Tag Info

Hot answers tagged

69

There are a few cases where simply downloading a file without opening it could lead to execution of attacker controlled code from within the file. It usually involves exploiting a known vulnerability within a program which will handle the file in some way. Here are some examples, but other cases are sure to exist: The file targets a vulnerability in your ...


17

Windows will try to extract information from the file to display the icon and preview when looking at the folder inside explorer. One example was the Windows Metafile Vulnerability which could be exploited only by previewing the file in explorer. Another attack vectors is the builtin Windows Search. To extract the information necessary for a full text ...


9

If the input is not carefully filtered, then that is a vulnerability called Server Side Request Forgery (SSRF). There is even a common weakness enumeration number and page for it. https://cwe.mitre.org/data/definitions/918.html By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly ...


7

Adobe Flash is 21 years old (started as FutureWave's SmartSketch), over the years it had to be able to deal with many different OS's, standards, and all the quirky restrictions they brought along with them. Most of the work done on Flash is aimed at keeping it up-to-date with the latest technologies, adding more and more features over time. This doesn't ...


6

Autorun applies mostly to external drives connected to the machine, less to downloaded files. If you do not execute the downloaded file, in theory you should be safe. However, practically, your computer may open it itself for your convenience and without asking your approval, whether it is to generate some kind of thumbnail or preview of the document, to ...


5

Well depending on how they've implemented this feature it could indeed be quite dangerous. In addition to to the risks you've mentioned there's also the potential for non-public URLs to be retrieved by the system. For example retrieving http://127.0.0.1 would retrieve localhost. This can be a risk as things like administration panels are commonly deployed ...


3

The most famous has got to be the Samy worm: Samy (also known as JS.Spacehero) is a XSS worm that was designed to propagate across the MySpace social-networking site written by Samy Kamkar. Within just 20 hours of its October 4, 2005 release, over one million users had run the payload making Samy the fastest spreading virus of all time. The ...


3

Null bytes in your return address are hard to beat. Since its an address as opposed to code you cannot use an encoding stub. There are however a few potential ways to get around this: 1)Find the perfect address. Sometimes the application will copy code onto the stack or other areas in memory. If you're lucky you can find a static location that contain a ...


2

The cookies could contain anything, and the vulnerability isn't as much about what they contains, as it's about the fact that they can be accessed. The "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability is, in combination with for example a XSS attack, a way to get access to the contents of cookies carrying the httpOnly-flag. An ...


2

You just discover that GCC perform alignments on local variables (stack). An paper that could give you an idea of this concept is the following one: Optimal Stack Slot Assignment in GCC


2

When you are exploiting a buffer overflow, your attack is possible because of an underlying misschecking on the asm code. In your case, strcpy use is in fault so you have some limitations. Indeed, strcpy is a string function. As you said, you can't have \x00 byte. You can find other cases (not relying on stcpy) when \x00 can be allowed but not in this case. ...


1

I'm assuming that my comment about the code being copied incorrectly is accurate, and as such I'm giving the solution that would work if the code were moved around. The value returned by memchr isn't pushed on the stack. All the variable declarations happen at the beginning of manage_request, so after that the stack frame for that function should be ...


1

AFAIK several implementations exist, but openess is often limited by competitive advantage (AV companies for example). Microsoft has published much of their honeymonkey project. See http://research.microsoft.com/en-us/um/redmond/projects/strider/honeymonkey/ for more details.


1

It depends on the type of virus you may have downloaded. Macro viruses: when you open an infected document using the program it is designed to attack. Same thing occurs with program viruses that infect other programs of your machine if the program infected by them are activated by executing them. Boot sector viruses: they infect your hard drives by their ...


1

A honeypot is not a plugin which will defend you while surfing. For this you already have several plugins available, each one dedicated to face different kind of attacks (whether it is phishing, tracking, SSL / JavaScript / Flash related, etc.). A honeypot on the contrary is made to attract and allow attacks to better study them. The way I could imagine ...


1

There are quite a lot of vulnerability DBs out there. In the good old days, those were Milw0rm and 0day. Now you probably look at http://www.rapid7.com/db/ as well as https://www.exploit-db.com/


1

NVD is an authoritative source for vulnerabilities reported to them. They do not list vulnerabilities that merely exist in the wild. So, yes, the NVD is a fine place to go, but it is never going to be fully complete. Not every vulnerability is issued a CVE.



Only top voted, non community-wiki answers of a minimum length are eligible