The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

7
votes
2answers
298 views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
23
votes
10answers
4k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
1
vote
2answers
50 views

Can BadUsb only be delivered via USB?

BadUsb works by infecting a computer when plugged into the USB port. Is it also possible for an attacker who gains control of a system, such as remote access, to then infect any connected USB ...
76
votes
7answers
9k views

Why do I hear about so many Java insecurities? Are other languages more secure?

I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
7
votes
5answers
586 views

Can the BadUSB exploit be prevented?

Recently I read a few things about the BadUSB exploit, for example: http://arstechnica.com/security/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/ My understanding ...
3
votes
1answer
137 views

Closely spaced failed logins in auth.log

I have a raspberry-pi (running GNU/Linux) and I recently allowed my router to forward port 22 (ssh) to the raspberry-pi so that I could log in while away from home. I then noticed a bunch of ...
5
votes
4answers
1k views

Setting up a security CTF server

I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges. To sum it all up in a simple one-sentence question: How do you set up a server ...
170
votes
5answers
85k views

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
0
votes
1answer
51 views

Pivoting through XSS

I'll start off by saying this is a purely academic question; I'm trying to fill some gaps in my knowledge. If a website is vulnerable to XSS, and the target host is another machine that can browse to ...
5
votes
1answer
839 views

What kind of vulnerability would this exploit?

We're currently having our website pentested, and looking through our logs, a cookie we set (our allowCookies cookie) has had the value set to ...
1
vote
1answer
155 views

Exploiting shellshock

On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses ...
2
votes
1answer
157 views

Why “() { :;};”?

I was wanting to understand why the code below serves as a proof-of-concept for telling me whether my server is vulnerable or not. Moreover, how does the vulnerability work at lower-level? $ env ...
2
votes
2answers
56 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
0
votes
1answer
58 views

3 byte address of system call and exit call

i am trying to exploit a buffer overflow vulnerability in ubuntu (kernel version 3.0.0-12 generic i686) by using the method return to libc and the stack is not exploiting ? By while exploiting i ...
19
votes
3answers
1k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked. Check this out: ...
1
vote
1answer
31 views

How can non-secure or non-https-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and https-only and remaining 5 are neither. In this scenario, in what all ways can we ...
-3
votes
1answer
71 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
6
votes
2answers
5k views

How does the ShellShock exploit work over OpenSSH?

The three options listed in the CERT release (AcceptEnv TERM and SSH_ORIGINAL_COMMAND) are all server-side options. If none of these are set on a host (and no http vector is available) is the host ...
8
votes
1answer
468 views

What does this attempted Shellshock exploit do, and has my website been compromised?

I grepped my Apache's access.log today for the now infamous () { string, and besides a bunch of what seemed like pings to check how many servers are vulnerable, I found this attempt, which looked like ...
1
vote
1answer
61 views

Am I safe to see a thumbnail of a downloaded images on Ubuntu 14.04?

I have downloaded an image that someone has uploaded to my website with a public upload form. My intention was to copy the file in a virtual machine and see the image from there; unfortunately, on ...
3
votes
1answer
98 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
-1
votes
2answers
85 views

XSS InJavaScript

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
-4
votes
0answers
128 views

How to exploit bash shellshock expoit? [duplicate]

I am intersted how it works, can anyone to show me how to exploit this? I just wana learn how to do that, please do not spam if you can't help.
25
votes
4answers
11k views

Can A Powered Down Cell Phone be Turned On Remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the ...
-2
votes
1answer
50 views

Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]

I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
0
votes
1answer
391 views

Add third party exploit to metasploit under kali linux 1.0.6

I want to add custom exploits in metasploit running inside kali linux system version 1.0.6. I start using this methode : cd /root/.msf4 cd modules mkdir -p exploits/windows/browser mv ...
0
votes
1answer
32 views

What is the difference between XSS and Cross Site Flashing? [duplicate]

I want to know the basic differences between XSS and XSF
31
votes
9answers
4k views

Why is it a security problem not to update one's browser?

Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update? As part of this question, I would like to ...
3
votes
2answers
79 views

Is there any danger in allowing users to host PDF/RTF/DOC files on my web server?

If I were to allow users to host arbitrary PDF/RTF/DOC files on my server all under the same name, but with different query strings would there be anything to worry about? I've heard of PDF/RTF ...
-1
votes
1answer
61 views

Why should I use ROP for exploit dev? [closed]

Return Oriented Programming is a technique for bypassing DEP which based on ret2libc.. ROP is used for formatting the API function parameters in order to make a reliable shellcode.. I dont get ...
0
votes
1answer
202 views

Which shell is more secure, mksh or bash?

Which shell is more secure, mksh or bash? There has been some discussion pointing into the direction, that mksh is more secure. How to come to that conclusion? By looking which code was more audited ...
8
votes
2answers
854 views

Is this GET request an exploit attempt?

I've noticed a few requests like this to a Rails application I am maintaining: GET ...
2
votes
4answers
139 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
2
votes
1answer
161 views

is computrace a permanent backdoor?

I was reading about CompuTrace and this thing is pretty much a backdoor and irremovable. It's in the firmware, in the BIOS and survives formatting and even hard drive change and OS reinstalls. Some ...
0
votes
1answer
90 views

Are shell scripts / bash inherently less secure than other (script) languages such as python?

Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts? Or are shell scripts / bash less advisable for some tasks such as parsing ...
18
votes
1answer
453 views

EICAR Virus Test maliciously used to delete logs?

Today at work I was asked to test our anti-virus software on our Linux servers. I attempted to create a text file containing the EICAR Virus Test signature. The file was deleted instantly, ...
0
votes
1answer
97 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
5
votes
1answer
2k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
11
votes
7answers
2k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
1
vote
0answers
49 views

Shared clipboard on Linux without keylogging, etc. vulnerabilities?

X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using ...
4
votes
2answers
738 views

Possible arbitrary file download vulnerability

I am auditing a possible vulnerable piece of ASP code on a Windows environment. The code is as follows: If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then Basicly it is ...
3
votes
2answers
198 views

Small, Vulnerable apps for exploit training

I'm looking for some really small apps on Ubuntu for some bufferoverflow exploitation training. I don't want to start off with some huge apps. I know some sites like http://www.oldversion.com.de/ ...
2
votes
4answers
208 views

How should I defend against zero-day attack on SSH?

Vulnerabilities are discovered everyday. The recent Heart bleed attack caught many people off guard. I was wondering if a serious flaw was to be discovered that allows unfettered access to SSH, how ...
1
vote
2answers
678 views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
2
votes
2answers
1k views

Is OpenSSL CCS Injection (CVE-2014-0224) critical?

Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224. It allows man-in-the-middle attackers to consequently hijack sessions ...
1
vote
1answer
142 views

How do you stop a hacker with no IP and a dot for their HOST

The entry below is from the visitors log in c-panel Host: . /specific legimate-wordpress-post/ Http Code: 503 Date: Jul 24 09:28:06 Http Version: HTTP/1.1 Size in Bytes: 1118 Referer: ...
1
vote
2answers
109 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
4
votes
1answer
5k views

Finding environment variables with gdb, to exploit a buffer overflow

I have to exploit a very simple buffer overflow in a vulnerable C++ program for an assignment and I am not being able to find the environment variable SHELL. I have never worked with BoF before, and ...
8
votes
2answers
2k views

Exploiting PHP via GET params

To be clear, this is in the interest of ethical testing to secure an application on behalf of my work. Now that that's out of the way, here are the details: Un-sanitised GET params are used in a ...
3
votes
2answers
1k views

Reverse shell connections

Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice. Would not most servers restrict outgoing ...