The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

-2
votes
1answer
45 views

Are exploits 1:1 with vulnerabilities? [on hold]

I know that for the most part, there are some small differences between thoughts on a lot of matters in terms of definitions in security. What I am asking about is whether exploits are considered to ...
0
votes
3answers
65 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
-2
votes
0answers
22 views

Bad image error in dll hijacking [closed]

I use this exploit : http://cxsecurity.com/issue/WLB-2015040065 I compiled the dll but when I want exploit that program I see the bad image error ... How I can fix it ? Thanks
10
votes
1answer
842 views

Legality of writing exploits for educational purposes (USA, Canada) [closed]

Is it legal for me to write a small exploit (possibly to a closed issue) and put it up on the internet for everyone to see (as a tutorial)? I have been researching the legality of exploiting ...
13
votes
4answers
690 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...
2
votes
1answer
55 views

Buffer Overflow EDI but not EIP

Is possible to exploit a program if you can only overwrite ESI or EDI register without EIP? Program in question does seg fault and overwrite EDI, ESI and ECX but can't get it to overflow EIP. Anyone ...
1
vote
0answers
27 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
9
votes
2answers
974 views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
0
votes
0answers
27 views

Can a subprocess launched from a parent executable access the memory of its parent? [migrated]

Given a system() call with user controlled input, is it possible to read the virtual memory of the parent program? Assume that the system call is made with dropped privileges, and that running ...
0
votes
2answers
65 views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
1
vote
2answers
89 views

Questions regarding Bad USB exploit

I own a Netbook and my external DVD Drive is possibly infected with Bad USB. If i install Ubuntu using this infected DVD drive could my system be taken over during installation process or later when ...
0
votes
1answer
82 views

Java desktop app vs web service [closed]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
1
vote
2answers
64 views

Meterpreter and staged payloads

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions A staged ...
5
votes
1answer
77 views

Return oriented programming without int 0x80

I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location. However, this region does not ...
4
votes
2answers
59 views

Are there methods for determining the exploitability of bugs, after a crash is found in fuzzing?

I have found this, https://msdn.microsoft.com/en-us/magazine/cc163311.aspx It says that only "a full root-cause analysis can ensure that you have correctly diagnosed whether a given crash is ...
2
votes
1answer
84 views

exploiting Heap Overflow in gdb segfaults

I have been trying to exploit the heap overflow vulnerability for the program below, I am running Linux 14.04. #include <stdio.h> #include <string.h> #include <stdlib.h> int n = 5; ...
1
vote
0answers
45 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
1
vote
0answers
21 views

Possible exploit while MPLS parsing with Bottom of Stack bit

My current task to parse MPLS label in a packet and store them in to a list. When I check packets with MPLS: One can understand it is the last MPLS header by checking Bottom of Stack bit. If ...
12
votes
9answers
4k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...
2
votes
1answer
75 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
1
vote
1answer
75 views

Bash Shellshock

I am trying to find out if my devices are vulnerable to bash shellshock. I have run the commands found on https://shellshocker.net. It seems my devices are both susceptible to only one of the ...
1
vote
1answer
76 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
8
votes
3answers
612 views

Evading IDS in exploit development

In the context of buffer overflow exploit development, I was asked: Discuss how your exploit may be modified to evade an Intrusion Detection System. I'm not asking for my homework to be done, but ...
2
votes
2answers
56 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character on realtime so when i input the following code: <input onclick=alert(document.cookie)> there ...
2
votes
1answer
86 views

Resources to learn about Windows systems exploitation [closed]

I'm a beginner in penetration testing, and I'm struggling with finding decent material to learn. I used book about nmap, Metasploit, exploit writing etc..., but they contained too much information ...
-2
votes
1answer
110 views

Possible Injection to PHP PDO

Expert says that PDO is one of secure scripting from mysql injection. I have read the manual about it and do some little research. And here, I'm trying to get ID value from URL paramater, as in: ...
4
votes
1answer
83 views

Realistic: Exploiting a computer on BIOS/ hardware level in less than an hour? (Infinite preparation time)

I wonder how hard it it to infect a laptop or netbook in 60 minutes or less in a way the victim cannot easily clean their machine by wiping hard disk drives. Let's assume the following: The ...
13
votes
3answers
393 views

remote desktop connection to a potentially compromised machine

I am using rdesktop client on Linux to connect to windows machines. If some of these machines were compromised by some evil malware/virus/worm/trojan, is there any way for the malware to "jump" to my ...
1
vote
5answers
104 views

How to analyze spam email URLs to detect exploits?

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside ...
2
votes
1answer
109 views

SMB/CIFS shares on HP-UX vulnerabilities

So, I've run an unauthenticated Nessus scan against a critical piece of infrastructure as part of a pen-test but I'm getting back some weird stuff and i can't seem to re-create the issue to ...
1
vote
1answer
47 views

Are Sun/Oracle's SPARC processors invulnerable to buffer overrun exploits?

We all use Intel architectures these days, in small part because Oracle has totally dropped the ball regarding SPARC CPU development. But with so many now saying that protection against viruses is ...
14
votes
7answers
876 views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
1
vote
2answers
151 views

How do I prevent tampering with form submission data, and changing the details for any account?

Although this is something that only employees can use, I'd like to prevent the tampering anyway. I don't like insecure code, and this is hideously insecure. Here's an example link: <a href="#' + ...
4
votes
1answer
189 views

How did GamerFood hack the Starcraft IEM Taipei Tournament? [closed]

During the recently completed professional Starcraft tournament, Intel Extreme Masters (IEM) Taipei 2015, the notorious cheat software company Team Gamer Food hacked the cast somehow. How did they do ...
-1
votes
1answer
165 views

Hack to change the webpage of a website? [closed]

Recently, there is a website by Malaysia Airline got hacked and their main page has been defaced, below is a link to that article ...
0
votes
1answer
67 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
4
votes
2answers
118 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
1
vote
3answers
108 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
0
votes
1answer
74 views

Are firefox bugs cross platform? [duplicate]

I use Ubuntu and last firefox version. I opened an image with firefox, and a crash occurred. Let's assume it's a crafted jpg to run an exploit, and execute arbitrary code. To sum up: (1) Firefox ...
1
vote
0answers
54 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
9
votes
2answers
187 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
1
vote
2answers
87 views

Reasonable source of old proof-of-concept attacks

I am relatively new to the area of cyber security but have a reasonable knowledge of several programming languages, assembly (x86 in particular) and scripting. In light of the recent Shellshock and ...
0
votes
1answer
34 views

Getting a DEP exception when trying to call SetProcessDEPException(false)

I'm demonstrating an exploit for an old app. On Windows XP SP3 32bit (EN), the address of SetProcessDEPPolicy() is usually 0x7C8622A4. I have that version of Windows (in English as well) and I've ...
2
votes
0answers
84 views

Case Studies of high profile hacks [closed]

Every hack happens because of a form of security vulnerability or another, and I feel that the best way to avoid/fix these vulnerabilities is to learn about them. Is there anywhere on the internet ...
1
vote
1answer
105 views

Printf inject 0x00

When performing a format string exploit, how do you inject an address that contains 0x00? #include<stdio.h> int main(int argc,char *argv[]) { char buf[80]; snprintf(buf, 79, argv[1]); ...
0
votes
2answers
64 views

Web/App vulnerability responsibility [closed]

While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development ...
2
votes
0answers
79 views

SET tool autopwn website type penetration [closed]

I tried to hack my second computer and phone in my local network. I am not very experienced so instead of picking the particular options and payloads i just pressed autopwn to use them all instantly. ...
11
votes
5answers
272 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
2
votes
3answers
157 views

Parallel systems, in case any of two has known exploits

As software becomes more and more complex it's harder and harder to keep it secure down the entire line. Discussing this problem with a friend we were opting some pretty extreme solutions and wondered ...
2
votes
2answers
110 views

What is asymmetric information in relation to information security? [closed]

I have just finished reading "Why information security is hard - An economic perspective", the term asymmetric information is mentioned. An example in this paper mentions "The technical bias in ...