Tag Info

New answers tagged

0

Mark answered (1) and (3). For (2), this also isn't anything to do with BadUSB. To begin with, BadUSB is about someone reprogramming legitimate USB controllers through a USB connection; this makes it easy to do, and also means it can be done by an infected computer without anyone noticing. It was always possible for a USB device manufacturer to put whatever ...


0

1) BadUSB works by reprogramming a USB device's firmware "in-band" (ie. over the USB connection). Currently, only one particular model of USB controller chip is known to permit this. Devices that do not permit in-band firmware changes are not vulnerable to BadUSB. 3) No amount of firmware programming can make a device do something it doesn't have the ...


1

Any software needs to be maintained. Honeypots are no exception. Because honeypots are designed to be probed and hacked, they need to be placed in a separate and secured environment with the understanding that they may be completely overtaken. Make sure the servers that honeypots are running on are part of your regular patch management process, and make ...


3

They're just as vulnerable as any other software would be to a vulnerability, so to your specific question it would be just as vulnerable. Remember though that in the case of shellshock the honeypot would have to be passing input to a bash shell to be vulnerable. Of course, is another component on the system is vulnerable, the honeypot could still be ...


2

From what it sounds like this is not a problem limited to you. Many other WordPress websites have been hit. I'd expect someone to come out with a more comprehensive solution soon. That being said: ARS Technica just reported that it seems like a premium plugin called RevSlider is responsible for the security hole. Other than restoring the website from a ...


0

Given Turla is based upon cd00r, there should not be any privilege escalation involved. cd00r runs as normal user application, starting an inetd service on some predefined ports. Thus, removing execute permissions on inted should be enough to block it. sudo chmod o=r `which inetd`


2

This is a book on BASIC pentesting of webapps : http://www.amazon.com/Web-Penetration-Testing-Kali-Linux/dp/1782163166 I think it will be enough for basic testing , mostly it explains usage of scanners. If you want proper pentesting you can hire a pentesting company , or maybe Bugcrowd.


2

As a starter owaspis always goodhttps://www.owasp.org/index.php/Main_Page you could also find some tools there. check the cheat sheet series too https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series


0

Download and run Linux Exploit Suggester: $ perl ./Linux_Exploit_Suggester.pl -k 3.0.0 Kernel local: 3.0.0 Possible Exploits: [+] semtex CVE-2013-2094 Source: www.exploit-db.com/download/25444/‎ [+] memodipper CVE-2012-0056 Source: http://www.exploit-db.com/exploits/18411/


12

TURLA is the final stage of a large and sophisticated family of malware. There have been known Windows versions since at least 2010. This 40 page presentation is the most comprehensive resource I have seen, for either platform. TURLA - development & operations Some Windows Highlights Stage 0: attack stage - infection vector Stage 1: reconnaissance ...


1

Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response. This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set. The HTTP TRACE method is used for debugging purposes only and should be disabled. Apache Configuration: ...


0

The National Collegiate Cyber Defense Competition (CCDC) is a blue team competition that includes a Microsoft server and client. Not exactly CTF, but an information security competition with Windows nonetheless. Must be involved with academia to compete however.


1

It all depends on what is written in the HTML. Is there code such as php, asp, .net. It can also depend on the server, is the version of whatever software your using (e.g. Apache, IIS, nginx) vulnerable. There is more to it then what you may think. Also, are there other means to get into the server? (SSH, FTP, RDP, VNC). Is it easy to determine a possible ...


2

Simple static HTML protects you for things such as sql injections and many common forms of hacking but it does not protect you from flaws in Apache or bad rights assignment to the Apache service user. This is where rights escalation comes in if you can break Apache server itself. That being said Apache is very mature so a current stable version will ...


1

Apache is software too, and can have vulnerabilities. Having a simpler "attack surface" does help reduce exposure to vulnerabilities, but it doesn't make you invulnerable.


1

You assumption is wrong. you don't need to use the full 4 byte address of the FP. Since your CPU will understand the thumb mode. as a result your exploit will look like : printf "AAAABBBBCCCC\x94\xac\x8b\xbe\[FP 2 bytes without \x00\x00 here]\x38\x84"


0

When you're reviewing vulnerabilities in Nessus, if you view the "detailed vulnerability summary" it will tell you if there is a "public exploit available" for the vulnerability. If there is a public exploit available Nessus will tell you which module from within Metasploit to use. (I use Nessus enterprise on a daily basis). As Milen said, just because the ...


3

CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous! On ...


0

You've just discovered why biometrics is not viable as access keys. The question of how you can get US President's fingerprints is irrelevant, because you can always get them this way or another (eg. dust for prints some place he visited). The answer is: getting them is useless, because his fingerprint (alone) doesn't open anything. Photographs of ...


3

HD footage is only around 2 megapixels in resolution. It is not anywhere near sufficient to pull a finger print. To pull a finger print, you would need something more in the 20+ megapixel range, focused on just the hand, and still would need the right angle for the fingerprint to be particularly visible, so in answer to your primary question, no, ...


12

An excellent slideshow on this topic (in my opinion) is the one from Marc Rogers. Basically, he says the following: Most fingerprint systems can be hacked Fingerprint security provides convenient security, not military grade security I also like the analogy in his explanation: Door locks have been defeated with increasing elaborate picking techniques as ...


11

No, I don't think photographs or HD camera footage of powerful people waving to cameras is a security flaw for several reasons: It's not trivial to get fingerprint patterns from HD cameras: it's highly unlikely that you could make a workable print from an HD camera. Even if the person in question held their finger up to the camera in perfect lighting ...


2

Popular commercial brands are not going to have the BadUSB exploit "installed" when it comes from the factory. You must understand how the badUSB exploit works. BadUSB is an exploit that can be executed against almost ANY USB drive. It's not something that can be exploited on some vendor drives and not other drives. For your drive to become compromised, ...


2

You can search within metasploit using the search command for example : msf>search ms08-067 you can also search by the name of the program that has a vulnerability using: msf>search name:windows http://www.offensive-security.com/metasploit-unleashed/Msfconsole_Commands#search


1

You've already listed some resources so I will add another that is not a tool per-se, but a write up on how the different browsers are storing data. The write up contains a minimal python script that should help get you started. As for Safari, pre version 6.0 the credentials were only base64 encoded so it was easier to get data then. The difference with ...


0

Don't trust a whitelist, it can be bypassed: Content-type: image/jpeg; filename=exploit.php Hashing the files does not protect you if the attacker can access the file direct: <img src='http://yoursite.net/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg> You could create a PHP script to read the file and send the contents to the user, unchanged. This ...



Top 50 recent answers are included