The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

1
vote
0answers
22 views

MySQL BACKRONYM (CVE-2015-3152) only affects MySQL client?

I read the CVE-2015-3152 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152) named BACKRONYM (http://backronym.fail/), and what I understood (ELI5 style) was the following: Attacker ...
-1
votes
0answers
30 views

How can I debug a running process on my computer? [on hold]

Using GDB can I debug a process ID to see where a particular variable is stored in memory? Consider that: I'm running a javascript game which is running in my browser, and I'm on Kali Linux. Can I ...
3
votes
1answer
30 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
2
votes
1answer
34 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
6
votes
2answers
291 views

How does getting a remote shell via exploiting a vulnerability really work?

I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
0
votes
1answer
51 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
1
vote
0answers
66 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
1
vote
2answers
72 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
3
votes
1answer
52 views

Found this textarea with PHP in it. Might it be malicious/exploitable?

I came across this textarea on the website of a Medical Center. Clients enter sensitive medical data here. What users see: HTML: <textarea name="message">&lt;?php echo ...
0
votes
1answer
27 views

How does a virtual machine escape work and how can it be prevented? [closed]

Although a virtual machine escape is one the most dangerous security issues a virtual machine can be exposed to, there isnt much information about it on the internet IMO. My main questions are: How ...
0
votes
0answers
22 views

What different methods can be utilized to carry out a DoS attack within Android?

So far I have discovered 2 methods of DoS attacks within Android: The first being, inputting unexpected test data to functions e.g. : if a function was expecting a positive number, then input a ...
5
votes
2answers
231 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
1
vote
2answers
42 views

Why Wordpress doesn't filter post_title?

Today, when I did some tests and found out that Wordpress doesn't filter the post_title. Respectively, I make posts with the titles: <?php while ( have_posts() ) : the_post(); echo 'Post Title'; ...
2
votes
2answers
91 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
1
vote
2answers
46 views

Potential worm damage on a physically isolated Tor system

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), and I'm concerned about methods a worm could use to infect my OS. In the ...
2
votes
0answers
46 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
0
votes
1answer
46 views

Why is Parallels Plesk running on port 8443 > 1023?

Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for ...
-2
votes
1answer
52 views

Are exploits 1:1 with vulnerabilities? [closed]

I know that for the most part, there are some small differences between thoughts on a lot of matters in terms of definitions in security. What I am asking about is whether exploits are considered to ...
0
votes
3answers
71 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
10
votes
1answer
858 views

Legality of writing exploits for educational purposes (USA, Canada) [closed]

Is it legal for me to write a small exploit (possibly to a closed issue) and put it up on the internet for everyone to see (as a tutorial)? I have been researching the legality of exploiting ...
13
votes
4answers
700 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...
2
votes
1answer
63 views

Buffer Overflow EDI but not EIP

Is possible to exploit a program if you can only overwrite ESI or EDI register without EIP? Program in question does seg fault and overwrite EDI, ESI and ECX but can't get it to overflow EIP. Anyone ...
1
vote
0answers
31 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
9
votes
2answers
1k views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
6
votes
2answers
93 views

Modify C code with buffer overflow vulnerability to skip code

I'm trying to find a way to exploit the buffer overflow vulnerability in the following source code so the line, printf("x is 1") will be skipped: #include <stdio.h> #include <stdlib.h> ...
0
votes
2answers
139 views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
1
vote
2answers
100 views

Questions regarding Bad USB exploit

I own a Netbook and my external DVD Drive is possibly infected with Bad USB. If i install Ubuntu using this infected DVD drive could my system be taken over during installation process or later when ...
0
votes
1answer
95 views

Java desktop app vs web service [closed]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
1
vote
2answers
78 views

Meterpreter and staged payloads

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions A staged ...
5
votes
1answer
91 views

Return oriented programming without int 0x80

I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location. However, this region does not ...
4
votes
2answers
66 views

Are there methods for determining the exploitability of bugs, after a crash is found in fuzzing?

I have found this, https://msdn.microsoft.com/en-us/magazine/cc163311.aspx It says that only "a full root-cause analysis can ensure that you have correctly diagnosed whether a given crash is ...
2
votes
1answer
97 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
1
vote
0answers
64 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
1
vote
0answers
27 views

Possible exploit while MPLS parsing with Bottom of Stack bit

My current task to parse MPLS label in a packet and store them in to a list. When I check packets with MPLS: One can understand it is the last MPLS header by checking Bottom of Stack bit. If ...
12
votes
9answers
3k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...
2
votes
1answer
79 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
1
vote
1answer
85 views

Bash Shellshock

I am trying to find out if my devices are vulnerable to bash shellshock. I have run the commands found on https://shellshocker.net. It seems my devices are both susceptible to only one of the ...
1
vote
1answer
76 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
8
votes
4answers
637 views

Evading IDS in exploit development

In the context of buffer overflow exploit development, I was asked: Discuss how your exploit may be modified to evade an Intrusion Detection System. I'm not asking for my homework to be done, but ...
3
votes
3answers
83 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character on realtime so when i input the following code: <input onclick=alert(document.cookie)> there ...
2
votes
1answer
91 views

Resources to learn about Windows systems exploitation [closed]

I'm a beginner in penetration testing, and I'm struggling with finding decent material to learn. I used book about nmap, Metasploit, exploit writing etc..., but they contained too much information ...
-2
votes
1answer
129 views

Possible Injection to PHP PDO

Expert says that PDO is one of secure scripting from mysql injection. I have read the manual about it and do some little research. And here, I'm trying to get ID value from URL paramater, as in: ...
4
votes
1answer
86 views

Realistic: Exploiting a computer on BIOS/ hardware level in less than an hour? (Infinite preparation time)

I wonder how hard it it to infect a laptop or netbook in 60 minutes or less in a way the victim cannot easily clean their machine by wiping hard disk drives. Let's assume the following: The ...
13
votes
3answers
403 views

remote desktop connection to a potentially compromised machine

I am using rdesktop client on Linux to connect to windows machines. If some of these machines were compromised by some evil malware/virus/worm/trojan, is there any way for the malware to "jump" to my ...
1
vote
5answers
112 views

How to analyze spam email URLs to detect exploits?

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside ...
3
votes
1answer
131 views

SMB/CIFS shares on HP-UX vulnerabilities

So, I've run an unauthenticated Nessus scan against a critical piece of infrastructure as part of a pen-test but I'm getting back some weird stuff and i can't seem to re-create the issue to ...
1
vote
1answer
48 views

Are Sun/Oracle's SPARC processors invulnerable to buffer overrun exploits?

We all use Intel architectures these days, in small part because Oracle has totally dropped the ball regarding SPARC CPU development. But with so many now saying that protection against viruses is ...
14
votes
7answers
1k views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
1
vote
1answer
175 views

How do I prevent tampering with form submission data, and changing the details for any account?

Although this is something that only employees can use, I'd like to prevent the tampering anyway. I don't like insecure code, and this is hideously insecure. Here's an example link: <a href="#' + ...
4
votes
1answer
200 views

How did GamerFood hack the Starcraft IEM Taipei Tournament? [closed]

During the recently completed professional Starcraft tournament, Intel Extreme Masters (IEM) Taipei 2015, the notorious cheat software company Team Gamer Food hacked the cast somehow. How did they do ...