Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

9
votes
4answers
4k views

What do shellshock attacks look like in system logs? [closed]

I have some Linux servers, which from what I can tell are not vulnerable to the shellshock attack vector, but I am curious what the attack looks like in the logs. What does a successful attack look ...
1
vote
1answer
605 views

Has Palo Alto firewalls released perimeter protection for the vulnerability in the Bash shell utility?

im wondering if palo alto firewalls have released perimeter protection for the bash shell vulnerability.
2
votes
1answer
339 views

Has CVE-2014-6271 Shell Shock been mitigated completely what is the latest? [closed]

I have patched my system however CVE-2014-7169 claims that the fix for 6271 was incomplete. Sure enough if I run the command below: env X='() { (a)=>\' sh -c "echo date"; cat echo It appears that ...
9
votes
2answers
3k views

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down ...
41
votes
3answers
23k views

Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?

I've recently heard via Twitter about CVE-2014-6271. Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
1
vote
2answers
141 views

Is this a serious vulnerability? Semi Information Disclosure

I was registering on an e-commerce website (no, I'm not gonna name it), when, due to my pentest nature, I captured the GET request for resending a confirmation email. Kinda like: http://www.example....
0
votes
1answer
1k views

What is DOM based XSS? And How to prevent it? [duplicate]

I know very well about the classic XSS vulnerabilities such as reflected & stored XSS. I have read a lot about DOM and DOM based XSS vulnerabilities. I came to an inference that there is nothing ...
8
votes
1answer
19k views

how can we find the CSRF vulnerability in a website?

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
4
votes
2answers
4k views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
4
votes
4answers
4k views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
0
votes
1answer
1k views

Are shell scripts / bash inherently less secure than other (script) languages such as python?

Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts? Or are shell scripts / bash less advisable for some tasks such as parsing ...
0
votes
1answer
144 views

What is the danger or downside of using online/cloud web app scanner vs on premise ones?

Cloud scanners are becoming more common these days. Pricing is a lot cheaper than on premise scanners. My concern with cloud scanners is that they store sensitive information on 3rd party network. (I ...
0
votes
1answer
388 views

Which shell is more secure, mksh or bash?

Which shell is more secure, mksh or bash? There has been some discussion pointing into the direction, that mksh is more secure. How to come to that conclusion? By looking which code was more audited ...
5
votes
2answers
3k views

How vulnerable am I on a unencrypted public WiFi network? [duplicate]

I am enrolling myself into a college. College provides a Public WiFi Access Point, to access internet through its network, which is unencrypted (No password). As being a programmer for last one and a ...
2
votes
2answers
313 views

Reporting SQL injection vulnerability to company that does not care

I have just finished building a CMS targeted at a certain industry and built a test site to see how everything works. I wrote a program to check for SQL injection vulnerabilities and the program ...
1
vote
0answers
86 views

use after free vulnerability [closed]

I am struggling trying to understand use after free vulnerabilities, can someone explain it for me with C language source code, and how it can be used to write to arbitary memory location or to cause ...
1
vote
1answer
141 views

How to maintain validity of user credentials?

In an example scenario consider that; I am a customer of organisation and I have two separate accounts with two different departments X and Y. I can login in to each department's website by using ...
1
vote
1answer
2k views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
1
vote
2answers
341 views

Need explanation on local file inclusion?

So few days ago a friend fixed an lfi on his site , and he sent me the url used , it was base 64 encoded url but not usual ../../../etc/passwd , It is : Li4vLi4vZXRjL3Bhc3N3ZAAucG5n Now decoded on ...
0
votes
2answers
281 views

Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my ...
1
vote
3answers
283 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
3
votes
1answer
172 views

Is it legal to “use” security vulnerabilities [closed]

I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are. Heres the case: I found a security hole in one of ...
2
votes
1answer
623 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
0
votes
1answer
98 views

How do I report a vulnerability? [closed]

How would I report an international security vulnerability which could cause a lot of damage? I am asking how & where I would report this vulnerability, not now to create a simple vulnerability. :...
4
votes
2answers
3k views

How does arbitary code execution work?

I'm unable to understand how arbitrary code execution vulnerabilities are supposed to work. Wikipedia mentions: Arbitrary code execution is commonly achieved through control over the instruction ...
0
votes
1answer
2k views

URL Rewriting vulnerability

We modified our Session handling from cookie based to URL Rewriting. By doing this the session id gets transmitted as part of the URL. Now there is a vulnerability issue, where whoever uses this URL ...
2
votes
1answer
279 views

Is this a bot fishing for security vulnerabilities on my site?

I am running a webpage for my family with a feature to track users and guests. Since its all just family stuff no one ever visits this server, and I hardly see more than 2-3 of us logged on at the ...
7
votes
3answers
3k views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
1
vote
3answers
10k views

Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?

In presence of 'trust certificates' & other attributes .. how important is this? Does OpenSSL implement it now & If not why does OpenSSL not implement? This is between non browser client &...
9
votes
2answers
460 views

How easy is it, really, to be hacked as an average user?

tl;dr at the bottom I have been searching around and I haven't been able to find a definitive answer to the question(s). I mainly work with OS X so that will be the base for my questions. How easy ...
0
votes
2answers
162 views

Creative vulnerabilities in unix eval command [closed]

I'm reading through past exams for an information security subject and I came across this. #!/bin/sh #applications launcher X=$1 eval "$X" "Do you think the program is vulnerable to attacks? Explain ...
1
vote
2answers
2k views

Is it illegal to publish an exploit against a known vulnerability in US?

Is it illegal to publish an exploit against a known vulnerability in US? The exploit could be published in one's blog or places like exploit-DB. It seems that in countries like Germany and France such ...
1
vote
2answers
102 views

Directory names using extensions a security risk?

In our app (PHP, MySQL) we allow users to create templates which are stored in their own subdirectory (which is named by the template name). Someone suggested to use standard file name sanitization ...
0
votes
1answer
351 views

How is a process forced to execute binary code?

I want to understand how a vulnerable internet facing process on some computer is exploited to run arbitrary binary code. I understand how buffer overflows could be used to overwrite the return ...
18
votes
1answer
36k views

What are the main vulnerabilities of TLS v1.1?

What are the main vulnerabilities of TLS v1.1? Actually, no RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except the description given in section 1.2 ...
0
votes
2answers
2k views

What types of software vulnerabilities are out there? [closed]

I have search a lot in the internet and I didn't find anything that is directly answer my question. What type of vulnerabilities are out there. I mean vulnerabilities like buffer overrun, not like XSS ...
1
vote
0answers
148 views

Struts2 + action prefix vulnerability + CVE-2013-4310

CVE-2013-4310 indicates the action prefix (action:) feature of struts2 framework is vulnerable. Hence the vendor released the patch(?) by disabling this feature. However, there is an option to enable ...
7
votes
3answers
8k views

How to access directories disallowed in robots.txt?

While scanning my website with uniscan it found my robots.txt file which disallows access to /cgi-bin/ and other directories, but they are not accessible in browser. Is there a way to access the ...
1
vote
1answer
960 views

How to use a Blind SQL-i keyword?

After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return. Blind SQL Injection: [+] Vul [...
5
votes
4answers
3k views

Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable

According to the OpenSSL project the version in use on a server we control is not vulnerable: 0.9.8o. According to OpenVPN v 2.1.3 is also not vulnerable (also in use). These are running on Debian ...
2
votes
1answer
115 views

What does the field vuln-security-protection stand-for in the NVD cve lists 2.0?

In the different NVD files which enumerates the CVE, which can be found here There is from time to time the field <vuln:security-protection> , containing often the value ALLOWS_OTHER_ACCESS or ...
0
votes
1answer
656 views

manually approach to check vulnerabilities?

How to check for different vulnerabilities mainly XSS, SQL Injection, CSRF manually??? We are not supposed to use any interceptor tool to read request and all. Is there any other way by which we can ...
11
votes
3answers
11k views

What is a good XSS vector without forward slashes and spaces?

I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after ...
2
votes
3answers
20k views

How to exploit this SQL injection vulnerability?

I am learning SQL injection on a vulnerable web app. I scanned it with w3af. It showed many vulnerabilities. One of them is: SQL injection in a Microsoft SQL database was found at: "http://www....
9
votes
4answers
1k views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...