The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

3
votes
3answers
595 views

What are methods for preventing browser hooking / drive-by downloads?

This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this. With the advent of BeEF and more and more of the computers in networks being infected just by ...
3
votes
3answers
654 views

Can malware on my computer infect my phone?

Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this? Relevance: Some banks use two-factor ...
3
votes
2answers
135 views

Taking action for exploit attempts

Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
1
vote
2answers
385 views

DVWA vulnerability list or guide?

Is there a list of vulnerabilities for DVWA, I cannot seem to find a vulnerability list or guide. By guide I mean an exhaustive list of vulnerabilities to work through.
1
vote
2answers
1k views

SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? [closed]

Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that ...
3
votes
3answers
543 views

Are there known hacks or security problems on broadband USB dongles?

USB broadband dongles seem to be common everywhere now though I'm not sure what the most widely accepted name for them is. In case I'm using poor terminology I'm referring to USB sticks which contain ...
6
votes
2answers
301 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
4
votes
1answer
356 views

In the light of recent information about RarVM, can we still trust RAR files?

See: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html https://github.com/taviso/rarvmtools It would seem according to these two sources that rar files can contain custom ...
2
votes
1answer
195 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
4
votes
2answers
250 views

Does anyone know about how LinkedIn was compromised?

I know some super basic stuff about website security (e.g. using HTTPS, escaping user input), but hearing about high profile sites getting compromised makes me wonder in what way they were broken ...
1
vote
2answers
154 views

What's the right way to prevent shell bounce back?

When an exploit was successfully executed, is there a way to block the user from bouncing back a shell? I would like to know about this on both Windows and Linux machines.
1
vote
1answer
1k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
1
vote
3answers
243 views

Java class type parameter vulnerability

In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
2
votes
1answer
254 views

How to achieve interactive shell attack?

Usually when a person gets a shell by attacking some vulnerabilities, what a person gets is non-interactive shell. So when I call FTP interactive client, shell fails. Is there any way I can do ...
-4
votes
1answer
681 views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...
3
votes
2answers
879 views

How to use attack trees and attack graphs

I am trying to understand how attack trees\graphs can be used in the security process. I read a lot of papers presenting the topic and how this reppresentation can be useful, but I really don't ...
4
votes
2answers
432 views

Webservices exploitation / axis/services/AdminService?Method=AdminService

I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services. I have a sandbox (can't post live URLs...) I'm trying some stuff to try to ...
1
vote
2answers
349 views

vulnerabilities in a machine that detects vulnerability scanners

I currently have a machine (set by another person) that has (according to nmap) open ports as: FreeBSD ftpd 6.00LS where anonymous login is possible OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0) ...
1
vote
1answer
470 views

Apache mod_rewrite vulnerability

The public exploits of apache mod_rewrite asks for the rewrite path in order to work, and I am unsure what the rewrite path is referring to. What should I supply in rewrite path?
27
votes
2answers
6k views

How do ASLR and DEP work?

How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
-4
votes
1answer
480 views

How to exploit a windows server when you have read-only filesystem access [closed]

I found a vulnerability in a site that can allow the download of any file of the server. I tested it by succesfully downloading boot.ini and autoexec.bat. I have no access to source code or file ...
12
votes
2answers
2k views

Why is 0x41414141 associated with security exploits?

This article and this search suggest that the 32-bit word 0x41414141 is associated to security exploits. Why is 0x41414141 associated to security exploits?
1
vote
1answer
382 views

Lots of 'unidentified exploits' detected with w3af

I've been running some scans across a few different networks and on certain sites I will get a flag about an unidentified exploit in the log. When I review what the exploit is, most of the time its a ...
1
vote
1answer
57 views

Dangers of a vulnerability in a local installer?

I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code. Other than the fact that if ...
2
votes
1answer
8k views

known public exploits for vsftpd 2.0.1/2.0.5

I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits. The server I am working on has vsftpd 2.0.5 ...
3
votes
1answer
281 views

Is there a way to use multiple firewalls / antivirus for penetration testing?

I don't really know how to do either, but I was wondering if it was possible to have multiple firewalls / virus scanners installed at once, and use a 3rd party program to specify which one is running ...
5
votes
3answers
10k views

How can I use this path bypass/exploit Local File Inclusion?

I have tried to run a vulnerability scanning script (Uniscan 6.0) on some websites and then I found a site which is exploitable with this following path. (included a word "invalid" , params/website ...
2
votes
4answers
360 views

Writing exploit code that bypasses IPS detection

Suppose that Network IPS/IDS can detect an exploit, however, the application server itself is still vulnerable to that exploit. If I modify the exploit code, are there IPS/IDS which will still ...
6
votes
3answers
3k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
4
votes
2answers
543 views

Possible arbitrary file download vulnerablity

I am auditing a possible vulnerable piece of ASP code on a Windows enviroment. The code is as follows: If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then Basicly it is ...
10
votes
2answers
494 views

How to analyze a rootkit?

The other a friend of mine sent me a rootkit/code he found on a server that was exploited (php cgi exploit). Now I was thinking of having a look at it, but I was wondering if there are some basic ...
3
votes
1answer
255 views

A simple example for showing the use of Data Execution Prevention (DEP) security feature

I am finding it really hard to figure out why we need a DEP! Microsoft states this about DEP: The primary benefit of DEP is to help prevent code execution from data pages. Typically, code ...
2
votes
2answers
515 views

Possible website hack?

I have been receiving some strange requests on my website from foreign countries. For example, 218.83.152.252/judge112233.php, /www.travelimgusa.com/ip.php, //59.53.91.9/httpproxy/proxyheader.php, ...
0
votes
3answers
414 views

Code auditing and/or fuzzing - Books and resources

I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
1
vote
1answer
740 views

syn flood size per second

Given the size of a TCP packet is 60 bytes, there is a SYN Flood attack on a computer made ​​by a 100 Mb bandwidth, the question is how many syn packets are sent in a second? Is there any formula for ...
5
votes
2answers
1k views

Exploits or other security risks with SVG upload?

I have a site, where people can upload graphics, you might think of it like an image hoster or a forum for pictures. Now, I allow upload of raster graphics to a certain size, but no vector graphics ...
1
vote
0answers
289 views

making a start in finding exploits [closed]

I am a thorough newbie in computer security but the Google chrome exploit reward has gotten me interested in computer security and I would like to know what is an ideal starting point for one ...
3
votes
1answer
379 views

For what malicious activity can one use a computer with a high-end GPU?

I'm currently researching what malicious activities can one do with a computer containing a high-end GPU. So far the only uses I found were Bitcoin mining and password cracking. Are there any other ...
5
votes
1answer
90 views

Testing a chroot environment for privilege escalation vulnerabilities

I'm looking for holes in my current implementation of a chroot jail that I have implemented for a group of users. Is there anything I can do better here? I utilized the following packages: RHEL6 ...
1
vote
1answer
285 views

Metasploit Closing Connections?

Whenever I attempt to use an exploit (that I know will work) from Metasploit in Windows on a machine on my LAN, I always get the error Exploit exception: An established connection was aborted by ...
3
votes
1answer
4k views

Finding environment variables with gdb, to exploit a buffer overflow

I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL. I have never worked with BoF before, and ...
-1
votes
2answers
170 views

Is it Illegal to break out of a forum post by using CSS for example?

Is it illegal in the UK to post styling that breaks out of a post? For instance, if styling were allowed here and I were to use it to change some stackexchange pictures on this page, would that be ...
1
vote
1answer
262 views

Trying to land a shell on a remote service

Here's the scenario, part of a wargame/CTF type exercise. There is a vulnerable program running as a service on the remote host. I have access to a copy of the binary, which has a stack overflow from ...
0
votes
1answer
1k views

Backtrack 5 R2-64 bit cannot load database (postgres) help required?

I want some help regarding use of autpwm feature in backtrack 5 R2. I'm using bt5 (64 bit) on my dell inspiron N5110 laptop. I downloaded the copy fresh from the website and running it as dedicated ...
0
votes
1answer
304 views

Metasploit Exim4 String Format Overflow

The string format exploit affecting versions of Exim <= 4.69 cannot be used when Exim is running on port 465, considering authentication is required to relay messages through the mail server, ...
0
votes
1answer
3k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
0
votes
3answers
238 views

Does “Start the following program on connection” mean what I think it means?

In the Programs tab of Windows' RDP application, there is a Start the following program on connection option. Does On Connection literally mean on connection? As in will the program I specify be ...
5
votes
6answers
454 views

Determining vulnerable software on client machines

I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
5
votes
10answers
568 views

Can a compromised mobile phone be used to penetrate a desktop or server?

Can a compromised mobile phone be used to penetrate a desktop or server, such as when you plug the phone into the server or desktop for plug and play? I don't know what protocol the transfer is ...
0
votes
2answers
275 views

Unexplained downloading

I was just watching as my bandwidth monitor spiked downloading a file. I checked my current netstat and I didn't recognize one of the IPs so I started capturing the data with Wireshark. The ...