The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

-1
votes
1answer
39 views

ROP: Use return value of function

Is it possible to call a function and store its return value in the next stack frame? So: call foo(); // int foo(); store return value of foo in next stack frame; call bar(int);
7
votes
0answers
219 views

iPhone 5/6 RAM security

I'm interested in how the RAM can be exploited in iPhone 5+, iOS 8+. I've previously discussed general iPhone encryption and from the response it reads: There are many exploits over the years ...
5
votes
0answers
93 views

Shared clipboard on Linux without keylogging, etc. vulnerabilities?

X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using ...
4
votes
0answers
55 views

Bluetooth vulnerabilities for Internet of Things demo

For a school assignment we have to talk about a certain topic within IoT. We chose security, and have to make a sort of live demo for it. So we 'hacked' up an rc-car, and attached an arduino to it ...
3
votes
0answers
196 views

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I ...
3
votes
0answers
58 views

How to analyse a suspicious Encapsulated Postscript file?

How can you analyze an encapsulated PostScript file that has a standard header, but is way too big? There is a EPS file which has a size of 1.8MB. When it is reconverted to EPS, the resulting file is ...
3
votes
0answers
66 views

How to notify Adobe about a software issue

Recently, I stumbled upon a way to reset the software trial of any product under the adobe suite. It's as simple as changing some attributes within a few files. I'm assuming that it can be deemed an ...
2
votes
0answers
38 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
2
votes
0answers
443 views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
2
votes
0answers
94 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
2
votes
0answers
279 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
2
votes
0answers
108 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
2
votes
0answers
81 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
2
votes
0answers
54 views

Execute form environmental variable while stack is not executable

Strange thing happened. I created EGG=NOPs + shellcode. Then i get the address of EGG; I made buffer overflow and jumped to it and get the shell(address of shell is the second parametr). How is this ...
2
votes
0answers
175 views

Older Cell / Smart phones were susceptible to bluesnarfing / bluetooth attacks, Why specifically are smartphones secure from this attack now?

Older cell / smart phones were susceptible to bluesnarfing / Bluetooth attacks, Nokia phones in particular. But now in days, modern smart phone and cell phones that use Bluetooth technology for ...
1
vote
0answers
21 views

How to exploit a stack-overflow without setting -mpreferred-stack-boundary=2

I have been playing with some wargames and I ported some of then on my Linux machine as well. I noticed that when not using -mpreferred-stack-boundary=2, gcc might compile "main" with an interesting ...
1
vote
0answers
78 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
1
vote
0answers
62 views

Address of DLL changes in Win XP SP3: CoreLan Exploit writing Tutorial part 1

I was following the CoreLan Exploit writing Tutorial Part 1. OS used: Windows XP SP3 I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] ...
1
vote
0answers
51 views

Passing arrays to a function call (Bufer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
1
vote
0answers
68 views

Possible exploit while MPLS parsing with Bottom of Stack bit

My current task to parse MPLS label in a packet and store them in to a list. When I check packets with MPLS: One can understand it is the last MPLS header by checking Bottom of Stack bit. If ...
1
vote
0answers
77 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
1
vote
0answers
195 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...
1
vote
0answers
49 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
1
vote
0answers
75 views

Local lan drive by download

Basically, I'm testing a local network, on which I'm able to use ARP spoofing. I now want to try and infect one of the Windows boxes on the network with a backdoor. I could inject an iframe into their ...
0
votes
0answers
7 views

Port explotation of servers

I'm voluntary scanning a website, not for money, but just for testing and learning. I decided that now I'll be looking for more complex vulnerabilities than just XSS and SQLi. So, I started scanning ...
0
votes
0answers
25 views

Encode metasploit

Using metasploit I generated an exploit exploit/windows/fileformat/ms14_017_rtf for windows 7 with windows/shell_reverse_tcp payload. In show advanced, I use option EnableContextEncoding true and it's ...
0
votes
0answers
45 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
0
votes
0answers
54 views

Is sharing with Direct Connect DC++ secure?

As I have some useful software that I want to share with friends and I don't like to get involved with torrents, DC++ (P2P client for sharing and chatting) seems a good way to do it, but I'm not sure ...
0
votes
0answers
32 views

Disguising as another computer using SMB Relay?

I've got a server that constantly checks for the existence of certain parameters on every PC in the web using SMB, if it fails to find those parameters it marks it as a rogue PC. I've understood that ...
0
votes
0answers
24 views

Is there any risk in allowing clients to be fed opengl shaders?

I'm working on a project that may eventually involve server specified fragment and vertex shaders. What are the possible risks of allowing a third party to send fragment/vertex shaders and execute ...
0
votes
0answers
83 views

Unable to execute shellcode in stack with no DEP

Here is the simplest example to show my problem. Everything is in WinXp sp3 with DEP disabled. char f() { // shellcode starting with some NOPs, char shellcode[400]= { 0x90, 0x90, ...
0
votes
0answers
353 views

Windows CTF/war games/reverse engineering/exploit challenges

War Games are fun but mainly deal with Linux reverse engineering. Example: http://blackbox.smashthestack.org:85/ Does anyone know of similar online games for Windows security?
0
votes
0answers
52 views

Malware or exploit kit without escalation kit

Does anyone know of any malware or exploit kit that do not use a privilege escalation kit and just do malicious things with an unprivileged permission?
0
votes
0answers
168 views

Exploiting buffer overflow

When I download a copy of a vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload), it works. However, when I made a same type of vulnerable program ...