i am to web applications so i have recently published my website and ran a penetration test using Acunetix Vulnerability scannerso i have found the following result and for me to experience a lot about web apps i would like experiment on this website penetrate my site see if i can successfully run arbitary code send emails do stuffs inside my website.Acunetix vulnerability resultsA heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. The problem affects nginx compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the spdy option of the listen directive is used in a configuration file.Affected itemsthank you
how can one cause heap memory buffer overflow in a worker process by using a specially crafted request?
malware;websites
I have not used Acunetix before, since I do not rely on automated assessment tools personally. However, I would assume, that Acunetix does the service banner grabbing, identifies the version reported there, and then matches it against a know database of vulnerabilities without actually verifying if the exploit conditions are true. Since the latter is typically left to human pentester to execute and confirm.If you Google for nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12, you would find at least:http://nginx.org/en/security_advisories.htmlhttp://www.saintcorporation.com/cgi-bin/demo_tut.pl?tutorial_name=nginx_HTTP_vulnerabilities.htmlThese might or might not have a publicly disclosed exploit code. Depending on that you would have to either do the patch analysis, debugging and exploit development on your own. Or if you are trying to secure your server -- then you would have to patch the software or implement the latest stable release.For more hints and proof-of-concept exploits you can start your search with the exploit-db.com.Hope this clarifies your question.