The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

1
vote
1answer
381 views

Lots of 'unidentified exploits' detected with w3af

I've been running some scans across a few different networks and on certain sites I will get a flag about an unidentified exploit in the log. When I review what the exploit is, most of the time its a ...
1
vote
1answer
57 views

Dangers of a vulnerability in a local installer?

I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code. Other than the fact that if ...
2
votes
1answer
7k views

known public exploits for vsftpd 2.0.1/2.0.5

I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits. The server I am working on has vsftpd 2.0.5 ...
2
votes
4answers
359 views

Writing exploit code that bypasses IPS detection

Suppose that Network IPS/IDS can detect an exploit, however, the application server itself is still vulnerable to that exploit. If I modify the exploit code, are there IPS/IDS which will still ...
5
votes
3answers
10k views

How can I use this path bypass/exploit Local File Inclusion?

I have tried to run a vulnerability scanning script (Uniscan 6.0) on some websites and then I found a site which is exploitable with this following path. (included a word "invalid" , params/website ...
10
votes
2answers
493 views

How to analyze a rootkit?

The other a friend of mine sent me a rootkit/code he found on a server that was exploited (php cgi exploit). Now I was thinking of having a look at it, but I was wondering if there are some basic ...
4
votes
2answers
540 views

Possible arbitrary file download vulnerablity

I am auditing a possible vulnerable piece of ASP code on a Windows enviroment. The code is as follows: If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then Basicly it is ...
3
votes
1answer
253 views

A simple example for showing the use of Data Execution Prevention (DEP) security feature

I am finding it really hard to figure out why we need a DEP! Microsoft states this about DEP: The primary benefit of DEP is to help prevent code execution from data pages. Typically, code ...
2
votes
2answers
514 views

Possible website hack?

I have been receiving some strange requests on my website from foreign countries. For example, 218.83.152.252/judge112233.php, /www.travelimgusa.com/ip.php, //59.53.91.9/httpproxy/proxyheader.php, ...
1
vote
1answer
737 views

syn flood size per second

Given the size of a TCP packet is 60 bytes, there is a SYN Flood attack on a computer made ​​by a 100 Mb bandwidth, the question is how many syn packets are sent in a second? Is there any formula for ...
1
vote
0answers
288 views

making a start in finding exploits [closed]

I am a thorough newbie in computer security but the Google chrome exploit reward has gotten me interested in computer security and I would like to know what is an ideal starting point for one ...
3
votes
1answer
379 views

For what malicious activity can one use a computer with a high-end GPU?

I'm currently researching what malicious activities can one do with a computer containing a high-end GPU. So far the only uses I found were Bitcoin mining and password cracking. Are there any other ...
5
votes
1answer
85 views

Testing a chroot environment for privilege escalation vulnerabilities

I'm looking for holes in my current implementation of a chroot jail that I have implemented for a group of users. Is there anything I can do better here? I utilized the following packages: RHEL6 ...
1
vote
1answer
316 views

Shellcode for higher file privileges

I'm learning exploits from the book Hacking: The Art of Exploitation. The shellcode below was written to enable higher privilege access to files. \x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80 ...
3
votes
1answer
174 views

How to protect against exploitation of email addresses from an mistakenly expired domain?

I have a domain name that I have registered for a long time. Due to a combination of bad luck and oversight, the domain name expired and was rebought by somebody else. I am attempting to buy the ...
6
votes
3answers
3k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
0
votes
3answers
413 views

Code auditing and/or fuzzing - Books and resources

I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
-1
votes
2answers
169 views

Is it Illegal to break out of a forum post by using CSS for example?

Is it illegal in the UK to post styling that breaks out of a post? For instance, if styling were allowed here and I were to use it to change some stackexchange pictures on this page, would that be ...
0
votes
1answer
1k views

Backtrack 5 R2-64 bit cannot load database (postgres) help required?

I want some help regarding use of autpwm feature in backtrack 5 R2. I'm using bt5 (64 bit) on my dell inspiron N5110 laptop. I downloaded the copy fresh from the website and running it as dedicated ...
0
votes
1answer
304 views

Metasploit Exim4 String Format Overflow

The string format exploit affecting versions of Exim <= 4.69 cannot be used when Exim is running on port 465, considering authentication is required to relay messages through the mail server, ...
3
votes
2answers
872 views

How to use attack trees and attack graphs

I am trying to understand how attack trees\graphs can be used in the security process. I read a lot of papers presenting the topic and how this reppresentation can be useful, but I really don't ...
1
vote
1answer
284 views

Metasploit Closing Connections?

Whenever I attempt to use an exploit (that I know will work) from Metasploit in Windows on a machine on my LAN, I always get the error Exploit exception: An established connection was aborted by ...
0
votes
1answer
3k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
6
votes
2answers
194 views

Security Researchers: How do you choose what services or software you are going to audit next?

Security Researchers: How do you choose what services or software you are going to audit next? I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
0
votes
3answers
237 views

Does “Start the following program on connection” mean what I think it means?

In the Programs tab of Windows' RDP application, there is a Start the following program on connection option. Does On Connection literally mean on connection? As in will the program I specify be ...
3
votes
1answer
4k views

Finding environment variables with gdb, to exploit a buffer overflow

I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL. I have never worked with BoF before, and ...
0
votes
2answers
274 views

Unexplained downloading

I was just watching as my bandwidth monitor spiked downloading a file. I checked my current netstat and I didn't recognize one of the IPs so I started capturing the data with Wireshark. The ...
3
votes
2answers
573 views

Compromised server redirecting only requests from Google

I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away: # host ...
7
votes
1answer
1k views

How will security need to be changed if P=NP?

If we suppose that it is found that P=NP, how will security measures need to be changed? I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
18
votes
4answers
8k views

Can A Powered Down Cell Phone be Turned On Remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the ...
4
votes
1answer
590 views

How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?

I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like ...
6
votes
1answer
290 views

Epson Projector security threats

I have an EPSON PROJECTOR (model EB-824H) And I would like to use it in our company. As I know (but not sure) this kind of projector has no WIFI,no network card and there is no HD in this PROJECTOR It ...
7
votes
3answers
470 views

How to gain a shell?

I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user. My question is this: I can create application that is guaranteed to be run by the ...
2
votes
1answer
856 views

Help in understanding a PHP exploit code found on a wordpress application

I've found this code in base 64 on all php files of one of my client's sites (wordpress) and I'm trying to understand what it does. I'm also trying to figure out if it was an application exploit or a ...
6
votes
5answers
579 views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
3
votes
1answer
199 views

How do attackers gather remote feedback for identifying and exploiting buffer overflows?

Local buffer overflows are relatively easy to understand: throw some input at an interface and see if the process fails with a core dump or similar. However, in my mind, this kind of exploit works ...
5
votes
10answers
567 views

Can a compromised mobile phone be used to penetrate a desktop or server?

Can a compromised mobile phone be used to penetrate a desktop or server, such as when you plug the phone into the server or desktop for plug and play? I don't know what protocol the transfer is ...
1
vote
1answer
262 views

Trying to land a shell on a remote service

Here's the scenario, part of a wargame/CTF type exercise. There is a vulnerable program running as a service on the remote host. I have access to a copy of the binary, which has a stack overflow from ...
5
votes
2answers
1k views

Exploits or other security risks with SVG upload?

I have a site, where people can upload graphics, you might think of it like an image hoster or a forum for pictures. Now, I allow upload of raster graphics to a certain size, but no vector graphics ...
1
vote
2answers
2k views

Find the hack in the Apache2 logs?

The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss). So I looked in the Apache2 logs and ...
2
votes
3answers
132 views

I want to implement a new type of security feature over several platforms

I want to make a security feature that will go farther in discouraging people from looking through a secure system or server than what I have seen being implemented. Specifically, is there a way (or ...
6
votes
4answers
693 views

if the hypervisor is hacked are all guests affected as well?

I'm guessing that all guests would be screwed, if the hypervisor is hacked. I found this article, but it seems to be more focused on privilege escalation of guests. I'm more interested to hear about ...
6
votes
1answer
357 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
3
votes
1answer
281 views

Is there a way to use multiple firewalls / antivirus for penetration testing?

I don't really know how to do either, but I was wondering if it was possible to have multiple firewalls / virus scanners installed at once, and use a 3rd party program to specify which one is running ...
13
votes
1answer
519 views

SCADA / PLC exploit code was released in metasploit. Now what?

Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities. They say it's so easy, the ...
2
votes
1answer
301 views

Possible Hijacked Email Server [closed]

MAILER-DAEMON notices are spamming our email administrator account, causing it to fill up, and bringing down our email server. Our email server is a Virtual FreeBSD box hosted by Verio. Their ...
6
votes
2answers
387 views

Videos and visual tutorials on Format String Vulnerabilities

Anyone know of good format string vulnerability tutorials/videos that demo how to test on a web app, such as modifying the URL. I've watched Vivek's videos from securitytube and another from ...
0
votes
3answers
301 views

How to rewrite config files using SNMP?

I scanned a router and found that the community string is public. The write access is also enabled. Now I want to change the configuration of the router. Can anybody tell me about tools and tutorials ...
9
votes
2answers
1k views

Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?

My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
6
votes
3answers
1k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are: 2010-1917, ...