The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

2
votes
0answers
18 views

Is there a way to get msfpayload to generate a regular cmd.exe reverse tcp shell? [on hold]

It looks like msfpayload now generates a powershell-based payload when you pass it windows/reverse_tcp_shell. Is there a way to generate a regular cmd.exe reverse shell instead? Thanks!
12
votes
2answers
496 views

Getting exploit reliability when using the off by one framepointer overwrite on linux

We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian ...
0
votes
1answer
104 views

how can I secure my static ip router?

hi I have a static ip and someone is hacking my computer trought it I tried to format my computer and making a clean install but he keeps penetrating it this time i tried to install the AV before ...
107
votes
5answers
51k views

What should a website operator do about the Heartbleed OpenSSL exploit?

CVE-2014-0160 http://heartbleed.com This is supposed to be a canonical question on dealing with the Heartbeat exploit. I run an Apache web server with OpenSSL, as well as a few other utilities ...
4
votes
1answer
172 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. Theo de Raadt had this to say: ... as long as you aren't using ...
1
vote
0answers
46 views

Local lan drive by download

Basically, I'm testing a local network, on which I'm able to use ARP spoofing. I now want to try and infect one of the Windows boxes on the network with a backdoor. I could inject an iframe into their ...
0
votes
2answers
523 views

Heartbleed client side attack: What can the attacker obtain? [duplicate]

If I have got this right in my head it would be a simple enough task to combine arp spoofing on a public WiFi to redirect clients to an evil SSL server which sends malformed heartbeat requests or to ...
5
votes
1answer
754 views

Does xkcd.com/1353 overstate heartbleed's capability?

Today's xkcd has characters discussing heartbleed: Megan: I mean, this bug isn't just broken encryption. Megan: It lets website visitors make a server dispense random memory contents. Megan: It's ...
1
vote
1answer
182 views

OpenSSL exploit [closed]

I have read about recent vulnerability in openssl. I tried to exploit one of my cloud servers where I run my web sites. I managed to get 64 KB of data. But what I managed to get was only HTML, CSS, ...
1
vote
1answer
144 views

Exploiting XP SP3 with local privilege escalation

I'm trying to exploit my virtual machine (windows xp sp3) by cve-2013-5065. I created exe from python script and ran on my virtual machine. It successfully spawned new shell but cmd.exe was not with ...
11
votes
1answer
455 views

Return-oriented programming: how to find a stack pivot

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
29
votes
6answers
2k views

Is there a difference between GET and POST for web application security?

I have 2 choices in sending data between 2 web applications. I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters. ...
1
vote
1answer
31 views

Is it possible to use a .Net payload with metasploit?

I'm not exactly sure how metasploit works when exploiting a target machine, and it has been a while since of played with it, so forgive me. Instead of using meterpreter as a payload in metasploit, ...
3
votes
1answer
319 views

How does SEH based exploit bypass DEP and ASLR?

I am new to structured exception handling based exploits. Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH) Can anybody explain the reason of ...
0
votes
3answers
260 views

Windows DLL Injection

In the past recent years of mine, I have been doing a lot of DLL injection with a few indie games and MMORPGs. I fully understand how to do it, and how it works for allowing these games to work not as ...
0
votes
0answers
27 views

Exploit.Win32.CVE-2010-2568.gen malware detected [migrated]

I am not very good with computers. Actually, I am very bad :( so if you are willing to answer my question, could you please explain your answer in very simple terms, like to a complete dummy? Thanks ...
0
votes
2answers
108 views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
1
vote
1answer
58 views

How can I verify my machine is not vulnerable from a specific exploit?

I'm running Ubuntu 8.04 TLS linux 2.6.24-23, I find that CVE-2009-2692 which exploits by using sock_sendpage() null pointer dereference. It describes this exploit affects linux version prior to 2.6.31 ...
1
vote
2answers
99 views

WordPress Private Expoit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
1
vote
1answer
67 views

A renamed exe automatically running

We are currently developing a web app that allows users to upload files to act as attachments to information they provide. Obviously allowing users to upload any file types is very dangerous, ...
4
votes
1answer
84 views

ROP resistant gadgetless binaries

G-Free: defeating return-oriented programming through gadget-less binaries This paper describes what seems like a really cool technique to prevent ROP attacks if the source is availible. They use an ...
2
votes
3answers
334 views

How to determine the size of payloads available in MetaSploit

I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do. However, ...
19
votes
8answers
2k views

How could someone exploit the OS an ATM is running?

As I'm sure many of you have heard, the end of support for Windows XP is the supposed apocalypse for ATM's worldwide. I am cognizant of the fact that this ensures that no more patches are issued, and ...
4
votes
3answers
2k views

How to get this to buffer overflow?

I'm trying to understand buffer overflow, and am working with a simple piece of code, as below. #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { ...
5
votes
1answer
615 views

Recent Fritz Box exploit

Background info: About 50% of the ADSL and cable internet access in Germany (and presumably parts of the EU) goes over AVM Fritz routers, either verbatim or rebranded as e.g. "1&1 Home Server" or ...
1
vote
3answers
88 views

Exploiting through a filtered port

I'm doing some pentesting against a machine the lecturer set up in the lab. NMAP shows port 445 to be filtered and Nessus confirms the ms08_067 vulnerability is present on that machine. I tried ...
-1
votes
1answer
181 views

Can this code be expoited using Buffer Overflow?

I have a piece of code which contains an obvious buffer overflow at strcpy(buf, x) since it doesn't check if buf is large enough to fit the string x. I'm wondering how to actually exploit this bug. ...
23
votes
4answers
5k views

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...
67
votes
5answers
1k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
0
votes
1answer
41 views

Automatic exploit searches

How to automatically search and download exploits which matches for example with kernel release ? Is there for example a public REST web service which provide data in XML or JSON format to a client ...
1
vote
2answers
126 views

Python exploit question?

Can someone please explain how and why this struct.pack code is used in the below exploit? I'm trying to understand how it triggers the vulnerability. I understand the buffer overflow aspect, I'm ...
9
votes
4answers
1k views

Nessus Scan Port ID mapped to Metasploit Vulnerability exploits

My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities? My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
2
votes
1answer
728 views

CentOS - Local privilege escalation - CVE-2012-0056

I have a server with these properties : cat /etc/lsb-release ...
0
votes
2answers
227 views

Can I exploit Windows kernel from user-mode application?

In this document is detailed technique of exploiting Windows kernel. But writer is talking about accessing kernel memory & doing exploit from user-mode application at the same time. Can I do this ...
-6
votes
1answer
79 views

How can mp3blaster vulnerability affect my linux OS? [closed]

Mp3blaster is a terminal mp3 player running a UNIX-like operating system, e.g. Linux, Free/Net/OpenBSD, etc. I usually use this player for playing my music, but yesterday I found a blog which claim ...
0
votes
1answer
60 views

Using buffer overflow on word with macro injection

I know how a buffer overflow works on a local network against an application running on a TCP port, assuming it doesn't drop the connection, but I would like some advice on an "exploit" I would like ...
0
votes
1answer
60 views

Looking For Compiled Version of Metasploit Local Windows Exploits [closed]

I am looking to have a standalone compiled exploits for all local windows exploits that Metasploit has right now. I was wondering if somebody has done this before or know a place that has these ...
1
vote
1answer
40 views

Why stack is not at the same address when exec running in GDB

During writing some basic challenges, I discover that the exploits are not working if not launched in GDB. To test this behavior, the following program print register values and code address: ...
4
votes
1answer
103 views

Why would a user agent string be executed?

I'm having trouble understanding how a particular XSS vulnerability might arise in the real world. Guides for two of the exercises on hackthissite.org: ...
-2
votes
1answer
46 views

websites with vulnerabilities INFO [duplicate]

Websites like http://www.cvedetails.com/ http://www.securityfocus.com This websites show information about vulnerabilities and exploits, which other sites are similar?
2
votes
3answers
138 views

Does the principle of the CRIME & BEAST attack affect VPNs?

I was recently reading about the attacks on SSL/TLS that CRIME and BEAST were able to exploit by attacking the compression in the secure session. Upon reading this I remembered that OpenVPN has ...
0
votes
1answer
55 views

Why does this buffer overflow have payload &system-&exit-&BINSH

I'm following a tutorial to write a simple buffer overflow. I have (basic) knowledge of assembly, and the stack. I've written a stack based buffer overflow before and understood it. The program I'm ...
67
votes
9answers
68k views

Can webcams be turned on without the indicator light?

I want to know how secure I am. I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a ...
1
vote
1answer
215 views

Reverse TCP connection from exploited SearchIndexer.exe failing

I'm working on a tool that exploits SearchIndexer.exe on Windows 7 x86 and connects back to a metasploit multi/handler, using standard metasploit reverse TCP stagers. The exploit seems to function as ...
4
votes
2answers
398 views

Cell phone voice mail hacking

The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, ...
1
vote
2answers
121 views

How do arbitrary payloads execute on the remote machine?

I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command ...
8
votes
2answers
298 views

Are userid and password needed in order to pentest a website?

We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
-1
votes
2answers
144 views

Automatically search Metasploit for useable exploits based on vulnerabilties in the database

Is it possible to automatically search the Metasploit database for usable exploits based on information about the vulnerabilities on the hosts? Searching in Metasploit for each CVE number to see if ...
0
votes
1answer
41 views

Installing a custom SSL Certificate For Local Proxy. Safe?

I've been writing some software for over a year that is a sort of browsing security/privacy application. One of the features of this software is that it uses a local HTTP proxy for some content ...
4
votes
1answer
380 views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...