Questions tagged [exploit]

The data, tools, and procedures which, when applied to a specific vulnerability, predictably violate the security design of a system.

Filter by
Sorted by
Tagged with
0
votes
0answers
56 views

Is my browser been exploited via CSS? [closed]

I've been looking at some Web tools as I had some suspicions. The css looks as though it does not come from Youtube. I've seen code from github and other sources. A large portion is commented out and ...
0
votes
1answer
44 views

Open TCP port exploit with MSFConsole [closed]

as a college task I have to exploit a web service that my teacher has set up. But I'm clueless on how to proceed. After I find how to exploit it I have to leave a text message at "the place that ...
0
votes
0answers
31 views

Exploiting File Upload Vulnerability Similar to DVWA in Real Web App [closed]

I successfully tried the File Upload Vulnerability (Low Security)in DVWA and successfully gain access to the Metasploitable machine. During File Upload there is an message generated if the file upload ...
2
votes
2answers
151 views

How do I gain root access to a system using a setuid root binary?

Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a ...
0
votes
1answer
58 views

Antivirus evasion for reverse tcp

I'm trying to do reverse tcp in an exe payload. To do antivirus evasion, I've tried to use Veil evasion, The fat rat, and also Phantom evasion, but even if the exe wasn't deleted by antivirus (I use ...
3
votes
2answers
106 views

Are there any Security Concerns to using Python F Strings with User Input

Background A while ago I started using F strings in Python but remembered seeing some security concerns with using them with user input so I have made a point of not using them for those situations. ...
-1
votes
0answers
78 views

system doesn't invoke /bin/sh

I am learning libc shellcode attacks and trying to execute /bin/sh from system I can execute other commands from system like whoami and ls -a but can not run /bin/sh the following works string = b&...
2
votes
2answers
143 views

Pentest findings advice

I am way out of my depth here. We have just had a pentest done, and we had one critical finding: if (file_exists($includeFile)) { $f_type = filetype($includeFile); if ($f_info['extension'] == ...
0
votes
1answer
356 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
2
votes
1answer
256 views

Format String Exploitation with limited number of characters possible?

Is the exploitation of a format string vulnerability possible if the number of characters you're allowed to enter is limited? Let's say I'm just allowed to enter input with 23 characters. I can read ...
2
votes
1answer
880 views

Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI). RCE is usually obtained by uploading the reverse shell script on the target, ...
0
votes
1answer
84 views

Send hex code into standard input after getting some output

I'm currently going through Hacking: The Art of Exploitation and there is an issue I'm having with trying to overflow a function pointer. The code is located here. I'm trying to input hex code into my ...
1
vote
1answer
135 views

Cannot execute shellcode using buffer overflow

As a home exercise I'm trying to achieve buffer overflow attack by running a simple char array program that stores the input argument in the program stack and then overflowing that stack with long ...
1
vote
0answers
108 views

Can someone impersonate you on WhatsApp?

Well I'm not a developer so I'm here to resolve a specific question. I have been investigating this subject for a while now and I need and opinion from experts or developers which really understand ...
0
votes
2answers
98 views

Can a router be attacked without being associated to it's WiFi?

Can an old and upatched (assume a 15 y.o. TP-Link: so plenty of vulnerabilities) be breached given: no physical access WEP is disabled WPA is up but password is not crackable via aircrack-ng + ...
0
votes
0answers
53 views

Which test nikto do to test oracle padding attack?

After running nikto it shows the following message OSVDB-68127: Server may be vulnerable to MS10-070 (based on numeric calculation), thus allowing a cryptographic padding oracle. This vulnerabilty ...
0
votes
1answer
90 views

PostgreSQL exploit not loading in MSFConsole from ExploitDB

Just trying to get a postgreSQL exploit (32847.txt - Low Cost Function ) from exploitdb to run in msfconsole. After pulling my hair out trying to figure out why it isn't loading, here I am. I'm using ...
1
vote
1answer
99 views

Exploit education stack-five: trouble opening shell

Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/). I run onto a problem while exploiting a stack overflow. The challenge is run execve('...
1
vote
1answer
82 views

Exploiting CSRF on DELETE Request

I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and ...
1
vote
1answer
1k views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
1
vote
1answer
2k views

BufferOverflow : ESP and access violation

The context : I have a small question regarding ESP and access violation. I just exploited a buffer overflow, with little space after ESP. So i did this : part 1 : NOP SLED part 2 : my shellcode : ...
0
votes
0answers
87 views

Exploiting WebDav

I'm trying to exploit webdav by uploading a msfvenom generated php script to the target webdav server on windows xp machine using the default credentials - wampp(username), xampp(password). The ...
5
votes
1answer
432 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
0
votes
2answers
1k views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
1
vote
1answer
106 views

“int 0x2E” instruction

While trying to exploit vulnserver (GMON), on windows 10, using an egghunter, the program crash in the instruction "int 0x2E" of the egghunter. The exploit work if I use jumps. Do someone ...
0
votes
1answer
244 views

Problem with shellcode when exploiting Chakra

I study Information Security at university, and we got at school a project to use some old patched vulnerability to get control over PC. We have chosen Chakra exploit CVE-2016-7200. We have it working ...
1
vote
1answer
68 views

Format string exploit length

I'm new to Software security and I'm studying it now at the university. I had some doubts about the Format String exploit, in particular how to count the length (in number of bytes) of a format string ...
0
votes
1answer
88 views

Buffer overflow with zeros

I'm starting to learn about buffer overflow, and I'm trying to change the contents of the return address to a specific location using gdb, but the problem is that the address starts with some zeros. ...
3
votes
2answers
7k views

Remote hack of my computer via Chrome using Google account

I posted this on Google yesterday but I think it deserves more visibility. If what I think might have happened, actually happened, then Chrome may not be secure: Something weird happened yesterday ...
1
vote
2answers
113 views

Are call stack addresses predictable with all protections disabled?

I'm currently practicing buffer overflows, but there is one thing I don't understand yet. I have read this similar question. I understand that if you don't know the address of ESP you must look for an ...
1
vote
2answers
214 views

How exactly can an infected Samsung TV record private conversations in a room?

We can read on Wikipedia page (about Weeping Angel) that Samsung smart televisions can be hacked by hackers which allows them to record conversations in the room and send it over the internet even if ...
21
votes
3answers
47k views

What does EIP stand for?

There are a ton of questions on here that make reference to the eip: How can I partially overwrite the EIP in order to bypass ASLR? Unable to overwrite EIP register Do I always have to overwrite EIP ...
1
vote
2answers
412 views

Jenkins malicious process identification

I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process: process has large CPU usage killing it, respawns it (with same name) restarting machine spawns it (with ...
1
vote
1answer
1k views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
0
votes
0answers
39 views

Metasploit unable to get local issuer certificate

I got the following versions: Framework: 5.0.86-dev Console: 5.0.86-dev The os that metasploit is installed are windows 10. I get a meterpreter session with an android device (genymotion virtual ...
3
votes
1answer
112 views

What is the risk of having an old, Internet capable phone not used for Interned compromised? (not smartphone)

I'm talking about a class of old mobile phones that are not smartphones but are still (theoretically) Internet-capable, at least via 3G. Examples of such phones include Series 40 Nokia phones or the ...
1
vote
2answers
413 views

What encryption did Encrochat use, and how was it broken? [closed]

On 2nd July, the UK's national news outlets broke the story of an "unprecedented" 4-year-long, Europe-wide investigation that, in the UK, resulted in the arrest of 746 criminals, including ...
1
vote
1answer
105 views

How to make use of a exploit that is not available in metasploit? [closed]

I want to exploit a Microsoft IIS HTTPD 10.0 server open which is open in PORT 80. However there is no available exploits in Metasploit but there are few vulnerabilities in this site. Is it possible ...
-1
votes
2answers
132 views

What is the real risk of clicking a link? [closed]

If I were to click a link on any of my devices, be it over text message, email, or from a webpage, and enter no information/actions with the target page. What is the worst that could happen?
0
votes
2answers
1k views

Is it technically possible to clear WhatsApp chat also on receiver's phone?

A friend of mine whom I trust 100% states that a user he was exchanging messages via WhatsApp deleted the whole chat,on his phone as well. He was able to take a screenshot of the last messages before ...
0
votes
0answers
59 views

How would you investigate if CoronaBlue has been exploited by an attacker or not?

How would you investigate if CVE-2020-0796 (Windows SMBv3 Client/Server Remote Code Execution Vulnerability) has been exploited by an attacker or not?
0
votes
1answer
2k views

Shellcode in MongoDB Python code

I know I can input this into a search box that queries the MongoDB. I have updated the code with my shell code, but I won't include that, I will just use the exploit as it is here: db.my_collection....
1
vote
1answer
1k views

XSS works when I save generated HTML to file, but not directly in browser

The hints of XSS game's level2 say that Entering a tag on this level will not work. Try an element with a JavaScript attribute instead. When entering <script>alert(1)</script> ...
1
vote
0answers
36 views

Does an exploit exist to enable Android debug mode on a locked phone? [closed]

Does someone know an exploit to activate the Android debug mode even if the phone is locked? I've tried some software to unlock but this is not the way I want to resolve it ...
0
votes
0answers
41 views

Are metasploit exploits always Port specific (smb-samba)?

So I was trying a machine on vulnhub i found port 139 open and also found its service and version on nmap scan that was samba-4.3.11 i also ran auxiliary scan module to confirm the version and service ...
1
vote
1answer
70 views

IFrame Vulnerability Classification

I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
1
vote
4answers
209 views

What are the names of software vulnerabilities? [closed]

In web apps there are vulnerabilities like SQLi or XSS and many more. I heard that for hackers to hack a computer they have to find a vulnerability in a software that is running on an open port. ...
1
vote
1answer
97 views

Does flooding with bytes cause buffer overflow? [closed]

If I flood a C program with bytes can I cause buffer overflow, or is there other stuff I have to take into account?
0
votes
1answer
4k views

Recon-ng v5 - How to add domains?

I just started with recon-ng today, I was following tutorials but every tutorial is outdated with most of them describing the functions of v4. I was able to update myself with simple additions like ...
1
vote
2answers
249 views

Shipment tracking displaying delivery information publicly - Is this dangerous?

Background: Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the ...

1
2 3 4 5
24