Tag Info

New answers tagged

0

Try http://www.codebashing.com/sql_demo .. they have created an interactive security war-game with integrated tutorials that walk you through a security vulnerability .. currently they support OWASP top 10 threats and are also working on a mobile security training portal. Disclosure: I work for Codebashing as a developer


0

If you're after security, running a VM is the wrong way to go about it. As the host OS, Windows 7 (and any malware you happen to get) will have full access to the VM. The VM's storage will be stored as a data file on the host machine's storage. This means that any host process that has access to the filesystem can modify data inside the VM's storage ...


0

I'd recommend http://vulnhub.com/ as a place to start looking, as they have been building a repository for pentesting VMs for a while now.


0

There are stacks: Metasploitable, DVWA, BWaPP, Mutillidae, WebGOAT (although the last few are vulnerable web apps). There is also Hack.Me, a community project where people upload vulnerable sandboxes for others to practice against. Troy Hunt has an online vulnerable web app to test against: http://hackyourselffirst.troyhunt.com Alternatively, you could ...


0

Just as a general rule, virtual machines cannot isolate against kernel mode malware that is VM aware. They are really only an effective containment for user mode malware. For user mode malware, or kernel mode malware that is "passive" (ie does not attempt to screen the kernel environment), the VM will contain it reliably so your measures are unnecessary. ...


2

Network questions: All your network related questions are basically down to the malware been able to talk with other computers on the network to. So, if the other devices outside of your guest machine are vulnerable then you're exposing your whole network. You'll want to have different NATs so they can't talk to your host machine or any other device on your ...


2

I don't know how exactly a UML kernel is run on the host system. I'm entirely speculating, but my speculations might be useful if you can combine them with some documentation on UML implementations. Privilege escalation in the guest with a guest-specific exploit Being root on the guest kernel should essentially allow you to do whatever you want with the ...


1

You could protect /dev/kvm with a group. Transfer /dev/kvm ownership to the group so that root privileges aren't given. This link explains how to do it, and here's the direct quote: The cleanest way is probably to create a group, say kvm, and add the user(s) to that group. Then you will need change /dev/kvm to owned by group kvm. On a system that ...


1

With KVM and Xen, the rogue administrator can take a snapshot of your live machine, then explore at his leisure what is in the RAM of your VM. In particular, he will easily obtain the encryption keys for the encrypted filesystem, and then proceed to read all your files. By the very nature of the snapshot system, you will not notice it. With OpenVZ, you ...


3

Use a clean PC or VM for your VPN connection and never ever use that system outside of the VPN. A VM will only work if your host is clean. If you install free games or random software then you SHOULD NOT trust your PC anymore. Never login to accounts that you use outside of the VPN !!! Create separate accounts for any service you use over the VPN. Never ...


1

Regardless of what virtualization technology you use. Once the attacker has access to the hardware, it's game over. In case of a VPS, even when encrypting the root partition, if the key is stored in memory and you have no control of the hypervisor, then you cannot protect your system's confidentiality with encryption. Administrators with access to the ...



Top 50 recent answers are included