Tag Info

New answers tagged

0

When you're reviewing vulnerabilities in Nessus, if you view the "detailed vulnerability summary" it will tell you if there is a "public exploit available" for the vulnerability. If there is a public exploit available Nessus will tell you which module from within Metasploit to use. (I use Nessus enterprise on a daily basis). As Milen said, just because the ...


3

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous! On ...


0

You've just discovered why biometrics is not viable as access keys. The question of how you can get US President's fingerprints is irrelevant, because you can always get them this way or another (eg. dust for prints some place he visited). The answer is: getting them is useless, because his fingerprint (alone) doesn't open anything. Photographs of ...


3

HD footage is only around 2 megapixels in resolution. It is not anywhere near sufficient to pull a finger print. To pull a finger print, you would need something more in the 20+ megapixel range, focused on just the hand, and still would need the right angle for the fingerprint to be particularly visible, so in answer to your primary question, no, ...


12

An excellent slideshow on this topic (in my opinion) is the one from Marc Rogers. Basically, he says the following: Most fingerprint systems can be hacked Fingerprint security provides convenient security, not military grade security I also like the analogy in his explanation: Door locks have been defeated with increasing elaborate picking techniques as ...


11

No, I don't think photographs or HD camera footage of powerful people waving to cameras is a security flaw for several reasons: It's not trivial to get fingerprint patterns from HD cameras: it's highly unlikely that you could make a workable print from an HD camera. Even if the person in question held their finger up to the camera in perfect lighting ...


2

Popular commercial brands are not going to have the BadUSB exploit "installed" when it comes from the factory. You must understand how the badUSB exploit works. BadUSB is an exploit that can be executed against almost ANY USB drive. It's not something that can be exploited on some vendor drives and not other drives. For your drive to become compromised, ...


2

You can search within metasploit using the search command for example : msf>search ms08-067 you can also search by the name of the program that has a vulnerability using: msf>search name:windows http://www.offensive-security.com/metasploit-unleashed/Msfconsole_Commands#search


1

You've already listed some resources so I will add another that is not a tool per-se, but a write up on how the different browsers are storing data. The write up contains a minimal python script that should help get you started. As for Safari, pre version 6.0 the credentials were only base64 encoded so it was easier to get data then. The difference with ...


0

Don't trust a whitelist, it can be bypassed: Content-type: image/jpeg; filename=exploit.php Hashing the files does not protect you if the attacker can access the file direct: <img src='http://yoursite.net/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg> You could create a PHP script to read the file and send the contents to the user, unchanged. This ...


1

Regular expressions are of very limited use here as any attack delivered via a HTTP POST request is unlikely to get logged. There are also many examples of header values having an impact while not being logged, ie: shellshock. There will also be alot of noise from automated scanners like Nikto that have no impact unless the visited url exist and is ...


2

You're looking at the telnet client, not the telnet server. The telnet client is just a tool which you can use to connect to TCP listeners. If you want to know if your server has telnet open, check it by: Verify on the server if a telnet daemon is listening on port TCP/23 using tools like ps, netstat and lsof (assuming this is a Linux/UNIX machine) Test it ...


5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...


4

It could be possible in some cases. For example, imagine that the videoconferencing software has a vulnerability into the file format parser (E.g. buffer overflow)... then it could be exploited by a remote attacker. Look at VLC for example http://www.cvedetails.com/vulnerability-list/vendor_id-5842/opec-1/Videolan.html


0

Some Samsung devices are imported - as such you can buy some on the Internet. Generally, they are shipped still with the same carrier applications. Baidu browser may be one of those applications that the carrier software tries to install on your device. I have an imported device and when I rooted it it showed some carrier software located in the ...


2

In contrast to all the other buses mentioned, USB does not allow remote DMA; nowhere in the USB on-the-wire protocol are there memory addresses. Only the driver and/or the OS can control from/to which memory addresses USB data is read/written. OTG allows to change the roles of host and device, but does not change the USB protocol. Jodeit/Johns talks only ...


2

The text segment which is also called the code segment, contains the application's static functionality is not randomized by ASLR. An exploit can jump anywhere into this region of memory reliably, which permits an attacker to build a chain of ROP gadgets. The most common goal of a ROP chain is to setup a stable environment to run shell code, but that is ...


4

Google is not hosting ChromeSetup.bat. A requirement for this attack is that a website needs to have an endpoint with a less common Content-Type and preferably a misconfigured Content-Disposition header (namely: no 'filename' attribute). These two headers will cause the browser to download the response as a file, instead of rendering it. In the URL you ...


4

Actually this is very timely as there's a relatively new attack where the data passed in the URL is the attack vector. Reflected File Download abuses non-malicious servers by passing them malicious data and then having it reflected back to users, so it appears to the user to have come from a "trusted" source.



Top 50 recent answers are included