The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

3
votes
2answers
298 views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...
1
vote
3answers
155 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: ...
0
votes
0answers
34 views

Disguising as another computer using SMB Relay?

I've got a server that constantly checks for the existence of certain parameters on every PC in the web using SMB, if it fails to find those parameters it marks it as a rogue PC. I've understood that ...
3
votes
1answer
377 views

Can you exploit an Internet IP adress just like a LAN IP address?

Is exploiting an Internet IP address as simple as exploiting a LAN IP address? i.e.: Scan that IP for vulnerabilities and open ports using tools like nmap or nikto Use a vulnerability and set the ...
1
vote
1answer
101 views

Is a precompiled Java program affected by Java vulnerabilities?

We know that Oracle publishes Java updates due to vulnerabilities / security issues and therefore we should make sure that we have installed the latest version of Java. Now there exist programs like ...
-2
votes
1answer
97 views

Why are discovered vulnerabilities of suspicious/illegal online software published? [closed]

For example, the Tor network has recently been hit by a reveal of a major exploit in a research paper. Isn’t publishing the details on the exploits completely counter-productive as the developers of ...
4
votes
2answers
104 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to ...
4
votes
1answer
472 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
-2
votes
1answer
186 views

How to check if your phone got hacked [closed]

Since the Stagefright exploit is very common on many devices I wanted to ask if there is any way to check if someone has used this exploit on a given device. Like check the processes for unknown ...
3
votes
1answer
188 views

Bash Shellshock

I am trying to find out if my devices are vulnerable to bash shellshock. I have run the commands found on https://shellshocker.net. It seems my devices are both susceptible to only one of the ...
2
votes
2answers
135 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
2
votes
1answer
347 views

Why Skype discloses my IP address to anybody? [closed]

Apparently there is a Skype exploit that allows people to obtain your IP address through your Skype username if you're online. The problem has existed since 2012. There exists countless websites which ...
-2
votes
2answers
481 views

Does Microsoft EMET protect against latest Hacking Team Adobe Flash 0-day exploit?

If I were to not update Adobe Flash and instead used the old version (from before the Hacking Team 0-day exploit was published in the internet), in that case, would Microsoft EMET protect me from the ...
9
votes
2answers
121 views

Is using separate stacks for return addresses and function arguments a viable security measure?

As far as I know, many exploits rely on overwriting return address of the function they try to exploit. They do it by buffer overruns. But what if the compiler set up two separate stacks far from each ...
0
votes
0answers
26 views

Is there any risk in allowing clients to be fed opengl shaders?

I'm working on a project that may eventually involve server specified fragment and vertex shaders. What are the possible risks of allowing a third party to send fragment/vertex shaders and execute ...
1
vote
2answers
146 views

Is this exploit on household appliances really as bad as it sounds?

CNN article link. The article claims that a household appliance can be hacked by reprogramming the circuits inside of it to release electromagnetic waves that could release system information, but ...
10
votes
2answers
720 views

Is allowing unfiltered curl request from a website a vulnerability?

Recently I was on a website which provided some non-sense feature: Enter a URL Press enter HTML source of a given URL is displayed It basically fetched a URL and just dumped the contents of it. ...
3
votes
0answers
69 views

How to analyse a suspicious Encapsulated Postscript file?

How can you analyze an encapsulated PostScript file that has a standard header, but is way too big? There is a EPS file which has a size of 1.8MB. When it is reconverted to EPS, the resulting file is ...
3
votes
1answer
101 views

Simple exploit leads to wrong EIP and EBP

I have a simple program: void bug(char *arg1) { char name[128]; strcpy(name, arg1); printf("Hello %s\n", name); } int main(int argc, char **argv) { if (argc < 2) { ...
3
votes
4answers
555 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
2
votes
0answers
362 views

Using .apk files to reverse_tcp and exploit on android? [closed]

I have been able to install and run the application that I plan on exploiting. Once the app is running I am able to exploit the application. In my testing environment I am able to do this just fine. ...
7
votes
2answers
341 views

Is it possible to encode bytes in an buffer overflow exploit that bypass string functions?

Disclaimer: this exploit is purely for educational use. In this exploit I play the role of the victim and the software exploited is written by me alone. I have a simple HTTP server that I want to ...
35
votes
5answers
4k views

Can malicious code trigger without the user executing or opening the file?

If a file is downloaded from the Internet, and saved on disk, but is not opened by a user (if we keep autorun off), are there any chances that malicious code (e.g. a virus) in the file could trigger? ...
4
votes
1answer
176 views

gray hat hacking 4th edition question

Example Using find.c Using find.c as an example, how would this manual source code auditing process work? We need to start with user data entering the program. As seen in the preceding ITS4 output, a ...
10
votes
1answer
5k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
2
votes
3answers
219 views

Browser as Honey-Pot, is there?

I'm watching all this movement around Metasploit project, the great number of different exploitation plugins, and thousands of exploit packs. Now, it is real truth, anyone could configure his own ...
2
votes
3answers
121 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character in real time so when I input the following code: <input onclick=alert(document.cookie)> there ...
0
votes
0answers
106 views

Unable to execute shellcode in stack with no DEP

Here is the simplest example to show my problem. Everything is in WinXp sp3 with DEP disabled. char f() { // shellcode starting with some NOPs, char shellcode[400]= { 0x90, 0x90, ...
3
votes
2answers
195 views

Questions regarding Bad USB exploit

I own a Netbook and my external DVD Drive is possibly infected with Bad USB. If I install Ubuntu using this infected DVD drive, could my system be taken over during installation process or later when ...
0
votes
1answer
72 views

What kinds of attacks can VLAN's mitigate? [closed]

Assuming these very basic kinds of attacks: Header based Protocol based Authentication based Traffic based What would using a VLAN mitigate? Several people seem to be overthinking the question. ...
34
votes
9answers
4k views

Why is it a security problem not to update one's browser?

Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update? As part of this question, I would like to ...
2
votes
2answers
73 views

Trusted vulnerability database source [closed]

Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product ...
1
vote
0answers
51 views

Passing arrays to a function call (Bufer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
4
votes
1answer
1k views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
3
votes
0answers
68 views

How to notify Adobe about a software issue

Recently, I stumbled upon a way to reset the software trial of any product under the adobe suite. It's as simple as changing some attributes within a few files. I'm assuming that it can be deemed an ...
2
votes
1answer
6k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
6
votes
2answers
347 views

Why are Adobe Flash exploits found so often? [closed]

Over the last couple of years Adobe Flash published bug fixes for (zero-day) exploits so often, that the installation is already annoying. But why are exploits so often found in this particular ...
17
votes
4answers
5k views

What is the corrupted image vulnerability? How does it work?

What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
1
vote
0answers
106 views

Metasploit new exploits failed [closed]

Why can't I use new exploits like exploit/multi/browser/adobe_flash_nellymoser_bof ? I tried to access it, but I can't even find it in MSF search Adobe or Flash or anything like this. What should I ...
9
votes
3answers
909 views

Can an attacker “simulate” a private IP address?

I have a SSH server with a rule that does not allow password connections outside the local network. So people already on the local network, either physically or via VPN, are allowed to connect with ...
3
votes
3answers
880 views

Why not fix Android root exploit? [closed]

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
4
votes
1answer
1k views

is computrace a permanent backdoor?

I was reading about CompuTrace and this thing is pretty much a backdoor and irremovable. It's in the firmware, in the BIOS and survives formatting and even hard drive change and OS reinstalls. Some ...
3
votes
1answer
95 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
2
votes
2answers
293 views

ROP Gadgets from executables?

I noticed that exploits which use Return Oriented Programming always find the gadgets in libraries. I wonder if it is possible to use gadgets from the executable (.exe) itself?
3
votes
2answers
112 views

How to sanitize archive files?

I am looking for a way to make sure that a particular archive file does not contain any sort of malicious code. From time to time new vulnerabilities pop up (e.g. gzip, 7zip) so I though a good idea ...
3
votes
2answers
178 views

How to overwrite ebp on stack alignment?

I want to exploit a simple program #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buf[128]; strcpy(buf, argv[1]); return 0; } The disassembly ...
0
votes
1answer
162 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?
1
vote
1answer
193 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
6
votes
3answers
229 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
1
vote
2answers
837 views

Spike in TCP port 5904 activity - what for?

There is an 'Internet Weather Report' on the Threat!Traq video blog by AT&T security researchers. In the March 14th broadcast, at around 31 minutes in, they mention an increase of scanning ...