New answers tagged

0

It seems I found an answer myself, at least a sort of. Well, as I suspected, kernel developers are very far away from me. Indeed the "Address space layout randomization" seems to produce the behaviour I observed on my system. When I read the wikipedia article, I understood address space is structured once each time kernel starts, but testing it I verified ...


2

I think your question is much broader than you realize, but I'll try to give some sort of answer. If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? I don't know, depends on what the exploit is. The most dangerous kind of exploit that an application can have is called arbitrary code execution ...


1

I strongly disagree that devices or software with lots of published vulnerabilities are therefore less secure than those with few. And advocating that as means of determining quality is to endorse practice of keeping vulnerabilities secret. While this does not apply to end-user maintained systems: A large proportion of vulnerabilities can be mitigated with ...


4

On Windows and Unix - no. There may be obscure operating systems that use different path separators. To handle encoding securely there is a simple rule: fully decode before doing sanitisation. If you fail to do this, you sanitisation can be circumvented. Imagine an application that does open(urldecode(normalize(path))). If the path contains ../ then ...


2

Besides searching CERT, what other methods are available to help accomplish this task? Look for vendor specific patterns and penelize any vendors which have lots of vulnerabilities take a lot of time for fixes expire products too quickly, i.e. make them obsolete after only few years and stop supporting them make it hard for you to find the updates ...


2

You can disable the module. modprobe nf_conntrack nf_conntrack_helper=0 More info about securing helpers without disabling the module entirely can be found here https://home.regit.org/netfilter-en/secure-use-of-helpers/


6

Utilizing Unicode, it's possible to encode \ and / into multi-byte characters. If the string comparison functions are not unicode-aware, there could be a bug which allows these characters through. Wikipedia has a section on this in relation to an old attack on Windows servers: When Microsoft added Unicode support to their Web server, a new way of ...


5

Your code is wrong: #include <stdio.h> int main(){ char *buffer[64]; gets(buffer); return 0; } The char *buffer[64] creates an array of pointers to chars. Try again with this: #include <stdio.h> int main(){ char buffer[64]; gets(buffer); return 0; } Run it at IDEone. Actually, I can see quite a few reasons why ...


2

TL;DR: Report that your card has been compromised to your bank and ask for a new one. You are the victim of a credit card fraud. Your bank (Bank A) noticed a suspicious activity with your debit card and froze it. As techraf said, report that this activity was indeed fraudulent to your bank. If some unauthorized transactions were approved, you can reclaim ...


0

Conserning POST and GET A link allows GET request when it is clicked. A form allows GET or POST requests when submitted. All GET requests that can be done with a form can also be done with a link and vice versa, so the extra functionality that the form allows is the POST requests. Asuming people stick to the intentions of the HTTP verbs, a POST requests ...


2

A form is more dangerous because it hides more stuff from the user than a simple link and can do different things. automatically removes any script tags, click events and basically any Javascript I assume that means that it also removes javascript:... links. So the only links an attacker can produce are simple GET requests, which amongst others, are ...


7

Yes, it is. By how much, and if it would be ok for you to allow forms depends on your specific situation. CSRF with referer checks If your CSRF protection depends on referer checks, not on a token, allowing forms means that you would be vulnerable to CSRF. As you disallow scripts, a victim would still need to actually click the form, but that can be ...


2

If the admin did not address the security flaw, even after a kind soul informed them- this is their gaping hole, not yours, sir. You did the best you could, more than most. I've emailed admins, good ones say thanks, bad ones ignore. No need for worry, you are trying to help is all. Remember, they are being paid, you are not, it's a good job you said ...


3

This entirely depends on wether or not you violated any law or school rules when you stumbled onto the problem. If you found it without violating rules If you didn't violate any rules (e.g. this is a simple enumaration problem with a web app and you just put in yourID+1 and got another students data) there should be no problem with disclosing this ...


1

According to google, they recommend 90 to 120 days to patch after disclosing the vulnerability. I would be careful if you do not have permission to "play" on the network as this maybe illegal. Sounds like something you stumbled upon without probing for vulnerabilities. If you get no response, leave it alone as you may face legal issues


0

I am pretty sure when assembly programmers first heard of high-level system programming languages like C they must have thought some classes of the bugs will never be seen again. What happened is we have exactly the same classes of bugs but under different disguises. Typical command/data confusion (which is behind most injection attacks) will occur no ...


0

You are overlooking the fact of the OSI Layers 8, 9 and 10 problem. Technology has been in place to prevent, minimize, and or disrupt most attacks for years. It does not matter how much more technology you create, theorize, adore, if the processes are broken. Most organizations that have been breached had more than sufficient technology to minimize access, ...


3

There is whole world of vulnerabilities out there which don't need buffer overflows or bad crypto. Just have a look at web applications where you have all these web based insecurities like Cross Site Scripting (XSS) or Cross Site Request Forgery (CSRF). Then take a look at code injections like SQL injection or Remote File Inclusion. If this is not enough ...


7

A test is free to restrict the conditions of a test for their own reasons depending on the effect that they want to test. Remember that the point is not to "get the right answer" but to teach and test understanding of the underlying concepts. It's like restricting the use of calculators when the test is about testing the student's ability to calculate ...


2

I remember requiring a read/write community string to order a cisco router to dump its config over tftp to "filename" on host ip1.ip2.ip3.ip4 by sending a PDU with the equivalent of SNMP SET n1.n2.....nn[ip1.ip2.ip3.ip4]="filename". There was a lot you could gather from those configs. I used this to scan routers twice a day and check in config changes into ...


29

File extensions The file extension actually has absolutely nothing to do with the data in the file or how that data is structured. Windows likes to make you think the extension is somehow magical - it's not, it's just part of the file name, and tells Windows which program to launch when you open the file. (Linux/Android and MacOS/iOS still use file ...


6

Well, this question is quite broad. But in short: File extension Quite a lot of virus simply utilize/-ed windows great feature of hiding file-extensions. E.g. the file someimg.jpg.exe would appear as someimg.jpg to the user, which would open it without knowing he executed malicious code. More specific hacks There have been (probably are) some drive-by ...


1

They are simply ASCII icons for the type and level of log entries. Many commandline programs do this, not just exploit code - it makes it easier to read the output. I'm not sure that there is an established standard, but if you read the source code, you can see what decisions the devs made in their program.


0

There are several exploits available (like MS14-064) for Windows 7 through 8 and maybe 10. Not all will be applicable as mentioned by @1ntgr You can search for them here: http://www.intelligentexploit.com/search-results.html?search=Microsoft+Windows You may want to target installed programs on the machine otherwise. Refer to http://www.exploit-db.com ...


1

A lot of the comments above are irrelevant. None of that stuff really matters. In the app, did the developer create a feature where external links are automatically redirected to the app? If not, the threat is very low. Somebody would have to decompile the app and add that feature in and redistribute it order to successfully exploit that vulnerability. I ...



Top 50 recent answers are included