The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.
151
votes
3answers
33k views
CRIME - How to beat the BEAST successor?
With the advent of CRIME, BEASTs successor, what is possible protection is available for an individual and / or system owner in order to protect themselves and their users against this new attack on ...
68
votes
13answers
6k views
What “hacking” competitions/challenges exist?
I have always enjoyed trying to gain access to things I'm not really supposed to play around with. I found Hack This Site a long time ago and I learned a lot from it. The issue I have with HTS is that ...
48
votes
7answers
38k views
Can webcams be turned on without the indicator light?
I want to know how secure I am.
I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone.
Recording an end-user's microphone seems to be a ...
23
votes
6answers
1k views
Is there a difference between GET and POST for web application security?
I have 2 choices in sending data between 2 web applications.
I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters.
...
21
votes
2answers
3k views
How do ASLR and DEP work?
How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
19
votes
2answers
364 views
Aviation security - Lessons to learn from PlaneSploit
A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level.
Now we have a presentation by Hugo Teso from n.runs AG ...
16
votes
7answers
835 views
How would you exploit this vulnerability in order to cause max damage
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
15
votes
4answers
889 views
What is the easiest way to search massive, leaked databases for persons and personal information?
This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be!
A while ago a very MASSIVE database was leaked that contained ...
15
votes
3answers
4k views
Can A Powered Down Cell Phone be Turned On Remotely?
I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the ...
14
votes
9answers
2k views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
14
votes
3answers
4k views
Stack Overflows - Defeating Canaries, ASLR, DEP, NX
To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
13
votes
4answers
1k views
What is the corrupted image vulnerability? How does it work?
What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
12
votes
3answers
741 views
Bypassing Address Space Layout Randomization
How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
11
votes
3answers
748 views
What is the difference between Exploit and Payload?
In computer security, we know that weak points in software are called vulnerabilities (if related to security). And once the vulnerability is found, theoretically it requires a piece of code as proof ...
11
votes
5answers
461 views
What is the potential impact of the alleged OpenBSD IPSEC attack?
Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have.
For instance, does ...
11
votes
3answers
1k views
How can I be protected from pictures vulnerabilities?
I've just read this question What is the corrupted image vulnerability? How does it work?
(GIFAR, EXIF data with javascript, etc..)
I'm asking myself how can I protect myself and my website's users.
...
11
votes
2answers
327 views
Where to report malicious URLs, phishing, and malicious web sites?
I recently discovered that my web designer was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked.
Check this ...
10
votes
2answers
235 views
How to protect against exploitation using a lapsed domain
Consider a domain that had been in active use for some time but is no longer desired — perhaps the company is out of business or a name change took place years ago, or whatever. The domain ...
10
votes
2answers
412 views
How to analyze a rootkit?
The other a friend of mine sent me a rootkit/code he found on a server that was exploited (php cgi exploit).
Now I was thinking of having a look at it, but I was wondering if there are some basic ...
10
votes
1answer
386 views
SCADA / PLC exploit code was released in metasploit. Now what?
Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities.
They say it's so easy, the ...
9
votes
4answers
223 views
What to do about companies that refuse to fix their security vulnerabilities
While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform ...
9
votes
2answers
1k views
How “leaking pointers” to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This ...
8
votes
6answers
422 views
Doing a demo about open wireless networks exploiting with Firesheep
A collegue and I have been asked to do a demo where we show off stealing Facebook sessions with Firesheep. I've never used Firesheep before myself, but I reckon it should be a simple task.
I know the ...
8
votes
2answers
927 views
Why is 0x41414141 associated with security exploits?
This article and this search suggest that the 32-bit word 0x41414141 is associated to security exploits.
Why is 0x41414141 associated to security exploits?
8
votes
2answers
570 views
Why is Firesheep Unable to Session Hijack over SSL?
Why is Firesheep unable to session hijack when a user is using SSL?
8
votes
2answers
553 views
Protecting cellphones from USB attacks (a.k.a. Juice Jacking)
We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB.
The visual assumption ...
8
votes
3answers
779 views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
8
votes
2answers
1k views
Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?
My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
8
votes
4answers
623 views
Nessus Scan Port ID mapped to Metasploit Vulnerability exploits
My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities?
My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
7
votes
3answers
413 views
How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?
There are several commercial exploit kits available containing 0day vulnerabilities:
White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml
Agora Exploit Pack ...
7
votes
3answers
385 views
How to gain a shell?
I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user.
My question is this: I can create application that is guaranteed to be run by the ...
7
votes
4answers
354 views
How should I escalate a vulnerability that is dismissed by the vendor?
I've come across a vulnerability that secure@microsoft does not think is worth pursuing.
I would estimate that there are many, many customers affected by this issue.
I do not want to start a ...
7
votes
3answers
859 views
How does BeEF work? (working understanding)
I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
7
votes
2answers
209 views
How a malware executes remote payload
Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
7
votes
2answers
352 views
Local File Download vulnerability - What files can be downloaded to potentially compromise a windows system?
On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which ...
7
votes
1answer
325 views
A practical .NET Remoting Architecture exploit
If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose?
I've read J. Forshaw's white paper on Breaking .NET Through Serialization ...
7
votes
0answers
208 views
Help in understanding an application's crash - exploitable?
Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
6
votes
4answers
455 views
Is Stonesoft's “advanced evasion technique” a major problem?
A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques.
With these techniques, they claim to be capable of launching attacks on a network ...
6
votes
3answers
435 views
Remote return into libc attack
It is often shown that non-executable data segemnts are possible to bypass through return-to-libc attacks. It's evident on /bin/sh but is it also possible to invoke a remote shell?
6
votes
2answers
482 views
SQL Injection: Drop All Tables
I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
6
votes
5answers
393 views
How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
My website will be hosting documents for end users and I would like to make this as secure as possible.
Question
Assuming that I have a need to share documents on a website that may contain hostile ...
6
votes
2answers
208 views
Using 'sudo vim' to spawn a shell
I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
6
votes
4answers
579 views
if the hypervisor is hacked are all guests affected as well?
I'm guessing that all guests would be screwed, if the hypervisor is hacked. I found this article, but it seems to be more focused on privilege escalation of guests. I'm more interested to hear about ...
6
votes
3answers
190 views
Security implications of an exploited router
So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
6
votes
1answer
698 views
How will security need to be changed if P=NP?
If we suppose that it is found that P=NP, how will security measures need to be changed?
I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
6
votes
2answers
199 views
Exploiting PHP via GET params
To be clear, this is in the interest of ethical testing to secure an application on behalf of my work.
Now that that's out of the way, here are the details:
Un-sanitised GET params are used in a ...
6
votes
1answer
69 views
What are Non-linear/backward overwrites?
I read some slides from the Black Hat USA 2012 conference, and I stumbled across the term
non-linear/backward overwrite, mentioned on slide 5 of the Exploit Mitigation Improvements in Windows 8 by ...
6
votes
1answer
218 views
Epson Projector security threats
I have an EPSON PROJECTOR (model EB-824H)
And I would like to use it in our company.
As I know (but not sure) this kind of projector has no WIFI,no network card and there is no HD in this PROJECTOR
It ...
6
votes
2answers
178 views
Example of malware in the wild?
I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
6
votes
2answers
342 views
Videos and visual tutorials on Format String Vulnerabilities
Anyone know of good format string vulnerability tutorials/videos that demo how to test on a web app, such as modifying the URL. I've watched Vivek's videos from securitytube and another from ...
