Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

0
votes
0answers
30 views

I found a massive security flaw in my university's Apache web server setup that allows system-wide read access. What to do? [duplicate]

I was working on a school project when I found a clever solution to a problem I was facing. Then I got curious and wondered if this "solution" could be extended to do other things. Long story short, I ...
0
votes
4answers
108 views

Does exploit development have a future? [on hold]

Does exploit development have a future? I mean there are a lot of fuzzers and they can find bugs better and with less time than humans. And today's there are lots of great fuzzers. I love exploit ...
0
votes
1answer
64 views

How to back up and restore personal data safely from possibly exploited android phone

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is ...
-2
votes
0answers
14 views

Is it possible to bypass or exploit with truncate, local file inclusion, path traversal attack or with any other possible attacks?

Is this code safe to execute, or how intruder can truncate the .php extension or make any other attacks? <?php $var = (string)@$_GET['var']; $var .= '.php'; if (file_exists($var)) { echo ...
1
vote
0answers
53 views

Buffer overflow shellcode placement

Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
-1
votes
0answers
74 views

Break out of from a network printer (with port 9100/tcp open) onto the networks computers

My Question is referring to this article: Port 9100 printing and the introduction from this git repository: PRET - Printer Exploitation Toolkit If you are connected to a network Printer with PRET ...
0
votes
1answer
38 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
0
votes
0answers
50 views

Metasploit's generic/custom payload

I have generated a custom payload using msfvenom like so (I first want to try with the simplest custom payload - no encoder or anything) : msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192....
-2
votes
0answers
56 views

What can an attacker do with access to a compromised Git branch?

If an attacker gains full write access to an arbitrary branch in a Git repository, which technical attacks could they perform to compromise the integrity or availability of the data in the master ...
0
votes
1answer
25 views

Any way to auto execute a file in windows

MS-Word gives the functionality of OLE In which we embed any link in document and on any event it would go to that link and download the file. The file is stored in the TEMP directory of the WORD. ...
3
votes
0answers
60 views

Recent Pwn2Own baseband exploit

I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
0
votes
0answers
30 views

Problem with buffer overflow exploitation - cannot find free buffer for usage

This is not duplicate post, I saw the other post and its not the same problem: Buffer Overflow doesn't have enough space for exploit after being crashed I have exercise of Buffer Overflow. ...
-1
votes
0answers
27 views

Buffer Overflow - Not enough space for shellcode [duplicate]

I have exercise of Buffer Overflow. After some fuzzing, I successfully crash the application and overwrite the exact 4 bytes of EIP, then I success to jmp to ESP that holds some of my payload (the ...
0
votes
1answer
64 views

Shipment tracking displaying delivery information publicly - Is this dangerous?

Background: Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the ...
0
votes
0answers
30 views

Problem with exploiting 'TrackPopupMenu' Local Privilege Escalation (MS14-058)

I've just started getting into local privilege escalation and ran into a problem. I downloaded MS15-058 from exploit database ( https://www.exploit-db.com/exploits/37064/ ) and did some rewriting to ...
1
vote
1answer
89 views

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)?

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)? I've been playing around with DLL injection by reading some old articles to that use, e.g., calc.exe to ...
1
vote
1answer
40 views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
0
votes
0answers
60 views

javax.xml.* XXE Exploitation

During a pentest engagement, I found an XXE vulnerability on a SOAP webservice written in Java, OS is Windows Server and I'm trying to demonastrate how serious the vulnerability is. The problem is, I ...
2
votes
1answer
364 views

Nessus found a vulnerability, but no corresponding exploit on Metasploit : How to run with meterpreter

I ran Nessus on a local network, it found a critical vulnerability for the router: MikroTik RouterOS < 6.41.3 SMB Buffer Overflow (Vulnerability description : Exploit-db) But I can't find any ...
3
votes
1answer
146 views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
4
votes
1answer
120 views

Metasploit is not detecting newly imported python exploit

I have added OpenSSH 7.2p2 - Username Enumeration exploit to Metasploit, which is a python exploit. But after so, it does not detect that exploit every way I tried. I have placed it under the ...
1
vote
0answers
28 views

What source formats are affected by ImageMagick's vulnaribility caused by Ghostscript?

According to https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/ ImageMagick's convertion to PDF of arbitrary (user-submitted) documents should not be used because of Ghostscript's ...
0
votes
1answer
131 views

Reverse Shell Exploit for SquirrelMail 1.4.22 [closed]

I am trying to gain access to a remote host running Ubuntu with Squirrel Mail 1.4.22. Ideally I need a reverse shell to traverse the machine to find a series of flags. I have discovered that POODLE is ...
-1
votes
2answers
79 views

How can i access any useful information in a wordpress site?

While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here: https://www.exploit-db.com/exploits/45439/ I used it and ...
0
votes
0answers
38 views

RamPage Attack?

It seems there is more to find out about the Rampage Attack. Among different articles on the net I read this too. They say that probably also Desktops could be affected, so all things that have ...
2
votes
1answer
137 views

Does an Egghunter attack still make sense in a 64 bit system?

Background An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
-1
votes
1answer
104 views

Timing Attacks: Against PHP Server - Prevention/Tutorials [duplicate]

What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP? I'm a high school student, I'm new to programming and I've been learning Security since few ...
0
votes
0answers
43 views

Understanding execve() exploit instructions

There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
105 views

Is XSS exploit always illegal? [closed]

I recently got a great deal of $$ stolen by scammers. I am trying to use XSS exploitation to find his real identity (IMSI, IMEI, External IP, Internal IP, any computer unique ID) Is it legal? I am ...
0
votes
0answers
23 views

CVE-2013-0333 Ruby on Rails Yaml Exploit Question

I have a question regarding the Ruby Rails JSON exploit. I understand how it works but I do not understand how code execution is achieved. I understand YAML and how it builds various serialized ...
0
votes
1answer
42 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
2
votes
1answer
119 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
2
votes
1answer
100 views

Is it possible for a virus to be embedded in a image and can this image execute on Android Oreo by just opening the image?

I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? ...
0
votes
0answers
19 views

Using custom shellcode to create custom payload in Metasploit [duplicate]

I'm new to the Metasploit world. I was wondering if I could transform my hand-made shellcode into a payload that I can easily use with various exploits. I've tried searching the internet but I didn't ...
1
vote
0answers
67 views

Bypassing double quote in DOM based XSS?

I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link: <a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script>&...
1
vote
0answers
45 views

How to find the return address when performing an overflow

for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
-1
votes
1answer
47 views

Local File Download(LFD) vulnerability exploit

I have found a arbitrary file download vulnerability in an asp.net application. I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
-4
votes
1answer
82 views

Need help with finding a vulnerability in PHP [closed]

There is a site whose main page is in the formathttp://example.com/index.php?page=1. It contains a rectangular box with text in it. What vulnerabilities can I use to find a hidden file on this site? ...
1
vote
1answer
71 views

Will a browser exploit also work after I have downloaded the website? [closed]

When I visit a website which exploits a vulnerability in my browser and I save this website to my computer and open later the offline version can my browser be hacked again?
1
vote
2answers
164 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
1
vote
0answers
64 views

Empire Powershell DDE Office Exploit Help

So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete. I have to use Empire (https://github.com/...
6
votes
3answers
243 views

What is the (literally) lightest way to run a second secure system?

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with ...
0
votes
1answer
42 views

Disable modules in Metasploit Pro

I have been using Metasploit pro for last few days. I understand that exploiting in Pro version is automatic using exploit ranks(GUI). But If I want to disable certain modules while exploiting, is it ...
2
votes
1answer
56 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
0
votes
2answers
256 views

SambaCry CVE-2017-7494 returns “Exploit completed, but no session was created”

I am using this exploit on msfconsole to exploit a VM with samba and the configuration is as follows: Module options (exploit/linux/samba/sambacry) Payload options (linux/x64/meterpreter/reverse_tcp) ...
0
votes
1answer
141 views

At which point does an exploit against TAILS happen?

Since TAILS by default disallows root/superuser privileges and since traffic is sent encrypted with each relay removing a layer until the exit node, at what point is an exploit on a version of TAILS ...
0
votes
0answers
34 views

trans2open not working on metasploit

I am using metasploit to exploit a vulnerable version of Samba on a remote host. Samba version 2.2.8, downloaded directly from the cve site. But when I use trans2open exploit with payload (generic/...
1
vote
3answers
210 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
0
votes
0answers
23 views

Understanding and executing Format String Exploit(Protostar Format1)

I was following the Liveoverflow Format String exploit example and I had difficulty understanding and executing a few things specifically with this line ./format1 "`\python -c "print 'AAAA' + '\x38\...
0
votes
1answer
108 views

what attacks are possible on outdated versions of TAILS?

I know using outdated software is a bad idea, but until recently I have only been able to boot TAILS from LiveCDs that come with some Linux magazines. Since these arrive in my country late, I end up ...