Hot answers tagged

8

You can try getting CERT involved. https://vulcoord.cert.org/VulReport/ We are more likely to accept reports if they: are technically accurate, sufficiently detailed, and reasonably complete affect multiple vendors impact safety or critical infrastructure involve disagreement or dispute between reporters and vendors involve hard-...


6

EIP is a register in x86 architectures (32bit). It holds the "extended instruction pointer" for the stack. In other words, it tells the computer where to go next to execute the next command and controls the flow of a program. Research Assembly language to get a better understanding of how registers work. Skull Security has a good primer.


4

The vulnerability may exist due to negligence, ignorance or limited resources. The owners get to decide when and how to solve the problem. The decision is their responsibility, not yours. Take an extra step to disclose your proof of vulnerability to the owners of the site. (i.e. verify they are receiving your communications) If you do not get a ...


3

This appears to be a case of UNION SELECT rather than inserting your own records. What you need to do is figure out how many columns are being selected (by trial and error.. SELECT 1,2,3...n until you stop getting an error). After that, you inject the query so the first part returns false (no username found). The tricky part: You inject ' OR 1 = 0; UNION ...


3

This is an extremely broad question. When you're learning about security and penetration-testing, you're supposed to learn all these techniques. There are loads of techniques each with it's own purpose, situation,... To give a small answer on your question, Social engineering is often used, and so are backdoors. Lastly I had to write a PoC (Proof of concept)...


3

Based on what you provided we can see that the Thunderbird icon is active. If it was configured to synchronise with Gmail account, and the authorisation was never performed or revoked, the connection is refused by Gmail service and Thunderbird requests an OAuth authorisation. If the above is true, there's no indication this authorisation request is ...


3

One of the basic things that a computer needs to keep track of is where in memory the instructions that are being executed are located. This is normally done by the CPU using what is often known as the instruction pointer or program counter register. The exact name depends on the architecture, but the concept generalizes across all architectures. It's ...


3

Yes, it depends how that GET/POST request is handled on the receiving party, i.e the client. While explained in another thread "Yes, you can get a virus just by visiting a site in Chrome or any other browser". This also counts for any client. In this case: the program that's handling the response from your web request. No matter if that's a browser, CLI ...


2

No, I don't think the pwd field is not exploitable in this example. Since the PHP is passed through PHP's MD5() function, the output will be the hexadecimal encoding of the hash. That means the string will only contain digits and the letters a to f. You can not break out of the quote using those characters. Lets assume that instead MD5($_POST['pwd'], true) ...


2

If you're directly using the SesssionId in your query, without escaping the SQL special characters then YES the Queries are vulnerable to SQL Injection. For example, Someone could send request to the server with following cookie : csid=a'; DROP TABLE cscart_sessions; And your SELECT query will execute to drop the table. Or a cookie like this : csid=a'...


2

Attackers employ a variety of techniques to compromise networks, however I would argue that in many (if not most cases) social engineering is involved. Spear Phishing has an overwhelming success ratio when executed properly and skilled social engineers are always going to be something to be feared. Spear Phishing typically also relies in a weakness in the ...


1

When you are overflowing a buffer to write on the stack in a way which is exploitable you will overwrite the return address on the stack. Ie, sending a long string of AAAAAAAAAAAAAAAAAAAAAAAAAAA.....AAAAAAAAA will result in EIP containing the value 0x41414141 when the application crashes. The reasons for this is all well documented in lots of places on the ...


1

With the module loaded, type info at the console prompt. You'll see what it expects. The INFILENAME is the path with the existing PDF to use and the FILENAME is the filename to export the malicious PDF as. msf exploit(adobe_pdf_embedded_exe) > info Name: Adobe PDF Embedded EXE Social Engineering Module: exploit/windows/fileformat/...


1

I think this is off-topic, but here is what you are looking for. RootKit A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) while at the same time masking its existence or the existence of other ...


1

The problem isn't the WYSIWYG editor. They are clientside code. The problem with such editors is when they are integrated with the serverside to post content or perform an image upload. Much of the bad reputation comes from when they are included in a CMS plugin. Those integrate with the serverside code base and either aren't always coded securely or the ...


1

As others have stated, MS08-067 (disclosed in 2008) took advantage of a flaw in the way RPC requests were handled (parsed) within the NetAPI32.dll. That code has since been updated with a patch to correct the vulnerability -hence it is obsolete. In terms of application, the vulnerability applied to: Windows XP - END OF LIFE Windows Vista - END OF LIFE ...


1

If the cache length lets say is 10.1kb well then the memory block will look something like this (Lets say the whole block is 30kb [Notice the middle block is our PP cache]): |~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~~~~~9.95kb~~~~~~| Now lets use the exploit, our data will look like this (Notice we just ran over 9kb of the next segment!): |~~~~~9.95kb~~~~~|~~~...



Only top voted, non community-wiki answers of a minimum length are eligible