Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Insecure Deserialization in C# (.NET) using NewtonsoftJson [migrated]

I am working on a Web API that needs to call a 3rd party Web API to achieve some features. That 3rd party's API's design is sort of a "God API" such that it takes a generic object type to ...
Paul Nogas's user avatar
0 votes
0 answers
58 views

how to exploit CVE-2023-1613

I am trying to understand the vulnerability in Rebuild in chromium which is identified as CVE-2023-1613. I found this poc online: https://github.com/getrebuild/rebuild/issues/596 What I understood so ...
anonymous's user avatar
0 votes
0 answers
56 views

Predicting V8's Math.random() truncated outputs [migrated]

i'm doing a research & working around Math.random() like a month ago. Math.random() uses XORSHIFT128+, so, if we can get the state of the PRNG, it'll be easy to predict future outputs. It is ...
laut3n's user avatar
  • 1
1 vote
1 answer
108 views

Does PDF level compression implicitly cleans file of malware?

Recently I've been looking into PDF files security, specifically about malware exploiting vulnerabilities in PDF readers. I thought about one thing - does compressing PDF file (for example, by using ...
Madzik's user avatar
  • 13
2 votes
1 answer
126 views

Can I use SELinux to add an extra layer of protection against 0-day VM escape exploits in KVM/QEMU?

My host is Fedora, and I want to add an extra layer of protection against 0day KVM/QEMU exploits that execute code on the host. For example there have been CVEs where if we run a specially crafted ...
OneAndOnly's user avatar
0 votes
1 answer
130 views

How are virus or exploits tested without being detected?

I was wondering how threat actors actually test their exploits without them being automatically detected and added to the library of an antivirus detection system, thereby being marked as useless and ...
birdd's user avatar
  • 41
0 votes
1 answer
113 views

How does malware work when compressed?

I have read up on compressed folders of file types such as .zip, .rar and .7zip being the malicious file itself (excluding cases such as an .exe file being disguised as a .zip file etc...), only ...
ReaLiTy-UnFatHom's user avatar
1 vote
1 answer
71 views

Metasploit search features returns intersection of results

When I use multiple search criteria in Metasploit it shows the results as an "or" rather than an "and". I see that this was asked several years ago so now I am wondering if this ...
osus71's user avatar
  • 13
0 votes
0 answers
92 views

Cache poisoning from rfc6455 (WebSockets) not requiring server message to be masked?

In RFC6455 section 10.3, it explains why they have made clients mask their outgoing frames (so that a malicious server cannot manipulate a client into sending something in plaintext, as the message ...
Secto Kia's user avatar
  • 101
2 votes
2 answers
255 views

How malware triggers without user running an executable?

It is known that downloading a file without actually executing it can be a security vulnerability, if the operating system does something which is not known by the user. See here for some good answers....
Ma Joad's user avatar
  • 121
0 votes
1 answer
215 views

SSRF trough Gopher

Gopher protocol is used a lot when exploiting SSRF, but how? a Gopher URL takes the form: gopher://<host>:<port>/<gopher-path> but let's take this example: gopher://10.10.10.3:80/...
jeff's user avatar
  • 3
0 votes
0 answers
198 views

how to exploit read -p in bash script

i wanna execute ls command inplace of the output being "your name is ls" is there a way to do it ? read -p "name??" name echo "your name is $name"
AverageUser69's user avatar
1 vote
1 answer
127 views

Security vulnerabilites in Windows updates from local network

Windows has offered the ability to download updates from machines in the local network for some time. My gut feeling tells me this would be a great attack vector for Windows security vulnerabilites. ...
J Heschl's user avatar
  • 123
1 vote
0 answers
74 views

How can I exploit the following code using string format vulnerabilities, Global offset table & GDB? [closed]

The following code should be exploited and I need to exploit it in such a way that it runs my command (l33t) and there should be shellcode and exploit included, so that it runs my command. I believe I ...
A M's user avatar
  • 11
1 vote
0 answers
59 views

Information on the Exploitation and Automatability Data for Vulnerable components

Is there any tool providing information such as exploitability state (i.e., None, POC & Functional/Active) and automatability data for a specified vulnerable component name and version?
sad_semicolon's user avatar
1 vote
0 answers
67 views

Why do I suddenly receive print notifications on Windows 10? [closed]

I have seen whats's in the image. But i don't have any printer. OS: Windows 10 22H2
priv-like-user's user avatar
1 vote
0 answers
87 views

How to properly pack address into bytes to overwrite EIP register

I'm learning how to exploit a tiny web server based on a well written post here: https://blog.coffinsec.com/2017/11/10/tiny-web-server-buffer-overflow-discovery-and-poc.html I am very close to ...
Jay's user avatar
  • 111
1 vote
1 answer
134 views

Is there a possible attack on a MySQL database using an input window [closed]

My app has an input field that is used as a source for a HTML and PDF file. I also store this input in my database. My question is: Is it possible to somehow write something in the text field which ...
VicTheWise's user avatar
0 votes
0 answers
61 views

What security issues could my system be exposed to via an unsecure memory card?

I'm working on an article that involves flash memory cards being put into machines that process and track sensitive information. The machines scan data from forms, then input the data into a database. ...
EstanciaLiberty's user avatar
1 vote
0 answers
85 views

How could the contents of multiple LastPass vaults be compromised?

According to this newly published article: Now, it appears that the LastPass hack has led cybercriminals to steal over $35 million in cryptocurrencies. ... Nick Bax, director of analytics at ...
End Anti-Semitic Hate's user avatar
2 votes
1 answer
215 views

Does Routersploit install any malware or executables on my PC?

If I install Routersploit on my PC, would it install any malware or executable binaries as part of it to PC? Even though developers of Routersploit do not have any nefarious intention to add malware, ...
Ajay's user avatar
  • 41
0 votes
1 answer
159 views

What to do if a bank doesn't admit it leaked millions of customer's data [closed]

I found a breach on a bank's website a few months ago which exposed customer data including: SSNs, account numbers, account balances, physical addresses, payment history, tax forms, temporary login ...
my-name's user avatar
0 votes
0 answers
194 views

Is UAC an overestimated protection measure in Windows? Does Linux do it better?

Windows is an API-based operating system, whereas Linux is file-based. Hence in my opinion, any operating system API security measures alone aren't effective in Windows. One of such examples would be ...
Sir Muffington's user avatar
0 votes
1 answer
408 views

Unable to execute shellcode on x86_64 architecture

I currently got interested in binary exploitation (even though I do not know if today is still useful). I started studying shellcode and buffer overflow (stack-buffer overflow, specifically). I know ...
KmerPadreDiPdor's user avatar
0 votes
2 answers
371 views

Is it possible to run a code only with an environment variable?

I'm researching the possibility that modifiable environment variables could have security implications. I mounted all writable volumes with noexec. LD_PRELOAD could be an attack surface, but I don't ...
user212942's user avatar
1 vote
1 answer
174 views

"PUT /SDK/webLanguage HTTP/1.1" on a server with only port 22 open

I've recently spun on a new droplet on Digital Ocean with Ubuntu 22 and enabled UFW and allowed only SSH, which reports being active even after a reboot: sudo ufw status Status: active To ...
Fanu's user avatar
  • 13
0 votes
0 answers
370 views

Help creating an exploit for CVE-2019-11500

I'm looking for a way to exploit CVE-2019-11500. Here's how it's described: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for ...
pwhx's user avatar
  • 1
3 votes
1 answer
262 views

NULL dereference - Why does it work?

I know that exploiting NULL dereferences is a thing of the past and that modern systems prohibit user processes from mapping NULL page, but I also know that back in the day, a NULL dereference in the ...
user9128's user avatar
2 votes
1 answer
343 views

Is running rsync as root problematic?

Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du? Background: I'm moving data from various systems ...
Fizz Khalifa's user avatar
51 votes
1 answer
10k views

What vulnerability is a math operation in an HTTP request trying to exploit?

I found the following string '<?=print(9347655345-4954366);?>' in a blocked request logged by our WAF this morning. This string was contained in the path as well as a number of headers. GET /?'&...
Dave Rager's user avatar
1 vote
0 answers
111 views

How to switch user instead of using uid? [closed]

In some methods of privilege escalation, if you want to be the root user, you write like this: setuid(0); setgid(0); And this is because the uid and gid of the root user is 0 id root uid=0 (root) ...
Freeman's user avatar
  • 241
1 vote
0 answers
257 views

XXE OOB File Content Extraction

Currently, I've discovered an OOB XXE that allows me to include a .dtd file to extract a particular system file content, for instance, /sys/power/disk. So my file.dtd is: <!ENTITY % data SYSTEM &...
nicg's user avatar
  • 11
0 votes
0 answers
794 views

How easy or difficult it is to exploit older SSL/TLS protocols?

Detection of outdated TLS/SSL protocols are one of the most common findings I have seen in many vulnerability scans and penetration testing reports. It is reported as a serious vulnerability too. ...
Sreeraj's user avatar
  • 1,317
0 votes
0 answers
109 views

Can WebASM provide JavaScript style interactivity without the same vulnerabilities?

JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript. I was wondering if it ...
user5623335's user avatar
1 vote
1 answer
141 views

Security Implications of Automatic Updates?

I have a custom Debian router installation which I'm trying to keep both secure and low-maintenance. I've therefore set some scripts which keep my Docker containers, blocklists, and OS (security ...
Synthetic Ascension's user avatar
2 votes
1 answer
459 views

Msfvenom reverse_tcp without LHOST

I have tested SMBGhost (CVE-2020-0796). I used the following msfvenom command to generate a reverse shell payload. msfvenom - p windows/x64/meterpreter/reverse_tcp LPORT = 4444 - b '\x00' - i 1 - f ...
HelpMe's user avatar
  • 21
1 vote
0 answers
194 views

Why was CVE-2022-20411 (Bluetooth Remote Code Execution) not detected by Android's BoundSanitizer?

CVE-2022-20411 enabled remote code execution over Bluetooth on Android. It was fixed in December 2022. But why was it not detected by Android's BoundsSanitizer? Its purpose is to detect and prevent ...
Finni's user avatar
  • 111
0 votes
1 answer
164 views

Info integer overflow vulnerability

I've found this interesting question Is this integer overflow vulnerability exploitable?. How can I practically find the next instruction (in gdb) so that I can overwrite the return address and ...
LianoQ's user avatar
  • 1
1 vote
1 answer
495 views

Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?

https://lolbas-project.github.io/ Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
user avatar
0 votes
1 answer
735 views

Exploit failed: NoMethodError undefined method `smtp_send_recv' for #<Module:exploit/unix/smtp/exim4_string_format [closed]

I was trying to run an exploit using Metasploit's Exim tool. In the process I will have used the exim4_string_format module. I gave as information a RHOST, LHOSTS AND LPORT. To attack the reverse_perl ...
larasputinnieiwqgbpre's user avatar
0 votes
1 answer
123 views

pvefindaddr p2 in mona?

Is there a "!pvefindaddr p2" (search for all pop/pop/ret combinations in the entire process memory space) equivalent in mona.py? Alternatively, is there any option to run pvefindaddr in ...
user286591's user avatar
1 vote
1 answer
563 views

How can I test the BlueKeep exploit?

I want to do the BlueKeep exploit, but I want to do it legally. I know how to do the exploit, I am just trying to figure out how to set up something that is vulnerable to BlueKeep. How can I ...
TheRealTengri's user avatar
1 vote
1 answer
160 views

Get in depth information about vulnerability from a CVE

I'm trying to understand how to get more information about a vulnerability given a CVE. I noticed that some CVEs, on websites like https://www.cvedetails.com, have got references to articles or to ...
Fral's user avatar
  • 13
1 vote
0 answers
282 views

Help with a pentesting lab [closed]

I am a graduate student working on a pen testing lab that I am having the hardest time understanding. I am given a link to a Kali VM and told the following as a preamble to the lab. You were recently ...
Gikio09's user avatar
  • 11
1 vote
0 answers
799 views

Changing referer value in burp request has no impact on the response

I am testing a request/response of an application using the burp suite and found that changing the Referer value has no effect on the response. The Referer contains the URL along with the unique ID of ...
Supraja's user avatar
  • 23
1 vote
1 answer
377 views

Why do you need to wrap bash command inside another when opening a reverse shell?

In the CSAW 2022 web challenge, called "my little website", a youtuber in this video used a vulnerability in md-to-pdf to run arbitrary js, and this is the payload used: ---js ((require[&...
snatchysquid's user avatar
-1 votes
1 answer
2k views

I found a way to remove controls on a school Chromebook. How should I tell the school? [duplicate]

Our school uses LanSchool Air and content keeper. I found a way to disable both. I have already gotten my Chromebook taken away for "abusing Chromebook privileges" I think this is a major ...
ANON10104's user avatar
0 votes
0 answers
618 views

CVE 2022-21661 - WP Injection replication

I'm trying to replicate the vulnerability CVE 2022-21661 on my own website that is resulted vulnerable as according the versions involved, as according wp-scan. I'm trying to submit a POST request ...
Giacomo's user avatar
1 vote
2 answers
1k views

Finding offset using Buffer overflow pattern generator

I am trying to find the offset for a buffer overflow attack for a simple C program using a Buffer overflow pattern generator #include <stdio.h> #include <string.h> int main (int argc, ...
Stokes's user avatar
  • 11
0 votes
2 answers
636 views

Where to find detailed info of how to exploit known vulnerabilities?

With most vulnerabilities, I see just summaries and not much detail about what is happening. Is there a good location where you can find demos of CVEs? For example, a CVE would say that the router ...
adrianTNT's user avatar
  • 140

1
2 3 4 5
26