Tag Info

Hot answers tagged

53

It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities. Crashes may give an attacker valuable information about the system and its internal details. Crashes may create temporary vulnerabilities or leave ...


48

CVE-2012-4969, aka the latest IE 0-day, is a based on a use-after-free bug in IE's rendering engine. A use-after-free occurs when a dynamically allocated block of memory is used after it has been disposed of (i.e. freed). Such a bug can be exploited by creating a situation where an internal structure contains pointers to sensitive memory locations (e.g. the ...


32

Apple apparently takes this seriously, since they "disabled Java" in users' computers, which is a rather drastic move. This actually smells like a pretext to kill off the technology, as part of a wider strategy. For this specific hole, there are a few details there. It is all about the Java applet model. To understand: Java is a programming language and a ...


31

The computer cannot guess what it is "supposed" to do. Instead, it does exactly what it is told to do -- that's what programming is about. As a corollary, computers have no initiative whatsoever, so if they are asked to do something stupid or nonsensical then they just do it. A bug is what happens when the sequence of instruction written by the programmer ...


26

There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...


25

There is quite a lot of them: Metasploitable: Currently there are 2 versions. Kioptrix: Currently 4 challenges. Hackademic: Apparently 2 VM, check 1 and 2. pWnOS: Currently 2 challenges. Standalone which you can install directly without VM, this is to hone your Webattack-Fu: OWASP WebGoat Damn Vulnerable Web Application Mutillidae


24

Yes, this is very possible. In fact, support for this is built into the most popular port scanning tool in use, nmap. This feature, OS detection, can be activated by passing the -O flag to the nmap tool. What nmap does is send different TCP and UDP packets to the target and examine the response. By comparing the response to a database of existing operating ...


20

The OS and web server with which you have the most experience are usually going to be the most secure. Security depends on all of the layers, not just the web server. If you pick one with very few vulnerabilities, but don't understand how to configure it, you will most likely not understand how to configure it securely. They are all mature web ...


18

Canary Stack canaries work by modifying every function's prologue and epilogue regions to place and check a value on the stack respectively. As such, if a stack buffer is overwritten during a memory copy operation, the error is noticed before execution returns from the copy function. When this happens, an exception is raised, which is passed back up the ...


16

So there's a couple of options open to you potentially, depending on the country you live in, however first a note of caution. You "tested" the site and then reported your findings. In many countrys if the application owners want to make out that you "hacked" them, they could do that, and it may be bad for you. I say this just so you can weigh it up ...


14

As of the end of 2010, the US government deprecates these algorithms based on recommendations from the very savvy folks at NIST: SHA-1 1024-bit RSA or DSA 160-bit ECDSA (elliptic curves) 80/112-bit 2TDEA (two key triple DES) MD5 never was an acceptable algorithm for government use, along with many other older algorithms. For security through the year ...


14

There's a couple of good ones in addition to DVL, that I've come across Metasploitable is designed for testing out some of Metasploits functionality. There's some good information on using it in the free Metasploit Unleashed course. There's also DVWA from a web applications perspective EDIT: Another good list I came across on a blog recently, has quite ...


13

Canaries and other volatiles do not prevent the overflow; they just try to cope with the consequences of an overflow which has happened. The canary tries to detect the case of an overflow which overwrote the return address in a stack frame. DEP is one step further, it assumes that the return address has been overwritten and followed, and it restricts the ...


13

If the only user on the database that can change records is root and your CMS uses the root user to perform queries then you have a problem. Your root user should never be used by a website. Get a limited user which can only access the tables and records he needs to access restricted with the right permissions. If he doesn't need delete or update, then ...


12

It's not exactly a guide, but I believe CWE - Common Weakness Enumeration is excellent source of common software vulnerabilities (not just web) and it is up to date. And of course for web application, the OWASP site contains a lot of useful information about web application vulnerabilities.


12

The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies. Even a quick read over the project websites provides an indicator of the likely comparative security ...


12

The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions. You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these ...


12

Get a known clean version of your site and identify the differences between the known good code the and current (hacked) production code. Study how the changes may have been made and repair. Update the passwords. Fix the FTP certificate issue - consider using 2 factor authentication. Find a way to scan your code for vulnerabilities - peer review or ...


11

In my experience these are my following observations: Should it revolve around the ability to verbally explain attacks at a non-technical\technical level? Yes. Absolutely it should involve a technical level. Non-technical explainations are a bonus, you will, as a pen-tester be involved in meetings with people who know nothing about what you're doing ...


11

As previous answer have covered most of the scenario in which attacker can get direct benefit by analyzing application crashes. I will recommend read on "Analyze Crashes to Find Security Vulnerabilities in Your Apps". Analyzing crashes for security vulnerabilities may require low level programming skills. As shown in figure 1 every exploit may not lead to ...


10

There is definitely a risk - scripting essentially allows execution of code on the browser. The vulnerabilities range from reading your browser's history to installing malware to phishing your bank credentials - each of which can potentially cause you "harm" in some way. However, given that most of today's web sites rely on scripting, there's a huge loss ...


10

Insecure but widely used cryptographic algorithms include: hash functions: MD4, MD5, (SHA-1) (MD2 is also insecure but not widely used; SHA-1 is only "weakened"; MD4 and MD5 are also widely used in situations where cryptographic resistance is not required, so that's not a problem) symmetric encryption: DES (56-bit key), RC4 (non-randomness -- but most ...


10

@rook : you should run a diff on the two kernels, after all those years (17 since the split) of divergence there isn't that much that is still common, however there is still cross-breeding between projects and a really good idea will spread all around. OpenBSD got way more in the way of security architecture, as in compiler support to prevent buffer ...


10

You are right about accessing the file system and internet, especially because the home folder is mapped with write permission by default. This implies that it can mess with your documents as well, for example adding macros to Open Office documents, deleting your mp3 files or sending interesting files to someone on the internet. And yes, it can write to ...


10

There is the Access Control extension. But, you should also read the Security issues with authorization extensions linked from there. MediaWiki is not designed to be a CMS, or to protect sensitive data. To the contrary, it was designed to be as open as possible. Thus it does not inherently support full featured, air-tight protection of private content. ...


10

HTTP TRACE method basically replies the request, together with all the headers in response. Cookie header will also be included in response. Session cookies should have httpOnly flag for preventing Session Hijacking attacks. This flag blocks access to the cookie value from Javascript. Basically this ensures that even if attacker will exploit a XSS flaw in a ...


10

Switches are NOT a security feature. That's the important part. A switch is an optimization over a hub, meant for better performance, not for security. When a hub receives a packet (an ethernet frame), it dispatches it on all the other links. This is inconvenient in large networks, because this means that when two machines talk to each other, they ...


10

Ok, this is a pretty nasty flaw. If directory traversal is possible, the attacker might overwrite often-used executables in order to infect the box with malware. From there, the rest of the network could get infected through a whole range of different mechanisms: USB spreading, remote code execution vulnerabilities, spear phishing, etc. Worse, they could ...



Only top voted, non community-wiki answers of a minimum length are eligible