libc attack
It is often shown that non-executable data segemnts are possible to bypass through return-to-libc attacks. It's evident on /bin/sh but is it also possible to invoke a remote shell?
2
votes
3answers
299 views
Security Implications of setting passwd as suid
When the passwd command is executed, it runs as the root user. Can't this be exploited? If not, why?
3
votes
1answer
78 views
How can one gain additional privileges from being able to read kernel memory?
Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of ...
4
votes
2answers
297 views
Cell phone voice mail hacking
The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, ...
3
votes
1answer
344 views
Two questions about learning Linux exploit development fundamentals
getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information.
First, I plan on reading "Understanding the Linux ...
5
votes
1answer
87 views
Modeling vectors of an unknown exploit
Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an ...
5
votes
3answers
165 views
Spamming exploits without user detection
So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
3
votes
2answers
515 views
Found some malicious Javascript - how did it get there?
Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're ...
4
votes
1answer
177 views
xml library vulnerabilities, regarding post-exploitation
there was some arbitrary code execution that occurred on my os x 10.5 system.
this came as a result of opening an xls file with excel for mac.
the vnc type program that came with office for mac was ...
2
votes
1answer
138 views
Can a bad guy be judged for gaining access to sensitive information?
Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
5
votes
5answers
904 views
Suggested reading list: OS exploits
In computer security, my areas of interest include x86 processors, binary exploitation and reverse engineering. I'm also interested in the certain aspects of the minix and the linux kernel(memory ...
4
votes
2answers
1k views
Command line Nessus/OpenVAS or NSE to find specific vulns?
Which methods do you use to quickly scan a network for certain vulnerabilities?
I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
6
votes
3answers
406 views
How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?
There are several commercial exploit kits available containing 0day vulnerabilities:
White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml
Agora Exploit Pack ...
11
votes
5answers
451 views
What is the potential impact of the alleged OpenBSD IPSEC attack?
Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have.
For instance, does ...
2
votes
2answers
772 views
Is it possible to change the admin user/password remotely on a router without logging in?
Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
16
votes
7answers
821 views
How would you exploit this vulnerability in order to cause max damage
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
8
votes
2answers
562 views
Why is Firesheep Unable to Session Hijack over SSL?
Why is Firesheep unable to session hijack when a user is using SSL?
