Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

1
vote
0answers
28 views

Android Exploit Development Lab [on hold]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
7
votes
1answer
99 views

What is the reason for the increase of CVEs since 2017?

According to CVEdetails.com, there were 6447 CVEs in 2016. In 2017 there were 14714 CVEs. That's 128% more than in 2016. Further, in 2018 it became even more with 16555 CVEs. A single peak in one year ...
0
votes
1answer
34 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
105
votes
15answers
20k views

How can I argue against: “System is unhackable so why patch vulnerabilities?”

An operating system has reached End of Support (EoS) so no more security patches are coming for the OS ever. An embedded device running this OS needs to be updated to a newer version. However, the ...
0
votes
2answers
118 views

How to search for all computers running memcached on shodan

Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port ...
1
vote
1answer
520 views

How to prevent persistent XSS vulnerability with the Java Struts 1 Framework?

I have an application that executes under Tomcat 7, developed with Struts (Java Web Framework). My application contains a security vulnerability (XSS Cross-site scripting). What kind of XSS ...
9
votes
1answer
521 views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

February 9, 2019: Source: New TLS encryption-busting attack also impacts the newer TLS 1.3 "Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the ...
1
vote
2answers
172 views

How does an OS execute code from a PNG file? [duplicate]

A recent bug in Android allows a hacker to execute code that is contained within an image file. Here is the quote from the Android Security Bulletin, The most severe vulnerability in this section ...
0
votes
1answer
41 views

OAuth 2.0 when and how to use the client id and secret

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain ...
1
vote
2answers
127 views

Vulnerability in using `input type=“text”` for website password other than shoulder surfing

I found a website that uses the plain text field as a password input form. <input type = "text" autocomplete= off ...> I understand shoulder surfing is one vulnerability but are there other ...
0
votes
1answer
67 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
1
vote
1answer
43 views

is SSRF attack or vulnerability?

I'm reading now about SSRF attacks, and many articles "SSRF is an attack" and others said "it's a vulnerability." Which is correct?
8
votes
1answer
544 views

Attack vector for exploiting WhatsApp's retransmission “vulnerability”?

A few days ago, an old "vulnerability" of WhatsApp re-appeared in the media. The Guardian published this article calling the vulnerability a "backdoor". The article cites these findings of Tobias ...
2
votes
2answers
544 views

Why double tagging attack in VLAN is unidirectional (one way)?

I was reading this article about VLAN double tagging security issues, and started to wonder two things: 1) Why double tagging is a one way attack? 2) How can the adversary make a bi-directional ...
0
votes
1answer
18 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
0
votes
0answers
15 views

Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404

I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
4
votes
2answers
236 views

Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)

Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
0
votes
1answer
60 views

How to do Mobile application testing using Burp Suite on latest ios and android devices

I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices. Here are the settings below which I have done in below points. I made sure that my ...
2
votes
0answers
41 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
-1
votes
1answer
41 views

Does making a pdf searchable make it more vulnerable? [closed]

I would like to know if making a pdf 'searchable' somehow make it less secure?
13
votes
2answers
674 views

How to detect Rowhammer vulnerability?

Related to How to know whether a RAM module is vulnerable to rowhammer before buying?, how can I check whether my already installed memory modules are susceptible to this attack, without having to use ...
1
vote
1answer
39 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
1
vote
2answers
494 views

Java Deserialization issue

I have been reading about the Java deserialization vulnerability which leads to Remote Code Execution attack. Many public exploits are even available to do the attack. I didn't find any tutorial ...
2
votes
1answer
118 views

How does wireless keyboards' encryption prevent frequency analysis?

I've found very little information on this topic after much googling. The only partial answer I found was by Microsoft: Microsoft_AES_Technical_Factsheet By adding random data to each message, each ...
3
votes
4answers
181 views

Is there a standard for labeling a vulnerability as an intentional backdoor?

US concerns of intentional vulnerabilities placed in foreign manufactured equipment has lit up headlines. Is there a standard that sorts (differentiates) poor-designs from intentionally placed ...
6
votes
1answer
357 views

External command execution in Excel formulas

It's known that MS Excel functionality of external references will allow executing arbitrary commands from its formulas with appropriate security warnings and confirmation required from the user. E.g....
3
votes
3answers
7k views

Bypass x-frame-options for clickjacking

Is there any way to bypass the x-frame-options header without using a MitM or changing the packets in another way? So actually getting a site that has x-frame-options: DENY to be shown in an iframe.
4
votes
3answers
949 views

HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Testing for DOM based XSS at OWASP reads: The first hypothetical example uses the following client side code: <script> document.write("Site is at: " + document.location.href + "."); </...
1
vote
1answer
45 views

Security implications of exposing payment gateway secret API key

Introduction In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow: POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL. ...
2
votes
1answer
158 views

Do security consultants routinely demonstrate hacking into attendees' PCs within minutes?

From this Quora answer: Years ago when I was in China I was getting updated on cyber security from one of our partnerships. We were going over everything from basic hacks a 9 year old could ...
0
votes
1answer
70 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
1
vote
1answer
169 views

Install Metasploitable on PC [closed]

I am a teacher giving pentesting classes and I have a group of students that I have been teaching for 4 years now. I would like to make a little "hacking contest" in which there is a vulnerable ...
3
votes
1answer
66 views

Do memory-level vulnerabilities in x86 applications also affect ARM?

I am currently fuzzing various open-source libraries and programs in order to find buffer overflows, underruns, memory leaks, crashes, etc. I am using an ARM system to perform this fuzzing. The ...
2
votes
1answer
326 views

What is NetSpectre?

A new attack was revealed in a document titled NetSpectre: Read Arbitrary Memory over Network (PDF warning). I've seen a few non-technical writeups about the fact that it's a pretty slow attack: ...
2
votes
0answers
28 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
1
vote
1answer
672 views

Dealing with NULL byte (0x00) in offsets

I'm trying to exploit a strcpy() buffer overflow vulnerability to test ROP attack. I found a very useful gadget at address 0x0000f26c so I am obliged to insert null bytes to the stack to override the ...
3
votes
1answer
2k views

How to use a sh SUID script to get privilege escalation?

As www-data user (non-privileged user) I have found this SUID, world-writable shell script: www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin -rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/...
0
votes
0answers
62 views

Failed to exploit netapi vulnerability on Windows server 2003 R2

I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message: Exploit completed, but no session was created. Any thoughts? ...
1
vote
1answer
84 views

Exploit database for NVD vulnerabilities [closed]

I have the list of vulnerabilities (CVEs) in the NVD database. I need to find which one has an exploit. Is there any database available to get the list of all the exploits for CVEs? or is there any ...
1
vote
3answers
138 views

Router access, am I in danger?

I learned I can access my router from a web device like so http://ipaddress/login.html I was wondering if anyone could gain access to my router control panel. IF that is the case can they compromise ...
1
vote
1answer
159 views

How the attacking vector of Skygofree is composed?

Regarding recently emerging Skygofree trojan for mobile devices, having read the following article Secure list / Skygofree summary it is still unclear to me how the device is getting affected with ...
0
votes
1answer
175 views

Vulnerability Analysis

As a developer of multiple standalone apps (Web-/Native apps) I am wondering, what things I should keep in mind / what are typical approaches of a blackhat (besides of these scriptkiddies checking for ...
2
votes
1answer
332 views

Can the client communicate with the AP after a KRACK attack?

When a client is forced to reinstall the key and to reset the nonce and the replay counter, what does it imply for the future communication between the client and the AP? There's a adversary in the ...
0
votes
1answer
44 views

TVRA does it cover physical, cyber and information security?

For that matter is TVRA only linked to security? Can it be used to assess, evaluate all or any situation and from there, come up with control measures?
1
vote
0answers
16 views

Vocabulary matters: link between faults and weaknesses

I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate ...
1
vote
2answers
37 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
1
vote
1answer
96 views

Internal HTTP(s) vulnerabilities

We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
2
votes
3answers
359 views

What are some best practices for WiFi security, in light of recently discovered vulnerabilities?

In the past few months, we've seen the revelation of several WiFi vulnerabilities (eg KRACK). It doesn't look like NIST has updated any of its best practices. How should we configure our enterprise ...
1
vote
0answers
45 views

Advice for carrying out risk identification in ISO27005:2011

I am currently required to carry out an information security risk assessment for an assignment, using the ISO 27005:2011 standard, for the Equifax data breach that occurred in 2017, https://...
0
votes
1answer
125 views

What famous attacks used a use-after-free vulnerability?

I'm compiling vulnerabilities and related attacks, and I need to find a famous attack that exploited a use-after-free vulnerability. I've looked for a while though I can't seem to find any. I know ...