Tag Info

Hot answers tagged

54

It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities. Crashes may give an attacker valuable information about the system and its internal details. Crashes may create temporary vulnerabilities or leave ...


48

CVE-2012-4969, aka the latest IE 0-day, is a based on a use-after-free bug in IE's rendering engine. A use-after-free occurs when a dynamically allocated block of memory is used after it has been disposed of (i.e. freed). Such a bug can be exploited by creating a situation where an internal structure contains pointers to sensitive memory locations (e.g. the ...


33

Apple apparently takes this seriously, since they "disabled Java" in users' computers, which is a rather drastic move. This actually smells like a pretext to kill off the technology, as part of a wider strategy. For this specific hole, there are a few details there. It is all about the Java applet model. To understand: Java is a programming language and a ...


32

The computer cannot guess what it is "supposed" to do. Instead, it does exactly what it is told to do -- that's what programming is about. As a corollary, computers have no initiative whatsoever, so if they are asked to do something stupid or nonsensical then they just do it. A bug is what happens when the sequence of instruction written by the programmer ...


27

There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...


26

There is quite a lot of them: Metasploitable: Currently there are 2 versions. Kioptrix: Currently 4 challenges. Hackademic: Apparently 2 VM, check 1 and 2. pWnOS: Currently 2 challenges. Standalone which you can install directly without VM, this is to hone your Webattack-Fu: OWASP WebGoat Damn Vulnerable Web Application Mutillidae


25

Yes, this is very possible. In fact, support for this is built into the most popular port scanning tool in use, nmap. This feature, OS detection, can be activated by passing the -O flag to the nmap tool. What nmap does is send different TCP and UDP packets to the target and examine the response. By comparing the response to a database of existing operating ...


22

Canary Stack canaries work by modifying every function's prologue and epilogue regions to place and check a value on the stack respectively. As such, if a stack buffer is overwritten during a memory copy operation, the error is noticed before execution returns from the copy function. When this happens, an exception is raised, which is passed back up the ...


20

The OS and web server with which you have the most experience are usually going to be the most secure. Security depends on all of the layers, not just the web server. If you pick one with very few vulnerabilities, but don't understand how to configure it, you will most likely not understand how to configure it securely. They are all mature web ...


17

These are the most common: MD5 - Use SHA512 SHA1 - Use SHA512 (Note this is not really insecure, but its showing its age, and will be fragiler in the next couple years....) DES / 3DES - Use AES


16

I'd suggest in additiona to HamZa DzCyberDeV's answer: Pentester Labs exercises which are full VMs as well as full detailed walkthroughs etc. These are great for all skill levels and i've found them most useful.


16

So there's a couple of options open to you potentially, depending on the country you live in, however first a note of caution. You "tested" the site and then reported your findings. In many countrys if the application owners want to make out that you "hacked" them, they could do that, and it may be bad for you. I say this just so you can weigh it up ...


15

Canaries and other volatiles do not prevent the overflow; they just try to cope with the consequences of an overflow which has happened. The canary tries to detect the case of an overflow which overwrote the return address in a stack frame. DEP is one step further, it assumes that the return address has been overwritten and followed, and it restricts the ...


15

As of the end of 2010, the US government deprecates these algorithms based on recommendations from the very savvy folks at NIST: SHA-1 1024-bit RSA or DSA 160-bit ECDSA (elliptic curves) 80/112-bit 2TDEA (two key triple DES) MD5 never was an acceptable algorithm for government use, along with many other older algorithms. For security through the year ...


14

There's a couple of good ones in addition to DVL, that I've come across Metasploitable is designed for testing out some of Metasploits functionality. There's some good information on using it in the free Metasploit Unleashed course. There's also DVWA from a web applications perspective EDIT: Another good list I came across on a blog recently, has quite ...


13

The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies. Even a quick read over the project websites provides an indicator of the likely comparative security ...


13

You are right about accessing the file system and internet, especially because the home folder is mapped with write permission by default. This implies that it can mess with your documents as well, for example adding macros to Open Office documents, deleting your mp3 files or sending interesting files to someone on the internet. And yes, it can write to ...


13

If the only user on the database that can change records is root and your CMS uses the root user to perform queries then you have a problem. Your root user should never be used by a website. Get a limited user which can only access the tables and records he needs to access restricted with the right permissions. If he doesn't need delete or update, then ...


12

It's not exactly a guide, but I believe CWE - Common Weakness Enumeration is excellent source of common software vulnerabilities (not just web) and it is up to date. And of course for web application, the OWASP site contains a lot of useful information about web application vulnerabilities.


12

The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions. You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these ...


12

I tend to start with http://secunia.com for vulns per-product or vendor, pick the CVE references up from there and then view the details on http://www.cvedetails.com


12

Get a known clean version of your site and identify the differences between the known good code the and current (hacked) production code. Study how the changes may have been made and repair. Update the passwords. Fix the FTP certificate issue - consider using 2 factor authentication. Find a way to scan your code for vulnerabilities - peer review or ...


11

@rook : you should run a diff on the two kernels, after all those years (17 since the split) of divergence there isn't that much that is still common, however there is still cross-breeding between projects and a really good idea will spread all around. OpenBSD got way more in the way of security architecture, as in compiler support to prevent buffer ...


11

As previous answer have covered most of the scenario in which attacker can get direct benefit by analyzing application crashes. I will recommend read on "Analyze Crashes to Find Security Vulnerabilities in Your Apps". Analyzing crashes for security vulnerabilities may require low level programming skills. As shown in figure 1 every exploit may not lead to ...


11

HTTP TRACE method basically replies the request, together with all the headers in response. Cookie header will also be included in response. Session cookies should have httpOnly flag for preventing Session Hijacking attacks. This flag blocks access to the cookie value from Javascript. Basically this ensures that even if attacker will exploit a XSS flaw in a ...


11

In my experience these are my following observations: Should it revolve around the ability to verbally explain attacks at a non-technical\technical level? Yes. Absolutely it should involve a technical level. Non-technical explainations are a bonus, you will, as a pen-tester be involved in meetings with people who know nothing about what you're doing ...


10

There is definitely a risk - scripting essentially allows execution of code on the browser. The vulnerabilities range from reading your browser's history to installing malware to phishing your bank credentials - each of which can potentially cause you "harm" in some way. However, given that most of today's web sites rely on scripting, there's a huge loss ...



Only top voted, non community-wiki answers of a minimum length are eligible