Tag Info

Hot answers tagged

12

TURLA is the final stage of a large and sophisticated family of malware. There have been known Windows versions since at least 2010. This 40 page presentation is the most comprehensive resource I have seen, for either platform. TURLA - development & operations Some Windows Highlights Stage 0: attack stage - infection vector Stage 1: reconnaissance ...


3

Generally, most drive by browsing attacks are through browser vulnerabilities, which redirect you etc., but some are through PDF render engines, or in fact any input or display functionality. These do not have to be zero-days. Many browsers have vulnerabilities - some that have been known for years and have fixes out.


3

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous! On ...


3

They're just as vulnerable as any other software would be to a vulnerability, so to your specific question it would be just as vulnerable. Remember though that in the case of shellshock the honeypot would have to be passing input to a bash shell to be vulnerable. Of course, is another component on the system is vulnerable, the honeypot could still be ...


2

From what it sounds like this is not a problem limited to you. Many other WordPress websites have been hit. I'd expect someone to come out with a more comprehensive solution soon. That being said: ARS Technica just reported that it seems like a premium plugin called RevSlider is responsible for the security hole. Other than restoring the website from a ...


2

This is a book on BASIC pentesting of webapps : http://www.amazon.com/Web-Penetration-Testing-Kali-Linux/dp/1782163166 I think it will be enough for basic testing , mostly it explains usage of scanners. If you want proper pentesting you can hire a pentesting company , or maybe Bugcrowd.


2

As a starter owaspis always goodhttps://www.owasp.org/index.php/Main_Page you could also find some tools there. check the cheat sheet series too https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series


2

Simple static HTML protects you for things such as sql injections and many common forms of hacking but it does not protect you from flaws in Apache or bad rights assignment to the Apache service user. This is where rights escalation comes in if you can break Apache server itself. That being said Apache is very mature so a current stable version will ...


1

Drive by exploits are a result of targeting vulnerabilities in a particular web browser. A web browser is a large piece of software with the potential for many bugs. PDF rendering, flash players, Javascript engines are all complex and have a long history of vulnerabilities. A good mitigation is definitely keeping your browser up-to-date. A zero-day exploit ...


1

Bash re-written Turla knock-door In order to understand how this work, I wrote this: #!/bin/bash myIpSum=${1:-0a230673aeea81fba0e6e66aae22cb4c} printf -v bport %04X ${2:-22} # port to watch for incoming ``knock'' printf -v rport %d ${3:-80} # change this for greater then 1024 if not root! while :;do while IFS=': ' read seq loci locp remi remp ...


1

By closing unnecessary ports you just decreased your attack surface, which is a good practice. But by running a modern operating system and web browser, you still have a relatively large (or should I say huge?) attack surface. For example, a secure up-to-date fully-patched drive-by-download-immune browser may not protect you from: Vulnerabilities in ...


1

Your key assumption is impossible. A "drive-by-download-immune browser" capable of surfing the modern web does not exist. Even if no known public vulnerabilities exist for a certain browser, there is always the possibility of zero-days. You don't download anything, but every time you visit a website with Javascript enabled, you are allowing arbitrary code ...


1

1) BadUSB works by reprogramming a USB device's firmware "in-band" (ie. over the USB connection). Currently, only one particular model of USB controller chip is known to permit this. Devices that do not permit in-band firmware changes are not vulnerable to BadUSB. 3) No amount of firmware programming can make a device do something it doesn't have the ...


1

Any software needs to be maintained. Honeypots are no exception. Because honeypots are designed to be probed and hacked, they need to be placed in a separate and secured environment with the understanding that they may be completely overtaken. Make sure the servers that honeypots are running on are part of your regular patch management process, and make ...


1

Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response. This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set. The HTTP TRACE method is used for debugging purposes only and should be disabled. Apache Configuration: ...


1

It all depends on what is written in the HTML. Is there code such as php, asp, .net. It can also depend on the server, is the version of whatever software your using (e.g. Apache, IIS, nginx) vulnerable. There is more to it then what you may think. Also, are there other means to get into the server? (SSH, FTP, RDP, VNC). Is it easy to determine a possible ...


1

Apache is software too, and can have vulnerabilities. Having a simpler "attack surface" does help reduce exposure to vulnerabilities, but it doesn't make you invulnerable.


1

You assumption is wrong. you don't need to use the full 4 byte address of the FP. Since your CPU will understand the thumb mode. as a result your exploit will look like : printf "AAAABBBBCCCC\x94\xac\x8b\xbe\[FP 2 bytes without \x00\x00 here]\x38\x84"



Only top voted, non community-wiki answers of a minimum length are eligible