Exploiting Heartbleed Bug!
closed account (13bSLyTq)
Hi,
I actually exploited the heartbleed bug for the first time and its so amazing to get so much information. I wonder if it is possible to upload a shell anyway who can I contact to talk about pentesting this forum.
Thanks!
I actually exploited the heartbleed bug for the first time and its so amazing to get so much information. I wonder if it is possible to upload a shell anyway who can I contact to talk about pentesting this forum.
Thanks!
Probably don't want to admit to that.
There was a thread not too long ago where somebody was asking if this site was affected by the bug and it was suggested to actually contact Twicker about it. I can't seem to find the thread now though.
EDIT:
Pen testing implies searching for currently unknown vulnerabilities. Knowing if a place is affected by this bug is as simple as having an admin check a version number. So, no I doubt anyone will let you "pen test" their site for this bug.
There was a thread not too long ago where somebody was asking if this site was affected by the bug and it was suggested to actually contact Twicker about it. I can't seem to find the thread now though.
EDIT:
Pen testing implies searching for currently unknown vulnerabilities. Knowing if a place is affected by this bug is as simple as having an admin check a version number. So, no I doubt anyone will let you "pen test" their site for this bug.
Last edited on
closed account (13bSLyTq)
Are you kidding in, its simply to test how hard a network is to penetrate into. Next, I exploited heartbleed on a test machine lol u think I would say that in public if I had did it to a normal machine.
| OrionMaster wrote: |
|---|
| its so amazing to get so much information |
Sure doesn't sound like a "test machine".
| OrionMaster wrote: |
|---|
| its simply to test how hard a network is to penetrate into |
No, it's not.
| OrionMaster wrote: |
|---|
| Next, I exploited heartbleed on a test machine lol u think I would say that in public if I had did it to a normal machine. |
Yes. You could easily have done it to a normal machine and claimed it was a test machine. Considering the admin made this site himself, I think he can find and fix any exploits and wouldn't blindly allow a member (especially any of us with questionable pasts) to have access to his site to be able to compromise the entire site.
closed account (13bSLyTq)
fair enogu, but the information was mean to be that with a such a simple bug getting so much information is exciting. Thats what I mean. Pentesting and 0-day are different , 0-day exploits a previously unknown vulnerability (as you said) in a computer application and not a network. You must have meant a 0day not pentesting.
Next, pentesting is:
1. Determining the feasibility of a particular set of attack vectors
2. Identifying higher-risk vulnerabilities that result from a combination of lower-risk vulnerabilities exploited in a particular sequence
3. Identifying vulnerabilities that may be difficult or impossible to detect with automated network or application vulnerability scanning software
4. Assessing the magnitude of potential business and operational impacts of successful attacks
5.Testing the ability of network defenders to successfully detect and respond to the attacks
6. Providing evidence to support increased investments in security personnel and technology
As you see, if I go into a hacking forum and ask them about website or network hacking and say I found a 0day they would laugh at you.
Pentesting is an attack on a computer system with the intention of finding security weaknesses, potentially gaining access to it, its functionality and data. It uses exploits to discover weaknesses. It may use 0-days but its rare and even the most hard-core hackers I know cannot even attempt to create valuable remote exploits like RPC DCOM or such.
But what gets me is NSA discovered so many freaking 0days in windows according to Edward Snowden.
Next, pentesting is:
1. Determining the feasibility of a particular set of attack vectors
2. Identifying higher-risk vulnerabilities that result from a combination of lower-risk vulnerabilities exploited in a particular sequence
3. Identifying vulnerabilities that may be difficult or impossible to detect with automated network or application vulnerability scanning software
4. Assessing the magnitude of potential business and operational impacts of successful attacks
5.Testing the ability of network defenders to successfully detect and respond to the attacks
6. Providing evidence to support increased investments in security personnel and technology
As you see, if I go into a hacking forum and ask them about website or network hacking and say I found a 0day they would laugh at you.
Pentesting is an attack on a computer system with the intention of finding security weaknesses, potentially gaining access to it, its functionality and data. It uses exploits to discover weaknesses. It may use 0-days but its rare and even the most hard-core hackers I know cannot even attempt to create valuable remote exploits like RPC DCOM or such.
But what gets me is NSA discovered so many freaking 0days in windows according to Edward Snowden.
Last edited on
closed account (13bSLyTq)
You need to justify and analyse and tell me where in the wiki page there is errors and then I can believe you. Else its a opinion.
Next, I could backfire every proof you have and say it is not credible so you need some proof.
Next, I could backfire every proof you have and say it is not credible so you need some proof.
| Next, I could backfire every proof you have and say it is not credible so you need some proof. |
-Albatross
My point was, you literally copy pasta'd your entire post out of that wiki page. If someone knows what they're talking about, they're not going to do that.
closed account (13bSLyTq)
No, no I was using proof to back up my point because if I did not then one would require proof so I actually copy pasted it , next I did not mean to threaten or anything but I meant before someone says not credible they must have reasons valid.
Next, What I said was right and it even said so in which is proof wikipedia and next the word you were looking for was 0-day rather than pentesting as pentesting is discovering vulnerabillities in a network using pre-existing exploits\hacks such as SQL injection, XSS, LFI, RFI or RCE which are exploitable using exploits for example few web-servers are vulnerable to RFI or RCE and to exploit that bug we use a exploit which allows us to do it.
However, don't get me wrong but sometimes penterster program to change the exploit a little bit but that is a different topic that is exploit discovery via using conventional methods such as debugging, memory dumps, PE file format to discover such bugs then that is exploit development which will be then used to see if the network is penetrable using the exploit or not and thats what pentesting is.
I think if you go to any security forum you will actually find they would agree with me.
Next, What I said was right and it even said so in which is proof wikipedia and next the word you were looking for was 0-day rather than pentesting as pentesting is discovering vulnerabillities in a network using pre-existing exploits\hacks such as SQL injection, XSS, LFI, RFI or RCE which are exploitable using exploits for example few web-servers are vulnerable to RFI or RCE and to exploit that bug we use a exploit which allows us to do it.
However, don't get me wrong but sometimes penterster program to change the exploit a little bit but that is a different topic that is exploit discovery via using conventional methods such as debugging, memory dumps, PE file format to discover such bugs then that is exploit development which will be then used to see if the network is penetrable using the exploit or not and thats what pentesting is.
I think if you go to any security forum you will actually find they would agree with me.
Last edited on
Topic archived. No new replies allowed.