The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

learn more… | top users | synonyms

2
votes
1answer
103 views

Can MITMf exploit SSL CCS vulnerability (CVE-2014-0224)?

I just wonder if MITMf (https://github.com/byt3bl33d3r/MITMf) can be used to exploit the 2014 early CCS bug, or is there a tool out there which can (preferably open source, so I will be able to ...
3
votes
1answer
51 views

What harm can this bug in base32 implementation cause?

There is a bug in Base32 implementation in Apache Commons Codecs: Example, there is no byte array value that can be encoded into the string "C5CYMIHWQUUZMKUGZHGEOSJSQDE4L===", but the existing ...
2
votes
1answer
173 views

Why is this version of OpenSSL (1.0.1e) not vulnerable to Heartbleed?

I recently ran into a requirement that needed a web server set up with SSL, to show that its possible to extract the private key from a server with a vulnerable version of OpenSSL (Heartbleed). Hence, ...
3
votes
0answers
196 views

ROP Programming/Exploitation on ARM - Gadget chain

Unfortunately, I cannot find this gadget in my libc.so. How can we reprogram this using different instructions: pop {r0, r1, r2, r3, pc} Which instructions will achieve the same? What gadgets I ...
2
votes
0answers
443 views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
12
votes
3answers
215 views

As a student, how do I safely and responsibly disclose a serious security issue in a school environment?

I am a student at my local school. About eight months ago, I stumbled upon a security hole that could allow any user to discover any student's ID in the entire district, and I am aware that the IT ...
0
votes
2answers
139 views

Malicious favicon icon?

Is it possible for a favicon icon to be malicious so that you get the virus by just looking at the icon in the search results of a search engine like DuckDuckGo that displays the favicon icons for all ...
4
votes
1answer
102 views

Building a project on ARM Cortex-M, anything I can do to keep IP secure? Dealing with Chinese knockoffs and sick of it

Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still. There are sites ...
3
votes
2answers
253 views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...
3
votes
1answer
68 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
41
votes
5answers
11k views

Accidentally came across the source code for some malware, what to do?

I accidentally, the other day, went to a dodgy site, and today I discovered that in my cache there lay a text file. And after reading the contents of the file, I have deduced that it is the source ...
1
vote
3answers
131 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: ...
0
votes
0answers
32 views

Disguising as another computer using SMB Relay?

I've got a server that constantly checks for the existence of certain parameters on every PC in the web using SMB, if it fails to find those parameters it marks it as a rogue PC. I've understood that ...
3
votes
1answer
294 views

Can you exploit an Internet IP adress just like a LAN IP address?

Is exploiting an Internet IP address as simple as exploiting a LAN IP address? i.e.: Scan that IP for vulnerabilities and open ports using tools like nmap or nikto Use a vulnerability and set the ...
2
votes
2answers
93 views

Is a precompiled Java program affected by Java vulnerabilities?

We know that Oracle publishes Java updates due to vulnerabilities / security issues and therefore we should make sure that we have installed the latest version of Java. Now there exist programs like ...
-3
votes
1answer
93 views

Why are discovered vulnerabilities of suspicious/illegal online software published? [closed]

For example, the Tor network has recently been hit by a reveal of a major exploit in a research paper. Isn’t publishing the details on the exploits completely counter-productive as the developers of ...
5
votes
2answers
97 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to ...
4
votes
1answer
356 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
5
votes
2answers
188 views

“Memory Sinkhole” attack and virtual machines?

Recently a design flaw in some Intel X86 processors was revealed at Blackhat. The flaw enables malicious code to gain access to SMM. The flaw can be exploited by an attacker with administrator ...
-2
votes
1answer
159 views

How to check if your phone got hacked [closed]

Since the Stagefright exploit is very common on many devices I wanted to ask if there is any way to check if someone has used this exploit on a given device. Like check the processes for unknown ...
3
votes
2answers
125 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
1
vote
1answer
334 views

Why Skype discloses my IP address to anybody? [closed]

Apparently there is a Skype exploit that allows people to obtain your IP address through your Skype username if you're online. The problem has existed since 2012. There exists countless websites which ...
7
votes
3answers
1k views

MSFConsole/Kali Linux - gain root access to unix system

I am messing around with Kali Linux, MSFConsole and DVWA (Damn Vulnerable Web Application). I have successfully been able to get into the system (Raspberry Pi) by creating a PHP backdoor and uploaded ...
-3
votes
2answers
374 views

Does Microsoft EMET protect against latest Hacking Team Adobe Flash 0-day exploit?

If I were to not update Adobe Flash and instead used the old version (from before the Hacking Team 0-day exploit was published in the internet), in that case, would Microsoft EMET protect me from the ...
8
votes
2answers
95 views

Is using separate stacks for return addresses and function arguments a viable security measure?

As far as I know, many exploits rely on overwriting return address of the function they try to exploit. They do it by buffer overruns. But what if the compiler set up two separate stacks far from each ...
0
votes
0answers
24 views

Is there any risk in allowing clients to be fed opengl shaders?

I'm working on a project that may eventually involve server specified fragment and vertex shaders. What are the possible risks of allowing a third party to send fragment/vertex shaders and execute ...
1
vote
2answers
143 views

Is this exploit on household appliances really as bad as it sounds?

CNN article link. The article claims that a household appliance can be hacked by reprogramming the circuits inside of it to release electromagnetic waves that could release system information, but ...
9
votes
2answers
589 views

Is allowing unfiltered curl request from a website a vulnerability?

Recently I was on a website which provided some non-sense feature: Enter a URL Press enter HTML source of a given URL is displayed It basically fetched a URL and just dumped the contents of it. ...
3
votes
0answers
58 views

How to analyse a suspicious Encapsulated Postscript file?

How can you analyze an encapsulated PostScript file that has a standard header, but is way too big? There is a EPS file which has a size of 1.8MB. When it is reconverted to EPS, the resulting file is ...
2
votes
1answer
88 views

Simple exploit leads to wrong EIP and EBP

I have a simple program: void bug(char *arg1) { char name[128]; strcpy(name, arg1); printf("Hello %s\n", name); } int main(int argc, char **argv) { if (argc < 2) { ...
4
votes
4answers
342 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
6
votes
2answers
211 views

Is it possible to encode bytes in an buffer overflow exploit that bypass string functions?

Disclaimer: this exploit is purely for educational use. In this exploit I play the role of the victim and the software exploited is written by me alone. I have a simple HTTP server that I want to ...
2
votes
0answers
299 views

Using .apk files to reverse_tcp and exploit on android? [closed]

I have been able to install and run the application that I plan on exploiting. Once the app is running I am able to exploit the application. In my testing environment I am able to do this just fine. ...
4
votes
1answer
141 views

gray hat hacking 4th edition question

Example Using find.c Using find.c as an example, how would this manual source code auditing process work? We need to start with user data entering the program. As seen in the preceding ITS4 output, a ...
3
votes
0answers
106 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
34
votes
5answers
3k views

Can malicious code trigger without the user executing or opening the file?

If a file is downloaded from the Internet, and saved on disk, but is not opened by a user (if we keep autorun off), are there any chances that malicious code (e.g. a virus) in the file could trigger? ...
0
votes
0answers
83 views

Unable to execute shellcode in stack with no DEP

Here is the simplest example to show my problem. Everything is in WinXp sp3 with DEP disabled. char f() { // shellcode starting with some NOPs, char shellcode[400]= { 0x90, 0x90, ...
3
votes
3answers
194 views

Browser as Honey-Pot, is there?

I'm watching all this movement around Metasploit project, the great number of different exploitation plugins, and thousands of exploit packs. Now, it is real truth, anyone could configure his own ...
0
votes
1answer
66 views

What kinds of attacks can VLAN's mitigate? [closed]

Assuming these very basic kinds of attacks: Header based Protocol based Authentication based Traffic based What would using a VLAN mitigate? Several people seem to be overthinking the question. ...
2
votes
2answers
69 views

Trusted vulnerability database source [closed]

Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product ...
4
votes
1answer
696 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
3
votes
0answers
66 views

How to notify Adobe about a software issue

Recently, I stumbled upon a way to reset the software trial of any product under the adobe suite. It's as simple as changing some attributes within a few files. I'm assuming that it can be deemed an ...
1
vote
0answers
51 views

Passing arrays to a function call (Bufer Overflow)

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying ...
5
votes
2answers
283 views

Why are Adobe Flash exploits found so often? [closed]

Over the last couple of years Adobe Flash published bug fixes for (zero-day) exploits so often, that the installation is already annoying. But why are exploits so often found in this particular ...
1
vote
0answers
103 views

Metasploit new exploits failed [closed]

Why can't I use new exploits like exploit/multi/browser/adobe_flash_nellymoser_bof ? I tried to access it, but I can't even find it in MSF search Adobe or Flash or anything like this. What should I ...
2
votes
3answers
764 views

Why not fix Android root exploit? [closed]

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
9
votes
3answers
822 views

Can an attacker “simulate” a private IP address?

I have a SSH server with a rule that does not allow password connections outside the local network. So people already on the local network, either physically or via VPN, are allowed to connect with ...
3
votes
2answers
108 views

How to sanitize archive files?

I am looking for a way to make sure that a particular archive file does not contain any sort of malicious code. From time to time new vulnerabilities pop up (e.g. gzip, 7zip) so I though a good idea ...
3
votes
2answers
147 views

How to overwrite ebp on stack alignment?

I want to exploit a simple program #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buf[128]; strcpy(buf, argv[1]); return 0; } The disassembly ...
0
votes
1answer
139 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?