Tag Info

New answers tagged

9

If the input is not carefully filtered, then that is a vulnerability called Server Side Request Forgery (SSRF). There is even a common weakness enumeration number and page for it. https://cwe.mitre.org/data/definitions/918.html By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly ...


5

Well depending on how they've implemented this feature it could indeed be quite dangerous. In addition to to the risks you've mentioned there's also the potential for non-public URLs to be retrieved by the system. For example retrieving http://127.0.0.1 would retrieve localhost. This can be a risk as things like administration panels are commonly deployed ...


2

You just discover that GCC perform alignments on local variables (stack). An paper that could give you an idea of this concept is the following one: Optimal Stack Slot Assignment in GCC


-1

Code injection in PHP is only possible if you explicitly use functions such as eval(); require(), create_function() or similar. As long as you don't invoke the interpreter to actually "execute" that variable you are on the safe side.


0

The other answers are great, but I thought I'd share one additional story I remember -- http://www.zdnet.com/article/strongwebmail-ceos-mail-account-hacked-via-xss/ Lance James and crew found an XSS when facing a challenge brought about by StrongWebMail's CEO (in the style of LifeLock). They were able to successfully win the challenge through the use of the ...


0

As a quick and straightfarward answer, you can look to these famous JS worms achieved by exploiting XSS vulnerabilities: Justin.tv worm The cross-site scripting vulnerability that was exploited was that the "Location" profile field was not properly sanitized before its inclusion in a profile page. Orkut "Bom Sabado" worm Orkut, a social ...


3

The most famous has got to be the Samy worm: Samy (also known as JS.Spacehero) is a XSS worm that was designed to propagate across the MySpace social-networking site written by Samy Kamkar. Within just 20 hours of its October 4, 2005 release, over one million users had run the payload making Samy the fastest spreading virus of all time. The ...


0

Here you are: List of 20 famous websites vunerable to XSS 20 Famous websites vulnerable to Cross Site Scripting (XSS) attack including famous newspapers, federal agencies and the biggest fast food restaurant in the world. Notable attacks in 2011 Basically the same question but answered back in 2011. Also Y! got pwned Popular webmail provider ...


3

Null bytes in your return address are hard to beat. Since its an address as opposed to code you cannot use an encoding stub. There are however a few potential ways to get around this: 1)Find the perfect address. Sometimes the application will copy code onto the stack or other areas in memory. If you're lucky you can find a static location that contain a ...


2

When you are exploiting a buffer overflow, your attack is possible because of an underlying misschecking on the asm code. In your case, strcpy use is in fault so you have some limitations. Indeed, strcpy is a string function. As you said, you can't have \x00 byte. You can find other cases (not relying on stcpy) when \x00 can be allowed but not in this case. ...


0

The simplest and most common type of malware depends on you executing it, but malware can target vulnerabilities in any program that processes the data. Image a piece of malware that targeted a known vulnerability in your antivirus software, or your spam filtering software.


1

I'm assuming that my comment about the code being copied incorrectly is accurate, and as such I'm giving the solution that would work if the code were moved around. The value returned by memchr isn't pushed on the stack. All the variable declarations happen at the beginning of manage_request, so after that the stack frame for that function should be ...


17

Windows will try to extract information from the file to display the icon and preview when looking at the folder inside explorer. One example was the Windows Metafile Vulnerability which could be exploited only by previewing the file in explorer. Another attack vectors is the builtin Windows Search. To extract the information necessary for a full text ...


6

Autorun applies mostly to external drives connected to the machine, less to downloaded files. If you do not execute the downloaded file, in theory you should be safe. However, practically, your computer may open it itself for your convenience and without asking your approval, whether it is to generate some kind of thumbnail or preview of the document, to ...


69

There are a few cases where simply downloading a file without opening it could lead to execution of attacker controlled code from within the file. It usually involves exploiting a known vulnerability within a program which will handle the file in some way. Here are some examples, but other cases are sure to exist: The file targets a vulnerability in your ...


1

AFAIK several implementations exist, but openess is often limited by competitive advantage (AV companies for example). Microsoft has published much of their honeymonkey project. See http://research.microsoft.com/en-us/um/redmond/projects/strider/honeymonkey/ for more details.


1

It depends on the type of virus you may have downloaded. Macro viruses: when you open an infected document using the program it is designed to attack. Same thing occurs with program viruses that infect other programs of your machine if the program infected by them are activated by executing them. Boot sector viruses: they infect your hard drives by their ...


1

A honeypot is not a plugin which will defend you while surfing. For this you already have several plugins available, each one dedicated to face different kind of attacks (whether it is phishing, tracking, SSL / JavaScript / Flash related, etc.). A honeypot on the contrary is made to attract and allow attacks to better study them. The way I could imagine ...


0

If I understood well your question's title, and if you are looking for opensource stuff: I know, FireFox and Chromium are Open-Source and would be the base for such Honey-Browser. then you can use, for instance, Thug which is a browser emulator written in Python automatically interacts with the malicious website to check its exploits. There are also ...


0

Traffic based. An example of an traffic based attack would be sniffing. By implementing VLANs, you seggragate traffic into different VLANs so that traffic that belongs to one VLAN is only visible in that VLAN. If there were no VLANs, an ARP spoofing attack could affect the whole switched network. In case there are VLANs, it would affect only the VLAN on ...


1

There are quite a lot of vulnerability DBs out there. In the good old days, those were Milw0rm and 0day. Now you probably look at http://www.rapid7.com/db/ as well as https://www.exploit-db.com/


1

NVD is an authoritative source for vulnerabilities reported to them. They do not list vulnerabilities that merely exist in the wild. So, yes, the NVD is a fine place to go, but it is never going to be fully complete. Not every vulnerability is issued a CVE.


2

The cookies could contain anything, and the vulnerability isn't as much about what they contains, as it's about the fact that they can be accessed. The "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability is, in combination with for example a XSS attack, a way to get access to the contents of cookies carrying the httpOnly-flag. An ...


-3

Adobe Flash Player is written in an unmanaged code language, vulnerable to the following commonly cited vulnerabilities: Heap-based buffer overflow Use-after-free vulnerability Integer overflow Stack-based buffer overflow Double-free vulnerability Unspecified "type confusion" Crafted format-string argument Typically, unmanaged code is also subject to a ...


7

Adobe Flash is 21 years old (started as FutureWave's SmartSketch), over the years it had to be able to deal with many different OS's, standards, and all the quirky restrictions they brought along with them. Most of the work done on Flash is aimed at keeping it up-to-date with the latest technologies, adding more and more features over time. This doesn't ...



Top 50 recent answers are included