Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

-1
votes
1answer
37 views

how to exploit file upload functionality [on hold]

I'm pentesting a website, where i'm testing an upload functionality and it only accepts pdf files and when we visit the url where the file gets uploaded it shows download prompt instead of any content....
0
votes
0answers
55 views

Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux

Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
0
votes
0answers
23 views

Exploit web applet uploading jar through jnlp file

I have a web application which at its start asks the users to download and execute a jnlp file. The jnlp file has the following structure: <?xml version="1.0" encoding="UTF-8"?> <jnlp spec=...
2
votes
0answers
82 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
0
votes
0answers
44 views

Failed to exploit netapi vulnerability on Windows server 2003 R2

I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message: Exploit completed, but no session was created. Any thoughts? ...
1
vote
1answer
70 views

Exploit database for NVD vulnerabilities [closed]

I have the list of vulnerabilities (CVEs) in the NVD database. I need to find which one has an exploit. Is there any database available to get the list of all the exploits for CVEs? or is there any ...
-1
votes
2answers
81 views

Buffer Overflow not working?

Basically I am trying to exploit a buffer overflow, but unfortunately I am not able to get shell. Script buf.c: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]){ ...
0
votes
4answers
141 views

Does exploit development have a future? [closed]

Does exploit development have a future? I mean there are a lot of fuzzers and they can find bugs better and with less time than humans. And today's there are lots of great fuzzers. I love exploit ...
0
votes
2answers
129 views

How to back up and restore personal data safely from possibly exploited android phone?

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is ...
4
votes
1answer
85 views

How can I recover my exploited android phone?

I have a Samsung S9 phone that has been exploited by my neighbor, however I am unsure as to how to prove/verify it, how in depth the access is to my phone, or how I can re-secure my phone. It seems ...
1
vote
0answers
69 views

Buffer overflow shellcode placement

Sorry if this post is in the wrong section I'm fairly new to the security field and I am new to stackexchange if this post is in the wrong section would be great if it was moved for me,also sorry if ...
0
votes
1answer
60 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
0
votes
1answer
41 views

Any way to auto execute a file in windows

MS-Word gives the functionality of OLE In which we embed any link in document and on any event it would go to that link and download the file. The file is stored in the TEMP directory of the WORD. ...
3
votes
0answers
91 views

Recent Pwn2Own baseband exploit

I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among ...
0
votes
1answer
65 views

Shipment tracking displaying delivery information publicly - Is this dangerous?

Background: Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the ...
1
vote
1answer
109 views

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)?

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)? I've been playing around with DLL injection by reading some old articles to that use, e.g., calc.exe to ...
1
vote
1answer
69 views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
2
votes
1answer
625 views

Nessus found a vulnerability, but no corresponding exploit on Metasploit : How to run with meterpreter

I ran Nessus on a local network, it found a critical vulnerability for the router: MikroTik RouterOS < 6.41.3 SMB Buffer Overflow (Vulnerability description : Exploit-db) But I can't find any ...
3
votes
1answer
178 views

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? Originally, return-oriented programming (ROP) was invented to counter the no-execute (...
4
votes
1answer
300 views

Metasploit is not detecting newly imported python exploit

I have added OpenSSH 7.2p2 - Username Enumeration exploit to Metasploit, which is a python exploit. But after so, it does not detect that exploit every way I tried. I have placed it under the ...
1
vote
0answers
29 views

What source formats are affected by ImageMagick's vulnaribility caused by Ghostscript?

According to https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/ ImageMagick's convertion to PDF of arbitrary (user-submitted) documents should not be used because of Ghostscript's ...
0
votes
1answer
174 views

Reverse Shell Exploit for SquirrelMail 1.4.22 [closed]

I am trying to gain access to a remote host running Ubuntu with Squirrel Mail 1.4.22. Ideally I need a reverse shell to traverse the machine to find a series of flags. I have discovered that POODLE is ...
-1
votes
2answers
87 views

How can i access any useful information in a wordpress site?

While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here: https://www.exploit-db.com/exploits/45439/ I used it and ...
2
votes
1answer
145 views

Does an Egghunter attack still make sense in a 64 bit system?

Background An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
-1
votes
1answer
135 views

Timing Attacks: Against PHP Server - Prevention/Tutorials [duplicate]

What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP? I'm a high school student, I'm new to programming and I've been learning Security since few ...
0
votes
0answers
62 views

Understanding execve() exploit instructions

There is an exploit available that utilizes execve() syscall to spawn a shell in only 24 Bytes. I know this is exploit requires an executable stack, but I am not interested in what the exploit ...
0
votes
1answer
117 views

Is XSS exploit always illegal? [closed]

I recently got a great deal of $$ stolen by scammers. I am trying to use XSS exploitation to find his real identity (IMSI, IMEI, External IP, Internal IP, any computer unique ID) Is it legal? I am ...
-1
votes
0answers
27 views

CVE-2013-0333 Ruby on Rails Yaml Exploit Question

I have a question regarding the Ruby Rails JSON exploit. I understand how it works but I do not understand how code execution is achieved. I understand YAML and how it builds various serialized ...
0
votes
1answer
52 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
2
votes
1answer
182 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
2
votes
1answer
111 views

Is it possible for a virus to be embedded in a image and can this image execute on Android Oreo by just opening the image?

I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? ...
-1
votes
0answers
69 views

Using custom shellcode to create custom payload in Metasploit [duplicate]

I'm new to the Metasploit world. I was wondering if I could transform my hand-made shellcode into a payload that I can easily use with various exploits. I've tried searching the internet but I didn't ...
1
vote
0answers
74 views

Bypassing double quote in DOM based XSS?

I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link: <a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script>&...
1
vote
0answers
54 views

How to find the return address when performing an overflow

for an assignment I'm trying to find exploits in a c program. I found one in strcpy, which is vulnerable to overflow attacks. The problem is I am actually having trouble deploying the shellcode ...
-1
votes
1answer
53 views

Local File Download(LFD) vulnerability exploit

I have found a arbitrary file download vulnerability in an asp.net application. I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
-4
votes
1answer
86 views

Need help with finding a vulnerability in PHP [closed]

There is a site whose main page is in the formathttp://example.com/index.php?page=1. It contains a rectangular box with text in it. What vulnerabilities can I use to find a hidden file on this site? ...
1
vote
1answer
72 views

Will a browser exploit also work after I have downloaded the website? [closed]

When I visit a website which exploits a vulnerability in my browser and I save this website to my computer and open later the offline version can my browser be hacked again?
1
vote
2answers
172 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
1
vote
0answers
78 views

Empire Powershell DDE Office Exploit Help

So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete. I have to use Empire (https://github.com/...
6
votes
3answers
245 views

What is the (literally) lightest way to run a second secure system?

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with ...
0
votes
1answer
46 views

Disable modules in Metasploit Pro

I have been using Metasploit pro for last few days. I understand that exploiting in Pro version is automatic using exploit ranks(GUI). But If I want to disable certain modules while exploiting, is it ...
2
votes
1answer
65 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
0
votes
2answers
331 views

SambaCry CVE-2017-7494 returns “Exploit completed, but no session was created”

I am using this exploit on msfconsole to exploit a VM with samba and the configuration is as follows: Module options (exploit/linux/samba/sambacry) Payload options (linux/x64/meterpreter/reverse_tcp) ...
0
votes
1answer
183 views

At which point does an exploit against TAILS happen?

Since TAILS by default disallows root/superuser privileges and since traffic is sent encrypted with each relay removing a layer until the exit node, at what point is an exploit on a version of TAILS ...
0
votes
1answer
52 views

trans2open not working on metasploit

I am using metasploit to exploit a vulnerable version of Samba on a remote host. Samba version 2.2.8, downloaded directly from the cve site. But when I use trans2open exploit with payload (generic/...
1
vote
3answers
248 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
0
votes
0answers
29 views

Understanding and executing Format String Exploit(Protostar Format1)

I was following the Liveoverflow Format String exploit example and I had difficulty understanding and executing a few things specifically with this line ./format1 "`\python -c "print 'AAAA' + '\x38\...
0
votes
1answer
114 views

what attacks are possible on outdated versions of TAILS?

I know using outdated software is a bad idea, but until recently I have only been able to boot TAILS from LiveCDs that come with some Linux magazines. Since these arrive in my country late, I end up ...
-1
votes
1answer
118 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
2
votes
0answers
85 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...