56

It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities. Crashes may give an attacker valuable information about the system and its internal details. Crashes may create temporary vulnerabilities or leave ...


31

DOT's backend Oracle database is down due to ORA-27101. ORA-27101 has a nice explanation here with a useful reader comment stating that it happened to them because the Windows Event log was full. From the output, you can learn that they have Oracle, Java JDBC, Drupal, ColdFusion. You also see some SQL code. With that knowledge you can start digging for ...


19

The link provided in the question seems really fishy. If it's a "patched" version supposed to get rid of limitation, it's more than probable the fixer added some kind of additional surprises (like a virus) in it. The official site already proposes a free version of the software, so I would start here to avoid getting a virus from a random stranger. This ...


18

It certainly does. gdb will not isolate the process at all and will merely give you some control over it to understand what it does. To do that kind of analysis, you should resort to a fully isolated system such as a VM with no network access. Break points will be respected, but you should always account for human errors which can have drastic ...


14

As previous answer have covered most of the scenario in which attacker can get direct benefit by analyzing application crashes. I will recommend read on "Analyze Crashes to Find Security Vulnerabilities in Your Apps". Analyzing crashes for security vulnerabilities may require low level programming skills. As shown in figure 1 every exploit may not lead to ...


13

Short: Is exploit researching different from penetration testing? Yes. Is exploit researching part of pentesting? Usually not. Good summary of what penetration testing is is here: Wikipedia definition of penetration testing. Simple penetration testing A lot of penetration testing work is actually just running pre-existing, well-known attacks or exploits....


11

On 32-bit x86 processors, with the ELF format in use on Linux systems, the function call convention states (page 3-12) that: A function that returns an integral or pointer value places its result in register %eax. In your program, the last element of main() is a call to strcpy(). That function returns a copy of its first argument, here a pointer to the ...


11

To generalise Deer Hunter's answer: If an application crashes, it means that what is happening is not expected, and not understood. If it is not expected and not understood, you have no way of knowing whether it is safe. You must therefore assume that it is not safe. Note that simply catching and discarding an unexpected exception is also insecure and ...


11

This message is not a security issue by itself. It's just a message. But it gives you a lot of information which you shouldn't get normally. With this information you could start searching through exploit-db and offensive-security if you are not familiar with writing exploits on your own.


8

Start with this guide -- https://github.com/hfiref0x/VBoxHardenedLoader -- it's incredibly up-to date in terms of making a VirtualBox guest VM more-difficult to detect, including techniques valid in 2017. This will definitely make your automated malware analysis initiatives and goals easier to achieve. Consider tracing and debugging outside of the guest VM ...


6

I would argue that this is in fact a security issue, since they are not preventing an verbose error message from being exposed. This might indicate that with enough effort, you could replicate such behaviour somewhere else (by provoking errors) and therefore collecting lots of information about their technologies and configurations.


6

Edit: As the question is a little unclear there might be a misunderstanding. From my point of view there are 2 possible answers: GHIDRA does not offer a debugger for other binaries currently. (It is a planned feature) GHIDRA has a debug mode to debug GHIDRA itself. This debugger is even accessible from the network, as the exposed port is not only locally ...


5

This is likely the same reason that you don't want to release a C/C++ program with the -g flags. Unnecessary symbols are likely stripped away or obfuscated. The build system might leave out certain security measures that will make debugging the application significantly easier. Pro-guard build scripts are likely not included in a debug build. The ...


5

Your main function contains pointer to __libc_csu_init just before its return pointer, because that's how stack frame works; before entering a function, caller pushes a stack frame pointer and a return pointer. Return pointer contains an address, to which function will return on function finish. Frame pointer contains the address of the previous top of ...


4

No. There's something to be said for the fact that if you "own" a machine, then you own it. Physical possession of a piece of hardware with the ability to disassemble, modify, and otherwise physically hack the device very nearly guarantees that with enough work you will be able to get around security measure that might be present. So, no, JTAG is no more ...


4

Shipping application with debug means that anyone with physical access to the device can execute arbitrary code under that application's permission. If the application holds sensitive data, it will be fairly straightforward to extract that sensitive data from the application. Doing the same on nondebuggable application would require the attacker to first ...


4

Please direct binary analysis and reverse engineering questions to https://reverseengineering.stackexchange.com/ especially if you are just starting out, since there is already a wealth of relevant knowledge that has been shared there and is frequented by and contributed to by professional reverse engineers and malware analysts. Possibly relevant existing Q&...


4

what stops us from starting a shell from within the debugger? If you run a setuid program under debugger, and you're not root, it will run as if was not setuid. Meaning it will execute under your id, not root. So while you can spawn a shell, it will use your credentials. You can easily test it yourself by launching su under gdb and verify in another ...


4

No, that's a terrible idea. A few reasons why: There are a lot of legitimate app developers, and they shouldn't need a separate phone to test their own app than they do to use yours. There are a lot of legitimate reasons for end-users to use development mode, such as using Helium Backup. It's really easy for any hacker even slightly more competent than a ...


3

You're thinking of TLS callbacks! TLS includes TLS callbacks, an array of pointers to functions that are to run before the EP is reached. This functionality exists so the developer can initialize the TLS data before the program is run. Putting your malicious code here would make it somewhat unexpected to the analyst since your debugger would normally break ...


3

An application crash is the result of an unexpected and unhandled behaviour. This means there is a bug in the application that crashed, and numerous bugs leads to vulnerabilities. One of the most dangerous kind of crash is ths crash due to memory corruption (Segmentation fault). This kind of bugs can often be exploited to make the vulnerable application ...


3

You could begin looking at Symantec: http://www.symantec.com/connect/articles/windows-anti-debug-reference And there is a question in Stackoverflow about anti-debugging tricks.


3

It depends on the device. In most Android devices it is possible to physically replace the software in Flash (the so-called "ROM") and thus overcome any software dependent security, in which case an open JTAG port doesn't make things much worse. But there are a few Android devices on the market in which the hardware validates the "ROM" software before it is ...


3

According to the paper "WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages" from 2015 WhatsApp does not use HTTP(S) but: WhatsApp uses the FunXMPP protocol for message exchange which is a binary-efficient encoded Extensible Messaging and Presence Protocol (XMPP) Which means that you will not be able to ...


3

You should check this github repo: https://github.com/jhaddix/tbhm Welcome! This repo is a conglomeration of tips, tricks, tools, and data analysis to use while doing web application security assessments, and more specifically towards bug hunting in bug bounties. Make sure to also check the video :)


3

Your note that it's a "different user's process" is the key here. If the malicious process is limited to that user's context, then attaching a debugger (which usually requires deep permissions) gives the process access to more resources. While a debugger might be used to prevent malicious activity, there is no way for the debugger to know what exactly you ...


3

I have never debugged the kernel, so I may be wrong, but I believe that what you are seeing makes complete sense. Let's go through it: add BYTE PTR [rax],al why is that? is this because I'n in virtual machine? That is what I would actually expect from 0x0000. This is easy to test: [~]$ uname -a Linux haps 4.7.6-1-ARCH #1 SMP PREEMPT Fri Sep 30 ...


3

The 0x414141 and 0x424242 that are placed in books for educational purposes because these are simply the strings "AAAAAAAA" and "BBBBBBB" in hexadecimal notation. Assigning them to integers has nothing to do with buffer overflows. A much better example can be had by using a full program, and a function call that will allow us to know when the overflow ...


3

As you correctly pointed out ESP always points at the top of the stack. Also stack overflows occur due to an overflow of a buffer on the stack (not due to an overflow of lets say a malloc-allocated buffer). So when you do: char* buf[100]; you are actually allocating some space on the stack for your buffer. To illustrate this: This buffer's initial state/...


3

It can reveal details of the implementation to an attacker that can be used to mount a better attack. Quoting from the OWASP page on improper error handling: Even when error messages don’t provide a lot of detail, inconsistencies in such messages can still reveal important clues on how a site works, and what information is present under the covers. For ...


Only top voted, non community-wiki answers of a minimum length are eligible