New answers tagged

2

You should NOT. First, you don't know if the file is trustable, you got it from some "source". It is never advisable to install APKs from untrustworthy sources, especially on your primary device. Second, it contains a known vulnerability. Third, it is an offline game, and it requires full internet connection(it may be because of ads, but you never know ...


3

According to the Windows Internals 5th Edition book, the 5-bit ASLR bias for heaps is "multiplied by 64KB to generate the final base address, starting at 0, giving a possible range of 0x00000000 to 0x001F0000 for the initial heap". As such, the initial heap for IE on Windows 7 will always be between 0x00000000 and 0x001F0000, with 32 possible locations. By ...


5

The relevant code for the HTML generation is the following: for (var i=0; i<posts.length; i++) { var html = '<table class="message"> <tr> <td valign=top> ' + '<img src="/static/level2_icon.png"> </td> <td valign=top ' + ' class="message-container"> <div class="shim"></div>'; html += ...


0

I'd rather try to send multiple requests simultaneously. In the vulnerable code, it takes 10 seconds from the check (if you have enough money) till the paying process finishes. Another request arriving just in this timespan might enjoy "free shopping".


0

In Chrome, you can simply press the ESC button to close/abort the connection. Look at the PHP code and you'll see when exactly you should press the ESC button.


2

Heartbleed exposes, as the other answer mentioned, arbitrary memory. On an unused NAS, this is most likely not sensitive information. Yet, this seems to be a certificate - maybe also, as polynomial said, (part of) the private key. Executing the exploit several times will probably yield different outputs; putting the pieces together can in fact yield ...


4

Heartbleed results in arbitrary server memory being disclosed. Sometimes this contains sensitive information. In some cases, this is the server's private key, which can be the most sensitive information on the server. In many cases, it can contain information that is intended for a different client. This is probably what you are seeing: certificates, version ...


1

I'm talking about the type of exploits that you compile and that result in an executable that exploits a daemon (and not by passing specially crafted input through human input fields). They do so by passing specially crafted input through non-human input fields. A program that does something useful needs to interact with some other programs in some ...


0

I used this ftp vulnerability (@halfinformed gave it to me in the comments). So here is the steps to install and exploit with a simple reverse shell : Install the vulnerable service from the link given above. Generate a new payload that fits your need (depending on your IP address) with this command msfvenom -a x86 --platform windows -p ...


2

To examine a malicious PDF you can use: PDF Stream Dumper After installing PDF Stream Dumper, load the suspicious PDF file and start looking around. You can see different colors on the right side, where the red color shows headers with JavaScript tags. The tool includes a number of signatures of known PDF exploits. To scan the file, select Exploits Scan ...


1

To properly expand your thesis, you should probably read the rest of the article you posted. Under "Android and Google Service Mitigations" it explains the current posture of Google to deal with these threats. While the best solution is naturally to patch the OS at the lowest level the bug exists, it is effective enough to patch the apps in userland that ...


0

Possibly. Not really with new browsers, as they have better security. However a video cannot cause any damage, unless it forced you to have a full hard disk. However pages can. Mostly if you have plug-ins. Scripts can cause malware, and much more.


33

but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer. No it is not. The implication is that there need to be a bug in the code handling the data. For instance the ffmpeg library is used in browsers like Chrome or Firefox and it had several serious bugs in the ...


11

A web browsers video system is just another video player, so the same problems apply which were mentioned in the linked question. The smaller set of supported video codecs greatly reduces the attack surface, but doesn't make bugs in the decoders for these formats inconceivable. The Adobe Flash plugin is renowned for its plethora of security bugs in the past ...


0

It seems I found an answer myself, at least a sort of. Well, as I suspected, kernel developers are very far away from me. Indeed the "Address space layout randomization" seems to produce the behaviour I observed on my system. When I read the wikipedia article, I understood address space is structured once each time kernel starts, but testing it I verified ...


2

I think your question is much broader than you realize, but I'll try to give some sort of answer. If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? I don't know, depends on what the exploit is. The most dangerous kind of exploit that an application can have is called arbitrary code execution ...


1

I strongly disagree that devices or software with lots of published vulnerabilities are therefore less secure than those with few. And advocating that as means of determining quality is to endorse practice of keeping vulnerabilities secret. While this does not apply to end-user maintained systems: A large proportion of vulnerabilities can be mitigated with ...


4

On Windows and Unix - no. There may be obscure operating systems that use different path separators. To handle encoding securely there is a simple rule: fully decode before doing sanitisation. If you fail to do this, you sanitisation can be circumvented. Imagine an application that does open(urldecode(normalize(path))). If the path contains ../ then ...


2

Besides searching CERT, what other methods are available to help accomplish this task? Look for vendor specific patterns and penelize any vendors which have lots of vulnerabilities take a lot of time for fixes expire products too quickly, i.e. make them obsolete after only few years and stop supporting them make it hard for you to find the updates ...


2

You can disable the module. modprobe nf_conntrack nf_conntrack_helper=0 More info about securing helpers without disabling the module entirely can be found here https://home.regit.org/netfilter-en/secure-use-of-helpers/


6

Utilizing Unicode, it's possible to encode \ and / into multi-byte characters. If the string comparison functions are not unicode-aware, there could be a bug which allows these characters through. Wikipedia has a section on this in relation to an old attack on Windows servers: When Microsoft added Unicode support to their Web server, a new way of ...



Top 50 recent answers are included