Questions tagged [vulnerability-analysis]

Reverse-engineering focused on the detection, and possibly the exploitation, of security vulnerabilities in software and computer systems.

Filter by
Sorted by
Tagged with
14 votes
3 answers
2k views

How exploit writers find bugs in Java Machine?

My question is about Java exploits, for example this one: https://www.us-cert.gov/ncas/alerts/TA13-010A (exploit avaiable here http://www.securityfocus.com/bid/57246/) The victimn should visit the ...
user avatar
  • 478
9 votes
2 answers
2k views

mathematical background behind exploit development and vulnerabilities

I would like more information about the mathematical foundations of vulnerability and exploit development.online sources or books in the right direction will be helpful.
user avatar
  • 734
7 votes
1 answer
785 views

What is your vulnerability discovery process? [closed]

I myself am a static analysis guy; I mostly gave up dynamic reverse engineering ten years ago. So these days, my process is usually to locate where my input enters the module that I am interested in, ...
user avatar
  • 7,799
6 votes
3 answers
2k views

Fuzzing Adobe Reader - Exploit Development

I have been fuzzing Adobe Reader lately. I found couple of bugs. One of the major issues that I'm facing are listed below. How to identify the root cause of the issue? I mean, the PoC has a large ...
user avatar
  • 595
5 votes
3 answers
4k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
user avatar
5 votes
2 answers
2k views

Need advice : Reverse engineering a pdf with shellcode

Problem : I try to find the plaintext which was hidden at pdf inbuilt with shellcode What i tried : I received a pdf which contains javascript with it ,i dig the pdf as follows : Exploring ...
user avatar
5 votes
1 answer
345 views

Do you have tips analyzing reported PoC(exploit) files?

My daily job is analyzing reported proof of concept files that exploits document viewers. People who report vulnerabilities in document viewers just give me the PoC and vulnerable version number. They ...
user avatar
4 votes
2 answers
11k views

When to use Windbg and Ollydbg?

According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is ...
user avatar
  • 381
4 votes
2 answers
436 views

Cannot locate a variable on the stack

I am unable to locate a variable on the stack. I'm using Fedora 25 x64 but with a 32 bit program, btw. C program: #include <stdlib.h> #include <unistd.h> #include <stdio.h> #...
user avatar
  • 1,605
4 votes
1 answer
5k views

How can a format string vulnerability be used to write a specific string into memory?

I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer. Can format string vulnerability also be used to ...
user avatar
3 votes
1 answer
725 views

Analyzing a use-after-free bug (taint analysis?)

I'm analyzing a use-after-free bug in IDA Pro by hand. Basically, I control the content of an object (pointed by a register) and I want to force a write at an arbitrary address. For instance, I might ...
user avatar
  • 133
3 votes
2 answers
733 views

Reading Memory to bypass ASLR

Modern exploits use different techniques to bypass ASLR. One of the technique used in some IE exploits is to leak memory using a BSTR overwrite. How can an attacker leak memory, and how can he use it ...
user avatar
  • 595
3 votes
1 answer
250 views

someone can help me recognize the vulnerability

I get this code and I can not find the vulnerability. I think this code may be vulnerable to buffer overflow. How do I prove it? #include <stdio.h> #include <stdlib.h> #include <...
user avatar
  • 33
3 votes
1 answer
1k views

Use After Free - Example

Use After Free bugs a getting more severe these days. I'm planning to demonstrate Use After Free bug exploitation using VTable overwrite. So, I'm trying to create a ATL ActiveX Control which is ...
user avatar
  • 595
3 votes
2 answers
211 views

blackbox vulnerability assessment

I wonder if the tools like AddressSanitizer exist for blackbox analysis. For instance I've fuzzer that can probe some 100 variants per second and after a few seconds crash was detected. Maybe some ...
user avatar
  • 793
3 votes
0 answers
544 views

Using Angr in Vulnerability Research

I would like to use angr for vulnerability research. I was thinking that if I did the following: p = angr.Project('a.out', auto_load_libs=False) sm = p.factory.simulation_manager() while len(sm....
user avatar
2 votes
1 answer
319 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
user avatar
2 votes
1 answer
1k views

Why stack canary can be brute-force one byte at a time?

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
user avatar
  • 21
2 votes
1 answer
158 views

How to connect to embedded device via charge-only USB?

For research purposes (vulnerability-analysis), I would like to connect to an embedded Linux-based device via USB. The USB is only intended for the (re)charging (according to the manufacturer of ...
user avatar
  • 21
1 vote
3 answers
997 views

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

Here's the attached image: (source: gsmsolutions.ie) The CA-50 was used by Nokia to program newer phones. Nokia phones from around 2008-2011 feature this port for flashing. I noticed the USB side is ...
user avatar
1 vote
1 answer
253 views

Run multiple instances of same application - Adobe Reader

I have been fuzzing Adobe Reader for a while now. One of the issue that I face is running multiple instances of same application. If I'm able to run multiple instances of same application, I will be ...
user avatar
  • 595
1 vote
1 answer
361 views

Help with identifying race condition in wargame

I've been trying for the past week to solve a wargame - where I am given a program and need to find the correct input (usually malformed, malicious, or otherwise) to get it to execute code that I want....
user avatar
  • 29
1 vote
1 answer
617 views

Understanding the variables in stack layout

i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
user avatar
1 vote
0 answers
110 views

Find vulnerabilities in ARM IoT device

I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro. I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
user avatar
0 votes
2 answers
780 views

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

I am a student of informatics with additional games engineering. I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic "Detecting ...
user avatar
0 votes
1 answer
197 views

MIPS Router Firmware

I'm pretty new to the whole reverse-engineering thing, but have some background knowledge in x86 asm and comp sci, as well as computer security. Project-based learning has always worked well for me,...
user avatar
  • 3
0 votes
0 answers
115 views

Inflate zlib Data Stream from Hex File

I am working on a firmware bin file that has been extracted from an EXE file. The Firmware was inserted as an encrypted PKZip resource in the EXE. I was able to fish the EXE password at runtime and ...
user avatar
  • 1
0 votes
0 answers
37 views

What are the best ways today in order to learn about finding use-after-frees while code auditing?

I'm a novice CTF player with a decent understanding of OS internals and software mechanisms, I have deep understanding of heap and OS and User locking mechanims. I would like to learn on how to ...
user avatar
  • 1
0 votes
0 answers
563 views

How to get a shell on a remote server?

Hello guys, I explain my problem, i recently learn about socket programming and i want to do a simple "exploit" maybe the easiest shellcode exercise. In order to be precise i'll put below the source ...
user avatar
-1 votes
1 answer
2k views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
user avatar
-2 votes
1 answer
453 views

What kind of fuzzer can i use? [closed]

I studied reverse engineering for 6 months. And I wanna discover Adobe Reader vulnerability for bughunting. But i have lack knowlege of this branch. Anyone help me plz? My question is what kind of ...
user avatar