The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

-2
votes
6answers
4k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
4
votes
2answers
875 views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
6
votes
2answers
209 views

Example of malware in the wild?

I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
7
votes
3answers
435 views

Risk Control - Ignored risks and accepted risks

Some say that ignored risks as part of an organization's behavior are much worse than accepted risks. I would like to test that axiom (in the eyes of some). When I am handling a risk and I choose to ...
4
votes
1answer
381 views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
3
votes
2answers
365 views

How was pentest performed in the era with no frameworks like Metasploit?

I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
0
votes
1answer
107 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
3
votes
1answer
233 views

How did the Tumblr worm spread?

Recently Tumblr was hit by a fast-spreading worm. How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
9
votes
4answers
242 views

What to do about companies that refuse to fix their security vulnerabilities

While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform ...
3
votes
1answer
232 views

Can TLS Compression be enabled on 3rd party CDN sites that have no authentication?

In this answer, @Thomas Pornin talks about remediating the CRIME attack and says: (It is a shame to have to remove SSL compression, because it is very useful to lower bandwidth requirements, ...
4
votes
2answers
133 views

Using format string to control the flow of a process?

I was cleaning up some code today on the advice of someone I know, and was made aware of the potential for a hacker to gain control over the flow of the process using format strings, particularly the ...
2
votes
2answers
758 views

Stack Overflow on ARM : Null Bytes Issue

I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link For the simple stack overflow exploitation, the code is : #include <stdio.h> #include <string.h> ...
2
votes
1answer
237 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
1
vote
1answer
82 views

sigsegv in php5.3.10

I found an overflow situation in php5.3.10. Probably it's not 'something new', but if I can understand this, it will help me to find this kind of bug faster in the future. What can I do to check ...
8
votes
3answers
1k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
2
votes
1answer
374 views

SafeSEH and x64

I read here that /SAFESEH is only valid when linking for x86 targets. /SAFESEH is not supported for platforms that already have the exception handlers noted. For example, on x64 and Itanium, ...
9
votes
4answers
1k views

Nessus Scan Port ID mapped to Metasploit Vulnerability exploits

My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities? My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
3
votes
1answer
237 views

Stack canaries protection and ROP

As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return. My question is: if I overwrite both EIP and stack ...
3
votes
2answers
633 views

Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?

Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
9
votes
2answers
3k views

How “leaking pointers” to bypass DEP/ASLR works

I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here: The only way to reliably bypass DEP and ASLR is through an pointer leak. This ...
2
votes
1answer
172 views

amd64 safer than 686-pae?

Apart from stronger ALSR entropy... Is a system using amd64 any safer than 686-pae? What are the advantages, if any?
3
votes
3answers
590 views

What are methods for preventing browser hooking / drive-by downloads?

This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this. With the advent of BeEF and more and more of the computers in networks being infected just by ...
1
vote
3answers
1k views

How to exploit DRUPAL-SA-CORE-2012-003

I have read the security notices and understand that it "would allow an attacker to reinstall an existing Drupal site with an external database server and then execute custom PHP code". According to ...
3
votes
3answers
647 views

Can malware on my computer infect my phone?

Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this? Relevance: Some banks use two-factor ...
4
votes
3answers
2k views

How to get this to buffer overflow?

I'm trying to understand buffer overflow, and am working with a simple piece of code, as below. #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { ...
4
votes
1answer
308 views

Need help on understanding obfuscated code in CVE-2012-4969 exploit

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation ...
1
vote
2answers
379 views

DVWA vulnerability list or guide?

Is there a list of vulnerabilities for DVWA, I cannot seem to find a vulnerability list or guide. By guide I mean an exhaustive list of vulnerabilities to work through.
6
votes
2answers
301 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
4
votes
1answer
356 views

In the light of recent information about RarVM, can we still trust RAR files?

See: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html https://github.com/taviso/rarvmtools It would seem according to these two sources that rar files can contain custom ...
2
votes
1answer
191 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
7
votes
3answers
2k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
1
vote
2answers
153 views

What's the right way to prevent shell bounce back?

When an exploit was successfully executed, is there a way to block the user from bouncing back a shell? I would like to know about this on both Windows and Linux machines.
1
vote
1answer
1k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
4
votes
2answers
250 views

Does anyone know about how LinkedIn was compromised?

I know some super basic stuff about website security (e.g. using HTTPS, escaping user input), but hearing about high profile sites getting compromised makes me wonder in what way they were broken ...
3
votes
2answers
135 views

Taking action for exploit attempts

Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
2
votes
1answer
253 views

How to achieve interactive shell attack?

Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell. So when I call FTP interactive client, shell fails. Is there any way I can do ...
1
vote
3answers
243 views

Java class type parameter vulnerability

In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
21
votes
3answers
9k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
-4
votes
1answer
676 views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...
2
votes
2answers
2k views

How to hack linux via Local File Inclusion vulnerability?

During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB. I tried to exploit the ...
185
votes
3answers
41k views

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
4
votes
2answers
425 views

Webservices exploitation / axis/services/AdminService?Method=AdminService

I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services. I have a sandbox (can't post live URLs...) I'm trying some stuff to try to ...
0
votes
1answer
419 views

apache mod_isapi public exploits

In public apache mod_isapi exploits, they ask for dlls, and I am unsure what I should put in dll. I am having a hard time understanding exploits.. How does all of dlls connect to manipulating ...
1
vote
1answer
468 views

Apache mod_rewrite vulnerability

The public exploits of apache mod_rewrite asks for the rewrite path in order to work, and I am unsure what the rewrite path is referring to. What should I supply in rewrite path?
1
vote
2answers
347 views

vulnerabilities in a machine that detects vulnerability scanners

I currently have a machine (set by another person) that has (according to nmap) open ports as: FreeBSD ftpd 6.00LS where anonymous login is possible OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0) ...
4
votes
3answers
1k views

Are there any tools that focus on shellcode analysis?

Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
5
votes
1answer
225 views

Hardware enforced DEP on different CPUs

Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)? Are there any significant differences how hardware DEP works on x86 ...
-4
votes
1answer
477 views

How to exploit a windows server when you have read-only filesystem access [closed]

I found a vulnerability in a site that can allow the download of any file of the server. I tested it by succesfully downloading boot.ini and autoexec.bat. I have no access to source code or file ...
12
votes
2answers
2k views

Why is 0x41414141 associated with security exploits?

This article and this search suggest that the 32-bit word 0x41414141 is associated to security exploits. Why is 0x41414141 associated to security exploits?
27
votes
2answers
6k views

How do ASLR and DEP work?

How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?