The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

2
votes
1answer
1k views

Can exploit vulnerability if program started with gdb, but segfaults if started without gdb

i'm currently trying to exploit a simple program called basic_vuln.c #include <stdio.h> int main(int argc, char** argv) { char buf[64]; strcpy(buf, argv[1]); } I'm using xubuntu ...
3
votes
3answers
263 views

Resources for building a network security curriculum

I am currently helping my teacher create a curriculum around IT Security because it isn't currently implemented. Some previous question had decent responses but I was wondering if there was more. My ...
1
vote
2answers
608 views

Spike in TCP port 5904 activity - what for?

There is an 'Internet Weather Report' on the Threat!Traq video blog by AT&T security researchers. In the March 14th broadcast, at around 31 minutes in, they mention an increase of scanning ...
2
votes
0answers
379 views

What is SPL exploit? [closed]

I recently worked on a web project that uses Javascript and PHP to load its content from flickr API. I kept on getting this image show up and disappear immediately during first 2 or 3 seconds of the ...
2
votes
2answers
788 views

how to bypass “header” in php

While reading an article I encounter an interesting thing I did not know about: if(!isset($_SESSION['usr_id']) || !isset($_SESSION['usr_name'])) { header('Location: index.php'); } ...Which ...
3
votes
1answer
416 views

Why is a separate reconnaissance server needed for DNS cache poisoning?

I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS). What I understand from the ...
1
vote
1answer
578 views

Win server 2003 sp2 'local' Privilege escalation via thin client

Just asking if there is any known exploit that allows a client connected a win server 2003 sp2 x64 via SunRay thin-client to infiltrate (or preform a local privilege escalation on) the server. The ...
1
vote
1answer
250 views

Compromised server with psyBNC - what are our next steps?

One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
1
vote
5answers
1k views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. ...
4
votes
4answers
2k views

Database hardening techniques

So as I understand it database hardening is a process in which you remove the vulnerabilities that result from lax con-figuration options. This can sometimes compensate for exploitable vendor bugs. ...
0
votes
1answer
139 views

Did I get hit by the recent Java exploit?

Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
32
votes
7answers
2k views

Is there a difference between GET and POST for web application security?

I have 2 choices in sending data between 2 web applications. I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters. ...
4
votes
5answers
3k views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
1
vote
4answers
1k views

My website has been hacked, what do i do next? [closed]

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask. My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
6
votes
2answers
1k views

What security standards and regulations are in place for bank ATM?

Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to ...
0
votes
2answers
2k views

Msf and exploitdb on Backtrack 5

Metasploit (msf) doesn't see exploits from exploitdb. I've just updated directory on my Backtrack cd /pentest/exploits/exploitdb svn update How can I load them now into msf? When i use a script ...
4
votes
2answers
892 views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
6
votes
3answers
2k views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
1
vote
6answers
8k views

Use PHP to check uploaded image file for malware?

I want my users to be able to upload a photo. Currently I am not checking the uploaded photo for problems of any kind, although I do limit the size to 32k. Is there any way for me to check uploaded ...
4
votes
2answers
1k views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
6
votes
2answers
241 views

Example of malware in the wild?

I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
7
votes
3answers
632 views

Risk Control - Ignored risks and accepted risks

Some say that ignored risks as part of an organization's behavior are much worse than accepted risks. I would like to test that axiom (in the eyes of some). When I am handling a risk and I choose to ...
5
votes
1answer
644 views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
3
votes
2answers
573 views

How was pentest performed in the era with no frameworks like Metasploit?

I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
0
votes
1answer
128 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
3
votes
1answer
274 views

How did the Tumblr worm spread?

Recently Tumblr was hit by a fast-spreading worm. How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
9
votes
4answers
272 views

What to do about companies that refuse to fix their security vulnerabilities

While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform ...
3
votes
1answer
295 views

Can TLS Compression be enabled on 3rd party CDN sites that have no authentication?

In this answer, @Thomas Pornin talks about remediating the CRIME attack and says: (It is a shame to have to remove SSL compression, because it is very useful to lower bandwidth requirements, ...
5
votes
2answers
229 views

Using format string to control the flow of a process?

I was cleaning up some code today on the advice of someone I know, and was made aware of the potential for a hacker to gain control over the flow of the process using format strings, particularly the ...
2
votes
3answers
2k views

Stack Overflow on ARM : Null Bytes Issue

I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link For the simple stack overflow exploitation, the code is : #include <stdio.h> #include <string.h> ...
2
votes
1answer
330 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
1
vote
1answer
91 views

sigsegv in php5.3.10

I found an overflow situation in php5.3.10. Probably it's not 'something new', but if I can understand this, it will help me to find this kind of bug faster in the future. What can I do to check ...
9
votes
3answers
2k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
2
votes
1answer
663 views

SafeSEH and x64

I read here that /SAFESEH is only valid when linking for x86 targets. /SAFESEH is not supported for platforms that already have the exception handlers noted. For example, on x64 and Itanium, ...
10
votes
4answers
2k views

Nessus Scan Port ID mapped to Metasploit Vulnerability exploits

My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities? My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
5
votes
1answer
380 views

Stack canaries protection and ROP

As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return. My question is: if I overwrite both EIP and stack ...
4
votes
2answers
1k views

Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?

Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
10
votes
2answers
6k views

How “leaking pointers” to bypass DEP/ASLR works

I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here: The only way to reliably bypass DEP and ASLR is through an pointer leak. This ...
2
votes
1answer
222 views

amd64 safer than 686-pae?

Apart from stronger ALSR entropy... Is a system using amd64 any safer than 686-pae? What are the advantages, if any?
3
votes
3answers
1k views

What are methods for preventing browser hooking / drive-by downloads?

This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this. With the advent of BeEF and more and more of the computers in networks being infected just by ...
1
vote
3answers
2k views

How to exploit DRUPAL-SA-CORE-2012-003

I have read the security notices and understand that it "would allow an attacker to reinstall an existing Drupal site with an external database server and then execute custom PHP code". According to ...
3
votes
3answers
1k views

Can malware on my computer infect my phone?

Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this? Relevance: Some banks use two-factor ...
6
votes
3answers
4k views

How to get this to buffer overflow?

I'm trying to understand buffer overflow, and am working with a simple piece of code, as below. #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { ...
4
votes
1answer
339 views

Need help on understanding obfuscated code in CVE-2012-4969 exploit

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation ...
1
vote
2answers
592 views

DVWA vulnerability list or guide?

Is there a list of vulnerabilities for DVWA, I cannot seem to find a vulnerability list or guide. By guide I mean an exhaustive list of vulnerabilities to work through.
6
votes
2answers
412 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
5
votes
1answer
439 views

In the light of recent information about RarVM, can we still trust RAR files?

See: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html https://github.com/taviso/rarvmtools It would seem according to these two sources that rar files can contain custom ...
2
votes
1answer
346 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
9
votes
4answers
5k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
1
vote
2answers
197 views

What's the right way to prevent shell bounce back?

When an exploit was successfully executed, is there a way to block the user from bouncing back a shell? I would like to know about this on both Windows and Linux machines.