The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

12
votes
4answers
8k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
8
votes
2answers
99 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
1
vote
0answers
36 views

SS7 exploit on the wiretapping part

Wondering if there are info/source code/guide on the SS7 wiretapping part (SMS interception). I had a look on the track any mobile by a German researcher, and on PTsecurity about how the structure ...
5
votes
2answers
85 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
2
votes
1answer
21 views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
-5
votes
0answers
13 views

How would you verify if you are a victim of custom data file attack? [on hold]

I was reading the post "Could you write custom data to a file of a specific extension and use it to hack a program once it opens the file?" Assuming you are a victim of such an attack, how would you ...
4
votes
1answer
46 views

Unable to overwrite EIP register

Source code for both programs at the end of the post So, I've working through Hacking: The Art Of Exploitation, and so far so good. I've managed to control EIP in the vulnerable program notesearch.c. ...
0
votes
0answers
15 views

Is the Meterpreter stager threaded? [closed]

I've been trying to google an answer for this but can't seem to find one. Is the Meterpreter stager threaded? That is, when it's executed, does the program spawn a new thread to download Meterpreter ...
0
votes
1answer
79 views

Unauthorized credit card payment

I have a debit card which links to my savings account in a let's call it Bank A. I had never used it for online purchases/transactions (not even interbank transfer). After a while, I purchased virtual ...
1
vote
0answers
36 views

How to remotely upload a file on linux and windows (without netcat or ssh)

With meterpreter from metasploit, there is an option (windows or linux victim) to upload files on the victim device. I searched in the metasploit-framework in order to find the script that does the ...
1
vote
3answers
148 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
8
votes
3answers
955 views

Is a HTML form tag more exploitable than a HTML link in user submitted content?

I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application. The editor component I have used automatically removes any script ...
-2
votes
0answers
11 views

Double Free - crash or no crash [migrated]

Can someone explain me why freeing a twice in a row causes a crash, but freeing a first, then b, and then a again does not crash? I know that a free will insert the heap chunk in a double linked free ...
7
votes
3answers
133 views

I anonymously submitted a security vulnerability, but it was not resolved. What now?

This is more or less a continuation of my previous question: As a student, how do I safely and responsibly disclose a serious security issue in a school environment? More than four months on after I ...
8
votes
1answer
148 views

Bluetooth vulnerabilities for Internet of Things demo

For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it ...
-1
votes
3answers
51 views

What is the future of exploitations? [closed]

With the advent of "Safe" languages like Rust, the prevalence of Software Correctness, and improved type checking in existing systems, memory based exploits are very hard if not possible at all, to ...
-1
votes
1answer
56 views

Does it make sense to restrict the usage of Metasploit in Penetration testing exams ? [closed]

In some PT exams (mainly Offensive Security's) they restrict the usage of Metasploit or any automated attacking tool and allow only for manually written\compiled codes from public exploit sites such ...
2
votes
0answers
27 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
6
votes
2answers
995 views

Exploiting Writeable SNMP

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches). I'm aware of the ...
3
votes
1answer
65 views

ROP chain on x64, get rid of nulls

So I have this ROP chain for x64 architecture: 0x0000000000400b60: pop rdi; ret; 0x482cf5 0x68732f6e69622f ('/bin/sh') 0x401550 <system> In Payload: ...
6
votes
1answer
113 views

Shared clipboard on Linux without keylogging, etc. vulnerabilities?

X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using ...
2
votes
0answers
38 views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
2
votes
1answer
61 views

How do self-contained executable program exploits work, when considering virtual memory?

My understanding of virtual memory is that the operating system allows each process to have access to the entire pool of memory, and creates this illusion by paging. As a consequence, a program can ...
16
votes
2answers
2k views

Could you write custom data to a file of a specific extension and use it to hack a program once it opens the file?

From what I understand file extensions don't really affect the data contained within them at all. They just give your computer a hint of what the data is, how it's structured and your computer then ...
9
votes
1answer
1k views

iPhone 5/6 RAM security

I'm interested in how the RAM can be exploited in iPhone 5+, iOS 8+. I've previously discussed general iPhone encryption and from the response it reads: There are many exploits over the years ...
2
votes
0answers
128 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
0
votes
1answer
26 views

What do the [-], [+], [!] line prefixes mean in exploit outputs?

When you're using exploits, in the output, every line is prefixed with a symbol inside a set of square brackets. For example: [+] Set arguments. [-] Running exploit. [!] Warning server returned 404. ...
2
votes
2answers
130 views

Install a vulnerable service for Windows 7

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell. I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
3
votes
1answer
413 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
-3
votes
1answer
124 views

With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? [closed]

So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs ...
0
votes
1answer
940 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
3
votes
2answers
82 views

Is it possible to crack g++ rand()?

So, I have this: I know that some code was used to generate a random sequence, and it looked roughly like this: #include <iostream> #include <string> int main() { const std::string ...
2
votes
2answers
80 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
110
votes
9answers
126k views

Can webcams be turned on without the indicator light?

I've made a series of penetration tests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a stealth thing, but what ...
-6
votes
0answers
102 views

Privilege escalation exploit for Ubuntu 9.04

For an IT security class, I am looking for a privilege escalation exploit on (unpatched) Ubuntu 9.04 in the form of a Metasploit module. I already tried two exploits as described in this thread, but ...
0
votes
1answer
44 views

Malicious tracking script being served from google server to circumvent block lists

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit. Thing is, its stored on a google server in a directory it really shouldnt be. ...
2
votes
3answers
73 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
-3
votes
2answers
56 views

How to find Use-After-Free vulnerbilities? [closed]

I followed a lot of tutorials about the exploitation of UAF vulnerabilities, but there was never explained how to find and detect uaf vulnerabilities in javascript or html (i.e. with a static analysis ...
6
votes
2answers
171 views

Cost of finding vulnerabilities vs developing exploits

From the perspective of someone who wants to develop a zero-day exploit against some software application or target, there are broadly speaking two tasks that the attacker must do: (1) find a new ...
1
vote
2answers
52 views

Is it possible to plan for race conditions?

Is it possible to plan for race conditions, so that you can execute specific commands at a specific time? For example, the following code is vulnerable to a race condition. Is it possible to modify ...
1
vote
0answers
44 views

Windows 7 remote desktop access to utilman or stickykeys?

Is anyone aware of a windows 7 procedure where the attacker is able to access the host machine remotely via RDP on port 3389, and implement the utilman and/or stickykey exploit? afaik the utilman ...
2
votes
1answer
77 views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
3
votes
2answers
177 views

Should ability to access login page after authentication be considered a security flaw?

On one of the recent engagements, I bumped into something I have not seen before: after successful authentication attempt the user still can access the login web page and login as another user. It ...
0
votes
2answers
86 views

Are regular expressions vulnerable to code injection?

Aside from having an excessive input length, is there a way of doing an exploit with a regular expression (assuming the underlying language/platform is secure)? Practically I was wondering if the ...
43
votes
3answers
35k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
4
votes
1answer
61 views

Armitage check exploit

I am with all fairness not the most experienced penetration tester, I am doing an industry placement where I can improve my skills. I am using Armitage in Kali Linux to check for vulnerabilities in ...
4
votes
2answers
384 views

I think my site was hacked. Can someone explain the “GET / HTTP/1.0” garbage in my Apache log, and what it's doing?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! ...
32
votes
10answers
6k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
13
votes
3answers
713 views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
2
votes
1answer
77 views

Sqlmap, how to move forward? [duplicate]

So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and ...