A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

1
vote
2answers
74 views

How to test the php vulnerability CVE-2014-3515

How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor ...
3
votes
2answers
318 views

List of most common network vulnerabilities a la OWASP Top 10 [closed]

I am trying to find the most commonly used attack vectors/techniques on computer networks in the style of the owasp top 10, for my thesis work. The reports shouldn't be older than 2-3 years. Can you ...
3
votes
8answers
527 views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
1
vote
1answer
155 views

POODLE vulnerability solution : Effect on customer or client side

I am using windows server 2008 R2 and I have lot of customers who use windows XP,7 and 8 with some of them still using IE6. So now I want to disable SSL3 and enable TLS 1.1 as a security measure for ...
0
votes
2answers
53 views

What are the available public or commercial feeds for Malware correlated with the vulnerabilities they exploit

To understand the severity of different types of malware, are there any freely available or commercial feeds of malware hashes mapped with public exploits that exploit vulnerabilities listed in ...
5
votes
2answers
320 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
28
votes
5answers
3k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
2
votes
0answers
56 views

Case Studies of high profile hacks [closed]

Every hack happens because of a form of security vulnerability or another, and I feel that the best way to avoid/fix these vulnerabilities is to learn about them. Is there anywhere on the internet ...
6
votes
3answers
4k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
2
votes
2answers
11k views

known public exploits for vsftpd 2.0.1/2.0.5

I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits. The server I am working on has vsftpd 2.0.5 ...
16
votes
5answers
1k views

Is Google Chrome a better secured browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested? Has anyone other results of independent investigations about security of web browsers? ...
2
votes
2answers
78 views

Fuzzing and its impact on testing environment

I asked this question on StackOverflow but got no answers so I thought that I would try my luck here since fuzzing is closely related to security and often used in vulnerability assessment tests. I'm ...
5
votes
3answers
550 views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
21
votes
9answers
2k views

What cryptographic algorithms are not considered secure?

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
9
votes
1answer
885 views

Example of how the remaining shellshock bash bug CVE-2014-7169 (taviso bug) could be exploited?

I have a general idea about the Shellshock bash bug (CVE-2014-6271 reported Sep 24, 2014) of what the vulnerability is and how it could be exploited. Here you find examples on how to exploit the ...
13
votes
2answers
684 views

How to make a website patch their poor security?

I am following an online class from a local institution. Recently, I've noticed they don't crypt passwords because they sent me my password by e-mail in clear text. The website has a lot of personal ...
7
votes
2answers
418 views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
3
votes
2answers
268 views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
0
votes
0answers
72 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
-2
votes
1answer
86 views

Best and most current sites for security breaches [duplicate]

I'm taking my masters in cyber-security and as a student I come across a lot of garbage when doing research. What are sites with the latest security breaches? Thanks for the help in advanced. My ...
2
votes
1answer
138 views

Why Shellshock works in useragent string?

I was wondering why Shellshock works when put in the useragent. Based on what I could find it is because a web server (e.g Apache) uses the useragent string in its internal working. Why would a ...
16
votes
2answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
2
votes
1answer
243 views

Are Java applications vulnerable to CVE-2014-6321 (WinShock)?

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows. My Java application uses SSL (JSSE ...
2
votes
1answer
119 views

Is this somebody trying to exploit a vulnerability?

On our website, when an invalid PHP session ID is detected, it's logged and regenerated. This invalid session has been logged: n040jl1nujch72tkrmr0uilnl1, ...
-3
votes
1answer
63 views

Buffer overflow without using environment variables [closed]

I was trying to overflow buffers and I was wondering , Is there anyway to do a buffer overflows without using environment variables ?
2
votes
3answers
1k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
1
vote
0answers
436 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
25
votes
10answers
4k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
197
votes
4answers
77k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
1
vote
2answers
234 views

POODLE vulnerability in major social networking

Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst ...
1
vote
2answers
366 views

SSLv3 cannot be disabled, can I use weak cipher as a workaround?

We're using lighttpd 1.5.0-2349 which unfortunately doesn't support the option to disable SSLv3. I think a potential workaround would be to only allow it to use some cipher which has already been ...
3
votes
1answer
259 views

Performing POODLE attack

I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
1
vote
0answers
267 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] ...
182
votes
5answers
101k views

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
-1
votes
1answer
100 views

Shellshock vulnerability for pc inside LAN

A common pc running bash inside a home LAN network (with a router/gateway providing internet access to the LAN) does not have any contact with the external internet, except browser navigation and the ...
1
vote
1answer
321 views

Exploiting shellshock

On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses ...
2
votes
2answers
242 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
-2
votes
1answer
936 views

The correct way to check for vulnerability CVE-2014-7169 (aftershock)

I found two ways of checking for the vulnerability CVE-2014-7169 (aftershock or taviso bug) bashcheck uses: cd /tmp;rm echo 2>/dev/null X='() { function a a>\' bash -c echo 2>/dev/null > ...
11
votes
5answers
2k views

Is replacing bash with another shell a prudent step?

Considering that RedHat and other major teams in business are conducting an audit in bash and have uncovered a few other vulnerabilities besides -7169 (-7186 and -7187), is it sensible to link /bin/sh ...
0
votes
0answers
282 views

How are you able to inject bash script through the user agent

I was looking over the new Bash exploit and was looking at this post in particular. Attack scenarios of the new Bash vulnerability What I don't understand is how does including bash in the ...
21
votes
1answer
9k views

Attack scenarios of the new Bash vulnerability [duplicate]

Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test". What yet I haven't understand is, what ...
3
votes
4answers
228 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
1
vote
1answer
271 views

Cannot get access into a vulnerable Windows 2000 (MS03_026)

I'm trying to get access into a Windows 2000 server through the vulnerability MS03_026. An exploit is provided by Metasploit but I don't know why it isn't working. After filling the options (basically ...
0
votes
1answer
2k views

Cable modem/router hidden internal ISP network?

I was querying my router(Thomson TCW750-4) over the SNMP and stumbled upon some interesting information. I see that the router actually has five separate network configurations operational: ...
1
vote
2answers
59 views

secure flash update

The default method for updating flash is through Adobe's unsecured http portal, which seems to be a serious security concern, given the access that flash has on a user's machine. Can anyone recommend ...
2
votes
2answers
483 views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
1
vote
0answers
53 views

use after free vulnerability [closed]

I am struggling trying to understand use after free vulnerabilities, can someone explain it for me with C language source code, and how it can be used to write to arbitary memory location or to cause ...
5
votes
1answer
3k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
15
votes
7answers
2k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
0
votes
4answers
644 views

How can i protect myself from tor vulnerability on windows

Recently I came across an article regarding Tor. According to article there is speculation that the uncovered malware was used by a law enforcement agency to harvest the IP addresses of users ...