Tag Info

Hot answers tagged

3

The idea of this attack is that it is taking place int he SSL handshake, hence the client is still not aware of the MITM and since the attack manages to downgrade the key of the encryption it will manage to make your client believe it is talking to the real server. So if someone manages to MITM your client with the client and server both using open ssl with ...


3

I guess it depends and varies on the compiler and the system you are running on. For example what worked for me on the test code you supplied is: (on a ubuntu 32 bit machine) \x30\xa0\x04\x08\x31\xa0\x04\x08\x32\xa0\x04\x08\x33\xa0\x04\x08%154x%4$n%17x%5$n%17x%6$n%17x%7$n the first 16 bytes are the addresses I want to inject to: 0x0804a030, ...


3

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


2

You start by figuring out what's going wrong with your logging. Everyone on the Internet has an IP address -- it's a necessary condition for connecting to any other computer out there.


1

@david is correct that an attacker must be privileged: this is a MITM attack. There's another important detail: both users (server and client) must be using a vulnerable version of OpenSSL. For the web, while many servers use OpenSSL, none of the most popular clients do. None of Chrome, IE, Safari, Firefox, or Opera on the desktop use OpenSSL. See Which ...


1

I wouldn't be overly concerned. There are plenty of ways he could possibly have found your operating system, a lot of them not considered malicious and are done directly through the browser without any form of exploit. For example this information could come from your user agent: http://en.wikipedia.org/wiki/User_agent Through the user agent they could ...


1

Each format parameter acts on each sequential byte. You can't use %x to read and add spaces to one of the bytes containing an address you wish to write to, because then the %n is applied to the following byte. In other words, the %x is used to read AND add the spaces. Once the spaces have been added, it's time to write that value into the address you've ...



Only top voted, non community-wiki answers of a minimum length are eligible