burlyscudd

6 ms·

1. 1.▲
   by burlyscudd 13y ago

   Scan a QR code, click the link --- aaaaand attacker has a shell on your phone.
2. 2.▲
   Metasploit ships single-click exploit for Android(community.rapid7.com)

   4 points by burlyscudd 13y ago|2 comments
3. 3.▲
   by burlyscudd 13y ago

   The executing process belongs to you - you should allow it no secrets in its basic running. First thing in any lang: learn the tools available for debugging and quickly opening library code to trace execution. Set breakpoints; dive int
4. 4.▲
   Anatomy of a botnet: Rapid7 researchers dissect Skynet(community.rapid7.com)

   8 points by burlyscudd 14y ago|1 comments
5. 5.▲
   by burlyscudd 14y ago

   In addition to giving security professionals tools to see how vulnerable their infrastructure is to real-world attacks, releasing exploits like this actually creates significant pressure for vendors to patch vulnerable software. Take the re
6. 6.▲
   by burlyscudd 14y ago

   Nope
7. 7.▲
   by burlyscudd 14y ago

   Yeah fair point that this exploit gives privs @ the level of the browser's current user. In that parenthetical, I was basically trying to explain what "session" means in Metasploit parlance in general.
8. 8.▲
   by burlyscudd 14y ago

   He's running a web server process w/ Metasploit, configured to serve/run the exploit module. Then he issues a GET request to the server w/ the affected browser and gets a session in Metasploit (framework). The screenshots are basically pr