Tag Info

Hot answers tagged

16

Droppers are a framework for deploying payloads. This is useful for botnets because the bot master can deploy his botnet without a specific payload, then rent out his network to his customers who provide the payload they want. Crime-as-a-service. Got to love it.


6

The intent would have been to exploit a server side include -- your webserver retrieving the URL and incorporating it into the web page. This vulnerability isn't very common anymore.


3

the exact cgi script which uses bash as an interpreter "Using bash as an interpreter" not a precondition for the exploitation of the family of bash vulnerabilities called "shellshock" (the many distinct parsing vulnerabilities based on an environment variable with any name beginning with exactly the bytes () {). All you need to exploit one of ...


2

The whole point of having a "stateless" thing is to avoid maintaining state (here, on the server side). Stateless servers are unavoidably subject to replay attacks, by definition. The problem you are envisioning is basically a replay attack. If attackers can steal clients' cookies, then you already have bigger issues. If they cannot, then there is no ...


2

No, there really isn't. In order for this work, you need to have some form of session management in place to determine whether the token in a cookie is valid or not. They may mean maintaining a list of valid sessions as in traditional session management, or explicitly blacklisting tokens that have expired for some period of time. (Less overhead on the ...


2

First of all, the command you execute would be: $ env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test" It all boils down to the way the vulnerability works. When bash exports functions, it does so through the environment, with a function x stored in either variable x or (after latest patch) BASH_FUNC_x. bash ...


2

Once an attacker gains control of a system he may use it to try and compromise vulnerable USB devices plugged into it in hopes of compromising the other systems to which the compromised USB devices will be connected. And the attacker doesn't care about which ports are used, he'll just probe all of them in hopes of finding & compromising a vulnerable USB ...


2

If a USB stick accepts unsigned firmware updates then yes it's vulnerable to a bad USB attack. There are products out there that only accept digitally signed firmware updates. These devices are not susceptible. http://www.ironkey.com/en-US/solutions/protect-against-badusb.html


1

I'm a bit confused about your question, but it seems like a framework like BeEF might do what you are talking about. This is an interesting project that allows you to drop a hook into a site that contains an XSS vulnerability and then gives you a dashboard that displays who has loaded the page. From here you can target specific users with all types of ...


1

By https-only I'm assuming you mean the HTTP Only flag, although it is accessed over HTTPS. The non HTTP Only cookies could be compromised if there are any XSS flaws on the website. The non secure flagged cookies could be compromised if the user was using a browser that does not support HSTS (such as Internet Explorer). This would be a MITM attack on a ...



Only top voted, non community-wiki answers of a minimum length are eligible