Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

cors error with location

I'm trying to do a proof of concept, everything works fine for me. but after exploiting the cors i want to redirect to another web but when i try to do that it doesn't work anymore. Could you help me ...
user avatar
  • 1
1 vote
1 answer
36 views

Is a buffer overflow / command injection attack possible with magnetic strip?

I am relatively new to security and I would call myself an amateur researcher as I do not even work in IT. However, I remember having a MS605 card reader / writer / encoder and I loved playing around ...
user avatar
  • 13
0 votes
1 answer
35 views

Import a exploit into msfconsole on ubuntu

I'm attending a offensive security courses and one of the subject is import a exploit from exploitdb into msfconsole. Commonly advice that it's required to create a exploit folder inside .msf4 and ...
user avatar
0 votes
0 answers
28 views

CVE-2021-4034 : __environ is init before the GCONV_PATH injection

I am a bit late to the party but I decided to look into the polkit vulnerability (CVE-2021-4034). I get that the code injection comes from iconv loading an arbitrary library file through the ...
user avatar
1 vote
1 answer
49 views

Is there a way to check if vulnerability introduced by npm package is reachable/exploitable

I have a problem where I have too many vulnerabilities on a few hundred repositories introduced with outdated npm packages. The issue is that I need to find a way to prioritize this. The biggest pain ...
user avatar
  • 11
7 votes
2 answers
1k views

/opt and sudo unzip to /opt, is it safe?

Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
user avatar
0 votes
0 answers
22 views

Explotation of reload/redirect through javascript

While working on a site (https://website.com/site/site.apexp) the site redirects through a javascript function: <html> <script> function redirectOnLoad() { var escapedHash = ''; ...
user avatar
  • 1
0 votes
0 answers
21 views

Shellcode working outside of GDB, but not inside

I am working on a pwnable.kr challenge in which I have to write a simple x86_64 assembly shellcode to read a file using syscalls. I generated the shellcode using pwntools: from pwn import * context(...
user avatar
-2 votes
2 answers
57 views

Vulnerabilities due to improper use of cipher's mode of operation? [closed]

I want to know if there was any vulnerability discovered - whether known to be exploited or not - in cryptographic systems due to improper use of the underlying block-based encryption algorithm's mode ...
user avatar
  • 1
0 votes
0 answers
43 views

Metasploit module for NULL LDAP credentials

This article covers the solution for the LDAP challenges on a capture the flag. I understand how the first example works, using the NULL value for the username and password to authenticate to the LDAP ...
user avatar
0 votes
0 answers
23 views

Can I import this exploit on metasploit or is better to use it in python? [duplicate]

I have tried to import this exploit: https://www.exploit-db.com/exploits/50539 and then use it in Metasploit (I'm following a walkthrough), but Metasploit cannot load it. Also I tried to use Python ...
user avatar
0 votes
0 answers
50 views

can hackers access a subnet in different network? [duplicate]

If I'm in my private network with my IP 192.168.4.5 and public IP 34.124.x.x, can hackers access my computer only with exploit/vulnerability (no malware) from a different network? The videos, sites ...
user avatar
0 votes
0 answers
37 views

Can I find the private key on an old Android Wallet's source code?

I recently found an old wallet from my younger self with God-knows what kind of embarrassing data on it. I only found the back up files on a cloud service and did some digging as to what it was when ...
user avatar
2 votes
1 answer
137 views

How to track which php file executed a malware binary

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
user avatar
0 votes
0 answers
25 views

Are "Pop Directional Formatting" and "Left-to-Right Override" unicode characters a possible exploit on NodeJS?

In a database table, I was running some phone number validations and I noticed that some unicode characters were inserted in a phone number field. The characters are: (U+202C): Pop Directional ...
user avatar
0 votes
0 answers
10 views

What are some safe ways to play a video file that was downloaded from the internet? [duplicate]

I would like to know what are some safe and easy ways to play a media (in particular, video) file that I downloaded from the internet, from an untrusted source. I know that if I use an open-source ...
user avatar
2 votes
1 answer
34 views

ld.so Secure-execution mode a valid mitigation for polkit CVE-2021-4034?

I was browsing the ld.so man page and I saw an entry about Secure-Execution mode: **Secure-execution mode** For security reasons, if the dynamic linker determines that a binary should ...
user avatar
-1 votes
1 answer
66 views

What can I do with reverse engineering

I have come across a lot of guides and blogs about reverse engineering where they use labs to teach various techniques and methods to break binaries. My question is what actual use cases does reverse ...
user avatar
0 votes
1 answer
25 views

Is It possible to bypass DEP if one of the linked dll or the exe itself is DEP disabled?

i have a program named x. The program x have one modules which is dep disabled and all other modules linked with dep enabled. What will be the state of the program x , when developing an exploit , do ...
user avatar
0 votes
0 answers
55 views

Implementing a protection for pie register vulnerability

I'm working on implementing a protection for a WordPress pie register plugin vulnerability being called: WordPress pie register 3.7.1.4 auth bypass / RCE I've conducted a research on the pie register ...
user avatar
22 votes
4 answers
5k views

Are web servers that support HTTP any more vulnerable to client-run exploits than those that use HTTPS?

Does HTTPS have any unique mechanisms that protect web servers from exploits run by a malicious client (eg. SQL injection, specific browser exploits etc.)? My current understanding is that HTTPS is ...
user avatar
2 votes
1 answer
116 views

Avoid stack addresses containing zeros

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox). ...
user avatar
  • 131
31 votes
5 answers
9k views

If my machine is infected and I run a Virtual Machine inside of it, will the VM also be compromised

I've been researching on virtual machine security and found a lot of articles detailing how an infected VM is isolated (or not) from the host machine. But I couldn't find any answers to the opposite ...
user avatar
0 votes
0 answers
41 views

How did the PSP firmware 5.03 HEN-C exploit work?

On the historical PSP (PlayStation Portable) console on firmware version 5.03 there used to be a thumbnail-based exploit called HEN-C. It worked (under a race condition I presume since it didn't work ...
user avatar
0 votes
2 answers
124 views

When receiving PDFs from unknown sources, is it sufficient to remove dynamic content (flash, JS, etc.) to minimise attack surface?

My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients, and while the image formats ...
user avatar
0 votes
0 answers
32 views

How to permanently remove DDE Exploit:O97M/DDEDownloader.C? Do I need to nuke my computer? Is it safe to not do so? [duplicate]

1Starting yesterday windows defender has found and quarantined 5 copies (pic 1) of the following threat (pic2) Exploit:O97M/DDEDownloader.C see here. I tried contacting Microsoft tech support but they ...
user avatar
  • 1
2 votes
2 answers
91 views

Javascript based attacks when not having JIT

Some browsers like Chromium and recently Edge have a flag to disable JIT. What attacks/threats does this protect against and what JS based attacks are not prevented?
user avatar
  • 31
0 votes
0 answers
12 views

"No session was created" between VMs [duplicate]

I'm a newbie to Metasploit and I have set up 2 VMs: Kali Linux and Windows 8 (victim machine). They use NAT adapter to connect to the internet. I want to make one exploit on ms17-010 but the result is ...
user avatar
  • 1
0 votes
0 answers
72 views

What equipment would an attacker need to infect a SIM card?

I'm aware that SIM cards can store malware according to this question but what equipment would be needed to do such an attack? For example, would you need a Computer and a SIM card reader or could it ...
user avatar
0 votes
1 answer
63 views

Can 2k (or in the spirit of the new year, 2k22) bugs be security risks?

Microsoft Exchange was recently affected by an issue involving the way they stored timestamps (overflow). Could this, and similar bugs, be exploited by an attacker?
user avatar
  • 1,147
1 vote
1 answer
130 views

Log4shell - Should affected servers be "nuked from the orbit"?

Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over? For example, we find out that a publicly ...
user avatar
  • 151
6 votes
3 answers
522 views

At which OS privilege level log4j usually runs?

Considering that a RCE vulnerability has been recently found in the log4j library, a library used in a lot more applications than I thought. The following question comes to my mind. If an attacker ...
user avatar
  • 151
3 votes
1 answer
335 views

How to find out I an application is vulnerable for log4j?

I am using a Mac for my daily work, But I do not know if I am vulnerable for the log4j exploit. Is there a way to find out? Is there a way to find all the applications that are using java? How to ...
user avatar
  • 251
3 votes
1 answer
470 views

Can one protect from the Log4j exp by sanitizing the parameters?

A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). (From an email CloudFlare sent to users) ...
user avatar
  • 271
12 votes
2 answers
679 views

How can the Log4Shell exploit affect an end user?

I am not an expert in security items and exploits - so there I would like to know how this recent Log4Shell exploit can affect me as an end user. Reading the news, the exploit can affect services like ...
user avatar
  • 251
1 vote
1 answer
113 views

Is it possible to recover data from a bricked smartphone?

I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it. If I recycle this phone, can someone down ...
user avatar
-1 votes
1 answer
112 views

Can modern radios/ham sets/digital walkie talkies be exploited?

Given the fact that modern radios/walkie talkies/ham sets have CPUs on them...would it be possible to exploit them? I am thinking in the following scenario: -There is a vulnerability in the function ...
user avatar
  • 133
0 votes
3 answers
188 views

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

OpenBSD has had much fewer "code execution" vulnerabilities and even fewer exploits than FreeBSD, according to https://cvedetails.com : https://www.cvedetails.com/product/163/Openbsd-...
user avatar
  • 312
0 votes
0 answers
81 views

64 Bit ELF Buffer Overflow Not working possibly due to if statement

I wrote the following: #include <stdio.h> int win(){ printf("Won!\n"); return 0; } int vulnerable(){ char buffer[20]; memset(buffer, 0, 10); printf("Input: &...
user avatar
0 votes
0 answers
112 views

Exploiting the local stack buffer overflow in cmd.exe

I have followed some online tutorials for generating shellcode payloads using Kali Linux, which I have confirmed working by performing several attacks using it. During my pursuit of knowledge, I have ...
user avatar
59 votes
2 answers
6k views

Why does this attack check the location of the server?

Recently (just now) the npm package ua-parser-js was found to be hijacked. The hijack installs a crypto miner on preinstall but I noticed the following passage in the preinstall script: IP=$(curl -k ...
user avatar
0 votes
1 answer
129 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
user avatar
  • 138
1 vote
0 answers
150 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
user avatar
  • 11
0 votes
0 answers
81 views

What are the latest techniques/advances in binary exploitation? Conversely, latest advances in defending against them?

I know the wording might be off so bear with me a minute to explain what I'm trying to find: If you never touched the topic, you start off with stack buffer overflows, then you learn about ret2libc, ...
user avatar
  • 133
0 votes
0 answers
121 views

Using msfvenom shellcodes on basic bof demonstration on syswow64 (win10 latest) leads to access violations and StackHash_2beb

I'm currently preparing a course on buffer overflows. The course takes place on the latest version of Windows 10 due to other constraints. Here is my experiment setup: I simulate a basic stack ...
user avatar
  • 131
3 votes
2 answers
383 views

ROP executes system("/bin/sh") but does not attach to it

Here is the code: import struct buf = "" buf += "A" * 552 buf += struct.pack('<Q', 0x401493) # pop rdi; ret buf += struct.pack('<Q', 0x7ffff7f79152) # /bin/sh buf += ...
user avatar
  • 131
0 votes
2 answers
311 views

How to completely restrict Steam in Linux to defend against remote zero day exploits?

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
user avatar
0 votes
1 answer
117 views

MongoDB NoSQLi in Cockpit CMS - use of $func?

Please explain how this recent Cockpit CMS exploit works, specifically using the $func operator of the MongoLite library, in more detail. How does it exactly make the PHP code behave? As I understand ...
user avatar
1 vote
3 answers
187 views

Does hashing syslog (or similar) make for good passwords?

I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
user avatar
  • 11
4 votes
2 answers
453 views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
user avatar

1
2 3 4 5
26