A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.
13
votes
9answers
2k views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
12
votes
3answers
3k views
Stack Overflows - Defeating Canaries, ASLR, DEP, NX
To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
18
votes
4answers
2k views
How secure are my passwords in the hands of Firefox using a Master Password?
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
9
votes
5answers
675 views
Is Google Chrome more secured browser?
I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested?
Has anyone other results of independent investigations about security of web browsers?
...
18
votes
0answers
565 views
Where can I find a vulnerable operating system to practice pentests on? [duplicate]
I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
16
votes
6answers
807 views
is there a guide of general/common IT vulnerabilities?
I'm looking for an updated and comprehensive guide of general/common IT vulnerabilities (general information).
I do not want you to do the job for me, I just want to put me in the right direction: a ...
21
votes
3answers
2k views
Should I be disabling Java?
First it was Apple, now it's the US government...
U.S. urges users to disable Java; Apple disables some remotely
New malware exploiting Java 7 in Windows and Unix systems
How serious is this ...
16
votes
7answers
422 views
which site do you use to view details of vulnerabilities?
Which site/sites do you guys use to view details of security vulnerabilities?
6
votes
2answers
365 views
What risks are inherent with connecting to an untrusted public key server?
Thomas Pornin brought up a good point about PGP key servers in an answer to a recent question, here:
Shouldn't GPG key fetching use a secure connection?
...you should not trust the key ...
6
votes
2answers
397 views
Where can I find a list of un-patched CVEs for a specific piece of software?
Is there a database of vulnerabilities somewhere, that can be queried in such a way as to return results for all non-patched vulnerabilities for a specific piece of software?
For example, I would ...
0
votes
1answer
116 views
why CVSS give a score of 0.66 for a full impact on CIA?
By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values for confidentiality, integrity and availability:
none : 0.0
partial impact : ...
33
votes
5answers
1k views
Why is application crash considered insecure?
If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again.
Crash is a bad behaviour in general and should be avoided, but why are ...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
18
votes
6answers
844 views
Why are vulnerabilities and lack of security possible in computers?
I have heard about computer vulnerabilities, virus, malware, etc.
Why are these threats possible?
Why doesn't the computer just do the things it is supposed to?
Why do some people write malware, ...
22
votes
6answers
304 views
How to keep an eye on upgrades, patches and security issues for used open-source libraries?
For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
7
votes
2answers
525 views
How should one prepare himself for a job interview for penetration testing?
So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this.
Should it revolve around the ability to verbally explain ...
7
votes
3answers
612 views
Exploit-db like websites, where people can search for security bugs
If someone has to decide between 2 very similar server programs, or operating systems, then it searches on sites like:
http://www.exploit-db.com/search/
so that there he could get enough ...
11
votes
2answers
697 views
Flaw in encryption through pseudorandom number stream (from gpg documentation)
I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity:
When I was in college in the early 70s, I devised what I believed was a brilliant ...
8
votes
3answers
802 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
5
votes
1answer
89 views
Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?
I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
5
votes
6answers
381 views
Determining vulnerable software on client machines
I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
3
votes
1answer
147 views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
1
vote
1answer
412 views
How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)
This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
