The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

184
votes
3answers
41k views

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
107
votes
5answers
50k views

What should a website operator do about the Heartbleed OpenSSL exploit?

CVE-2014-0160 http://heartbleed.com This is supposed to be a canonical question on dealing with the Heartbeat exploit. I run an Apache web server with OpenSSL, as well as a few other utilities ...
82
votes
15answers
13k views

What “hacking” competitions/challenges exist? [closed]

I have always enjoyed trying to gain access to things I'm not really supposed to play around with. I found Hack This Site a long time ago and I learned a lot from it. The issue I have with HTS is that ...
67
votes
5answers
1k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
66
votes
9answers
68k views

Can webcams be turned on without the indicator light?

I want to know how secure I am. I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a ...
41
votes
3answers
3k views

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var ...
29
votes
6answers
2k views

Is there a difference between GET and POST for web application security?

I have 2 choices in sending data between 2 web applications. I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters. ...
26
votes
2answers
6k views

How do ASLR and DEP work?

How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
24
votes
6answers
2k views

Most secure way to partition linux?

I recently acquired a netbook to play with, and I want to install Kali Linux so I can start learning about network security and exploit development. I want to use this to learn as much about security ...
23
votes
4answers
5k views

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...
21
votes
10answers
3k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
21
votes
3answers
9k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
20
votes
2answers
529 views

Aviation security - Lessons to learn from PlaneSploit

A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level. Now we have a presentation by Hugo Teso from n.runs AG ...
19
votes
8answers
2k views

How could someone exploit the OS an ATM is running?

As I'm sure many of you have heard, the end of support for Windows XP is the supposed apocalypse for ATM's worldwide. I am cognizant of the fact that this ensures that no more patches are issued, and ...
18
votes
4answers
8k views

Can A Powered Down Cell Phone be Turned On Remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the ...
18
votes
3answers
682 views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked. Check this out: ...
18
votes
1answer
1k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
17
votes
7answers
1k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
16
votes
4answers
2k views

What is the corrupted image vulnerability? How does it work?

What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
15
votes
4answers
1k views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
15
votes
3answers
2k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
14
votes
3answers
2k views

What is the difference between Exploit and Payload?

In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
13
votes
1answer
518 views

SCADA / PLC exploit code was released in metasploit. Now what?

Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities. They say it's so easy, the ...
12
votes
3answers
960 views

Bypassing Address Space Layout Randomization

How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
12
votes
2answers
2k views

Why is 0x41414141 associated with security exploits?

This article and this search suggest that the 32-bit word 0x41414141 is associated to security exploits. Why is 0x41414141 associated to security exploits?
12
votes
5answers
537 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
12
votes
2answers
856 views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
12
votes
2answers
492 views

Getting exploit reliability when using the off by one framepointer overwrite on linux

We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian ...
11
votes
7answers
986 views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
11
votes
6answers
361 views

Can a website determine what OS or webbrowser a visitor is using if the useragent is blanked/changed?

Assume that a visitor to a website has changed his useragent to something like the following, but he's using linux: Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0 Assume that the ...
11
votes
1answer
442 views

Return-oriented programming: how to find a stack pivot

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
10
votes
2answers
255 views

How to protect against exploitation using a lapsed domain

Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain ...
10
votes
3answers
444 views

How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?

There are several commercial exploit kits available containing 0day vulnerabilities: White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml Agora Exploit Pack ...
10
votes
2answers
492 views

How to analyze a rootkit?

The other a friend of mine sent me a rootkit/code he found on a server that was exploited (php cgi exploit). Now I was thinking of having a look at it, but I was wondering if there are some basic ...
10
votes
1answer
544 views

Help in understanding an application's crash - exploitable?

Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
9
votes
4answers
242 views

What to do about companies that refuse to fix their security vulnerabilities

While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform ...
9
votes
2answers
685 views

Why is Firesheep Unable to Session Hijack over SSL?

Why is Firesheep unable to session hijack when a user is using SSL?
9
votes
2answers
1k views

Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?

My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
9
votes
2answers
3k views

How “leaking pointers” to bypass DEP/ASLR works

I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here: The only way to reliably bypass DEP and ASLR is through an pointer leak. This ...
9
votes
4answers
1k views

Nessus Scan Port ID mapped to Metasploit Vulnerability exploits

My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities? My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
8
votes
2answers
296 views

Are userid and password needed in order to pentest a website?

We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
8
votes
6answers
484 views

Doing a demo about open wireless networks exploiting with Firesheep

A collegue and I have been asked to do a demo where we show off stealing Facebook sessions with Firesheep. I've never used Firesheep before myself, but I reckon it should be a simple task. I know the ...
8
votes
4answers
528 views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
8
votes
3answers
1k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
8
votes
2answers
1k views

Exploiting PHP via GET params

To be clear, this is in the interest of ethical testing to secure an application on behalf of my work. Now that that's out of the way, here are the details: Un-sanitised GET params are used in a ...
7
votes
3answers
600 views

Is this GET request an exploit attempt?

I've noticed a few requests like this to a Rails application I am maintaining: GET ...
7
votes
2answers
5k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
7
votes
1answer
1k views

How will security need to be changed if P=NP?

If we suppose that it is found that P=NP, how will security measures need to be changed? I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
7
votes
4answers
391 views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...
7
votes
3answers
2k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...