Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

A weakness or flaw in computer software and hardware which allows an attacker to take advantage of (exploit) a targeted system.

-3
votes
1answer
360 views

Is there scan-me-for-vulnerabilities services? [closed]

Where can I get more similar to nmap.online-domain-tools.com scan services. Edit: Probably, nobody know what does nmap.online-domain-tools.com is. I'm trying to explain: Network service. For ...
6
votes
2answers
768 views

Information Transfer Between Browsers and Tabs

Is it possible for a webpage to detect or otherwise be aware of what other tabs in the same browser, or even other open webpages in other browsers are doing or transmitting? I am well aware of cookies,...
8
votes
3answers
17k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
0
votes
1answer
370 views

Arbitrary code execution by opening a webpage by IE?

I came across this piece of HTML code today: <!doctype html> <html> <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" > <head> </head> <body> <SCRIPT ...
2
votes
3answers
4k views

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command ...
4
votes
4answers
2k views

How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.

I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students; It used to use EAP, allowing students to enter their ...
0
votes
1answer
238 views

Does MS14-066 affect CE versions of Windows?

I'm aware of the impact of MS14-066 to Windows servers/workstations, and have managed the patching our of desktop networks. However, I am concerned that our Windows CE systems may also be affected, ...
10
votes
3answers
6k views

SQL Injection if table structure/db structure not known

could an attacker who'd just found out that you're using mysql make an SQL Injection attack with only this information? If you don't know Any table/db name how come you can find it out? Is that even ...
2
votes
1answer
197 views

Downloading operating systems vulnerable to TCP amplification

I am doing a security research project on TCP amplification, and was looking to download vulnerable OS's for testing. From what I have researched mostly ancient linux kernels (2.0.x and below) and ...
-2
votes
2answers
86 views

What sort of vulnerability is this?

I am testing one web application build using PHP. I found one vulnerability in which multiple user can log-in using same browser, without destroying others session. What this sort of vulnerabilities ...
0
votes
2answers
700 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones) [closed]

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
8
votes
1answer
1k views

Why do some known vulnerabilities have no CVE ID?

Why do some known vulnerabilities have no CVE ID? And why does some vulnerability have a CVE ID assigned but no information on cve.mitre.org or cvedetail.com?
2
votes
3answers
671 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
2
votes
0answers
932 views

Backdooring vulnerable lighttpd installed on wireless AP [closed]

I have an AP at home and I'm trying to secure it as much as I can. I found an bug by accident. My AP has 3 ports opened: 22/ssh 53/dns 8081/blackice - icecap What I found is that my port 8081 is ...
1
vote
1answer
244 views

Who will fix the vulnerabilities found in Firewall

As a security guy, i run vulnerability scan and found vulnerabilities in firewall Like as follows SSL Server Allows Anonymous Authentication Vulnerability Solution SOLUTION: Disable support for ...
0
votes
1answer
380 views

Rooted android cached password

Assume you could exploit a vulnerability on an old Android 2.2, the questions are: 1- Is there anyway you could see stored passwords on that operating system, specially Facebook password. 2- Can you ...
-3
votes
1answer
11k views

Hown I can test “Microsoft ASP.NET Forms Authentication Bypass” in ASP.Net 4.0.30319

I searched in google for "ASP.Net 4.0.30319 vulnerability " keyword. finally,I found "Microsoft ASP.NET Forms Authentication Bypass" in below link: http://dl.packetstormsecurity.net/1203-exploits/SA-...
2
votes
3answers
2k views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
1
vote
3answers
3k views

How to exploit this include_once vulnerability in PHP?

I'm performing a static analysis on a PHP code and came across this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP request: ...
3
votes
3answers
10k views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
3
votes
1answer
5k views

Is there any practical attack on port knocking method?

I was wondering, how can I bypass the port knocking method. Is there any public vulnerability or method for attacking port knocking services? For example: I know an SSH port is behind a port ...
1
vote
0answers
348 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] vulnerable ...
7
votes
1answer
701 views

I've discovered a vulnerability which can reveal personal information for multiple websites. How to go about it?

It's not so much a technical vulnerability, but rather a sloppy security practice by a web design consultancy. They use a CMS which they've augmented with an admin login. As it happens, the admin ...
238
votes
4answers
108k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the ...
0
votes
1answer
270 views

Is the following PayPal Vulnerability a design/implementation flaw?

I am trying to understand the logic behind following vulnerability, I believe this a design flaw not only an implementation. To me the problem with the two-factor authentication service at PayPal is ...
3
votes
3answers
688 views

Vulnerability or Threat?

I have a practice question here: A business is going to determine the dangers to which it is exposed. What do we call a possible event that can have a disruptive effect on the reliability of ...
0
votes
1answer
204 views

Pivoting through XSS

I'll start off by saying this is a purely academic question; I'm trying to fill some gaps in my knowledge. If a website is vulnerable to XSS, and the target host is another machine that can browse to ...
1
vote
1answer
649 views

Exploiting shellshock

On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses ...
-6
votes
2answers
674 views

where can I find list of zero day vulnerability? [closed]

I want to have list of zero day vulnerability, Could any one intuduce some site which annonce them?
3
votes
1answer
650 views

Internal IP addresses allowed access to all DMZ hosts

Hi basically I'm doing a vulnerability assessment for at the moment. The setup includes a DMZ with a single firewall and an internal network (3 legged network model employing a single DMZ) but on the ...
9
votes
4answers
5k views

What do shellshock attacks look like in system logs? [closed]

I have some Linux servers, which from what I can tell are not vulnerable to the shellshock attack vector, but I am curious what the attack looks like in the logs. What does a successful attack look ...
1
vote
1answer
606 views

Has Palo Alto firewalls released perimeter protection for the vulnerability in the Bash shell utility?

im wondering if palo alto firewalls have released perimeter protection for the bash shell vulnerability.
2
votes
1answer
340 views

Has CVE-2014-6271 Shell Shock been mitigated completely what is the latest? [closed]

I have patched my system however CVE-2014-7169 claims that the fix for 6271 was incomplete. Sure enough if I run the command below: env X='() { (a)=>\' sh -c "echo date"; cat echo It appears that ...
9
votes
2answers
3k views

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down ...
41
votes
3answers
23k views

Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?

I've recently heard via Twitter about CVE-2014-6271. Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
1
vote
2answers
144 views

Is this a serious vulnerability? Semi Information Disclosure

I was registering on an e-commerce website (no, I'm not gonna name it), when, due to my pentest nature, I captured the GET request for resending a confirmation email. Kinda like: http://www.example....
0
votes
1answer
1k views

What is DOM based XSS? And How to prevent it? [duplicate]

I know very well about the classic XSS vulnerabilities such as reflected & stored XSS. I have read a lot about DOM and DOM based XSS vulnerabilities. I came to an inference that there is nothing ...
8
votes
1answer
20k views

how can we find the CSRF vulnerability in a website?

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
6
votes
2answers
4k views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
4
votes
4answers
5k views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
0
votes
1answer
1k views

Are shell scripts / bash inherently less secure than other (script) languages such as python?

Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts? Or are shell scripts / bash less advisable for some tasks such as parsing ...
0
votes
1answer
145 views

What is the danger or downside of using online/cloud web app scanner vs on premise ones?

Cloud scanners are becoming more common these days. Pricing is a lot cheaper than on premise scanners. My concern with cloud scanners is that they store sensitive information on 3rd party network. (I ...
0
votes
1answer
395 views

Which shell is more secure, mksh or bash?

Which shell is more secure, mksh or bash? There has been some discussion pointing into the direction, that mksh is more secure. How to come to that conclusion? By looking which code was more audited ...
5
votes
2answers
3k views

How vulnerable am I on a unencrypted public WiFi network? [duplicate]

I am enrolling myself into a college. College provides a Public WiFi Access Point, to access internet through its network, which is unencrypted (No password). As being a programmer for last one and a ...
2
votes
2answers
318 views

Reporting SQL injection vulnerability to company that does not care

I have just finished building a CMS targeted at a certain industry and built a test site to see how everything works. I wrote a program to check for SQL injection vulnerabilities and the program ...
1
vote
0answers
86 views

use after free vulnerability [closed]

I am struggling trying to understand use after free vulnerabilities, can someone explain it for me with C language source code, and how it can be used to write to arbitary memory location or to cause ...
1
vote
1answer
142 views

How to maintain validity of user credentials?

In an example scenario consider that; I am a customer of organisation and I have two separate accounts with two different departments X and Y. I can login in to each department's website by using ...
1
vote
1answer
2k views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
1
vote
2answers
352 views

Need explanation on local file inclusion?

So few days ago a friend fixed an lfi on his site , and he sent me the url used , it was base 64 encoded url but not usual ../../../etc/passwd , It is : Li4vLi4vZXRjL3Bhc3N3ZAAucG5n Now decoded on ...
0
votes
2answers
283 views

Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my ...