Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

0
votes
0answers
18 views

CVE-2013-0333 Ruby on Rails Yaml Exploit Question

I have a question regarding the Ruby Rails JSON exploit. I understand how it works but I do not understand how code execution is achieved. I understand YAML and how it builds various serialized ...
0
votes
1answer
21 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
2
votes
1answer
51 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
-1
votes
0answers
70 views

Protecting licensed software when deployed on premises with the licensee

Being a beginner in security and as part of one of my projects, I would like to determine what are the ways software might be vulnerable when deployed in in a specific scenario. Let's say that ...
2
votes
1answer
66 views

Is it possible for a virus to be embedded in a image and can this image execute on Android Oreo by just opening the image?

I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? ...
0
votes
0answers
11 views

Using custom shellcode to create custom payload in Metasploit [duplicate]

I'm new to the Metasploit world. I was wondering if I could transform my hand-made shellcode into a payload that I can easily use with various exploits. I've tried searching the internet but I didn't ...
1
vote
0answers
48 views

Bypassing double quote in DOM based XSS?

I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link: <a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script>&...
1
vote
0answers
32 views

How to find the return address when performing an overflow

for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
0
votes
0answers
26 views

How to copy BS character (0x08) to input for buffer overflow in GDB? [migrated]

I need to overflow a buffer with a specific value that contains 0x08. If I use echo -ne "AA\x08A", the output is AA, as the backspace character and one A are removed. How do I copy this value into ...
-1
votes
1answer
35 views

Local File Download(LFD) vulnerability exploit

I have found a arbitrary file download vulnerability in an asp.net application. I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
0
votes
0answers
28 views

Confused over unlink() macro for malloc

I am trying to understand the basic unlinc() exploit on the heap. (Yes, I know its been patched for years now.) I think I understand conceptually what is happening. The chunk that is being un-linked ...
-4
votes
1answer
72 views

Need help with finding a vulnerability in PHP [closed]

There is a site whose main page is in the formathttp://example.com/index.php?page=1. It contains a rectangular box with text in it. What vulnerabilities can I use to find a hidden file on this site? ...
0
votes
0answers
77 views

How To Hide a Virus Payload in JPG Image [duplicate]

one of my unsolved questions is the hacking in non-stop 2014 movie where programmer sends an image that rings the mobile even if it's in silent; I kind of know about raising volume java code but I ...
1
vote
1answer
70 views

Will a browser exploit also work after I have downloaded the website? [closed]

When I visit a website which exploits a vulnerability in my browser and I save this website to my computer and open later the offline version can my browser be hacked again?
1
vote
2answers
154 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
1
vote
0answers
48 views

Empire Powershell DDE Office Exploit Help

So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete. I have to use Empire (https://github.com/...
6
votes
3answers
238 views

What is the (literally) lightest way to run a second secure system?

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with ...
0
votes
1answer
34 views

Disable modules in Metasploit Pro

I have been using Metasploit pro for last few days. I understand that exploiting in Pro version is automatic using exploit ranks(GUI). But If I want to disable certain modules while exploiting, is it ...
2
votes
1answer
48 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
0
votes
2answers
148 views

SambaCry CVE-2017-7494 returns “Exploit completed, but no session was created”

I am using this exploit on msfconsole to exploit a VM with samba and the configuration is as follows: Module options (exploit/linux/samba/sambacry) Payload options (linux/x64/meterpreter/reverse_tcp) ...
0
votes
1answer
79 views

At which point does an exploit against TAILS happen?

Since TAILS by default disallows root/superuser privileges and since traffic is sent encrypted with each relay removing a layer until the exit node, at what point is an exploit on a version of TAILS ...
0
votes
0answers
27 views

trans2open not working on metasploit

I am using metasploit to exploit a vulnerable version of Samba on a remote host. Samba version 2.2.8, downloaded directly from the cve site. But when I use trans2open exploit with payload (generic/...
1
vote
3answers
127 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
0
votes
0answers
16 views

Understanding and executing Format String Exploit(Protostar Format1)

I was following the Liveoverflow Format String exploit example and I had difficulty understanding and executing a few things specifically with this line ./format1 "`\python -c "print 'AAAA' + '\x38\...
0
votes
1answer
92 views

what attacks are possible on outdated versions of TAILS?

I know using outdated software is a bad idea, but until recently I have only been able to boot TAILS from LiveCDs that come with some Linux magazines. Since these arrive in my country late, I end up ...
0
votes
1answer
55 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
2
votes
0answers
49 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
0
votes
3answers
95 views

Security risks of exposing a VM to single IP address on the Internet

I have a small office network with about 10 workstations and a single physical domain controller. I want to move it to the cloud. For that, I deployed a Windows VM on Azure, which I'm going to promote ...
4
votes
2answers
200 views

From FTP to SSH

Currently, I am doing a penetration testing laboratory with a server with the following services: Nmap scan report for 10.0.11.125 Host is up (1.3s latency). Not shown: 998 closed ports PORT STATE ...
2
votes
1answer
120 views

How does rowhammer physically work?

In rowhammer, why will changing voltage on one row cause the other row to open/close? Induction? How can it change bits from 0 to 1? (I understand from 1 to 0- voltage discharge) how can it cause ...
0
votes
2answers
173 views

Malicious code found - translation please? [duplicate]

An unfriendly visitor left some code on my website. Unfortunately, the coding makes it hard to understand what he wants (probably full control over my server). Any help in deciphering the actual ...
0
votes
1answer
190 views

Difference between Run and Exploit

When using Metasploit for running exploits you have two options: run exploit what is the difference between these two commands?
1
vote
1answer
62 views

is it possible to craft exploits for non-open source C/C++ software without fuzzing?

imagine that if i wanted to find a vulnerability in a program that is used by a lot of people in order to exploit it. the program is open source and is written in C/C++ . would this even be possible ...
0
votes
2answers
76 views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
1
vote
1answer
98 views

What does windows meterpreter reverse TCP Shellcode do?

I have just started learning msfconsole and I have used windows/meterpreter/reverse_tcp . I know this establishes a connection from the target system to our attacking system . However I would like ...
2
votes
2answers
75 views

Are managed programming languages immune to arbitrary code execution exploits?

Classic example of arbitrary code execution is when a stack based buffer overflows, overwrites the return address so the control can jump into the attacker's carefully set up data to execute a shell ...
1
vote
0answers
25 views

OAuth2 and linking resources of one owner to another person account

I'm implementing client side OAuth and I'm worried about the following scenario. There is application A registered with service B that is offering access to its user resources - authorized by OAuth (...
1
vote
0answers
50 views

Why can't I see my shellcode executing in Immunity Debugger?

I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file. I successfully spawned a reverse shell with metasploit, using a ...
0
votes
0answers
25 views

Fully patched Windows 2008 immediate BSOD from low privilege account

Is there any exploit/script/vulnerability where a very low privileged user can trigger a BSOD or reboot? I'm familiar with the USB exploit, but I'm wondering if its possible with some remote method? ...
3
votes
1answer
199 views

strstr and fopen, is there a bypass?

I have a binary that does this: if (strstr(USERCONTROLLERSTRING, "..")) exit; fopen(CurrentPath+"\\Data\\"+USERCONTROLLEDSTRING, "r"); then spits out all the content of the file. Is there any ...
3
votes
1answer
92 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
3
votes
1answer
55 views

Call and Unsolicited One Time Passwords

Context: I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I ...
1
vote
1answer
127 views

What kernel is more secure? [closed]

"Kernel update will have some sort of security fixes that close up holes that have been discovered" So newer kernel means less exploits. For now newest kernel is 4.18-rc4 and newest kernel that ...
1
vote
1answer
104 views

Can an exploit in my browser read login passwords without logging in again?

When I log into my email account through a browser and open an email which exploits some vulnerability in my browser would it be possible for the attacker to take over my account? Passwords for full ...
0
votes
0answers
49 views

What are data exfiltration channels after a successful VM break out?

Suppose someone managed to break out of a VM and gained access on the host. If there is networking on the host this could be leveraged to exfiltrate data. What could done to prevent this? Depending on ...
2
votes
2answers
160 views

What kind of access on the guest is required to break out of a virtual machine?

Is it enough to exploit the vulnerability in a program? Is root or kernel access required? Are there maybe even possibilities to directly exploit the host without any vulnerabilities in the guest? To ...
0
votes
0answers
30 views

Older Angular - 1.2.32 - Payload to XSS

Testing the app with older Angular. Somehow curly brackets are removed when entered in the field, or as parameter. Found this payload list: https://gist.github.com/mccabe615/...
0
votes
0answers
94 views

Metasploit INFILENAME: invalid option

I am using MSF on Kali but I ran into a problem. I am trying adobe_pdf_embedded_exe and I set INFILENAME to readme.pdf. Everything else works fine, but when I try to run it using the command exploit ,...
1
vote
0answers
78 views

Is there any modern scalable way to do system call monitoring?

I wrote a kernel module to replace the Linux kernel service routines (e.g. system calls) with security-enforcing code, similar to SELinux or AppArmor, with the main exceptions of ruleset control on-...
0
votes
1answer
62 views

Is a constant pepper at risk if an attacker knows the value and hash?

My app is a educational game for elementary schools, involving no money or anything of value, so I am not worried about sophisticated attackers having any interest in this. Still, I would like to ...