prevention of an attack vector (e.g. XSS, HPP, CSRF)
-1
votes
0answers
25 views
How to make sure my NIDS can detect recent exploits/vulnerabilities?
Is there any way other than installing the vulnerable OS and application, then running the exploit (published in exploit-db.com) to check whether my configured IDS could detect it or not? I mean, ...
2
votes
3answers
76 views
Does Gmail 2-factor auth increase security on smartphones?
So I have enabled 2-factor authentication on Gmail, which means that if I log in on a new machine, it sends a token to my phone.
Now, if I access Gmail from my phone, it seems like I have only one ...
-5
votes
1answer
42 views
History of Buffer Overflow attacks and it's countermeasures? [closed]
I want to know the chronology of BoF attacks and it's countermeasures.
We know it's started about 1972, here's a hypothetical of it:
Buffer Overflow Simple (attack)
ASLR (Contermeasure)
ret2reg ...
4
votes
1answer
65 views
Security consequence of Javascript hole in an online chat?
For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?
-4
votes
0answers
59 views
10 Most Common Windows PC Attacks [closed]
I’m trying to make a list of the ten most common attacks a windows computer faces when attacked by an intentional hacker. What I mean by intentional hacker is someone who has set his sights on ...
6
votes
1answer
88 views
How does ASCII-Armoring help to prevent buffer-overflow attacks?
I was reading about return-to-libc attacks at Wikipedia.
According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
3
votes
1answer
84 views
Vim Modeline Vulnerabilities
I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like:
# vim: set someoption=somevalue
and will then set those options. This is awesome if ...
2
votes
3answers
86 views
How good is validating source with request.referer than checksum?
I have 2 portals(both are under my control & domain names are different)
In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.
Link which will be hit in ...
0
votes
1answer
40 views
How to specify a Snort rule connection duration?
Is it even possible to specify into a snort rule the duration of a connection?
For example: in this format Hour, Minute, Second
H, M, S = 0, 2, 1
If a connection that has the duration of 2 minutes ...
2
votes
2answers
106 views
What is the disadvantage of using spoofing protected version of ARP protocol
I read this article about man-in-the-middle arp poisoning and how it works , it seems that arp poisoning programs exploits the fact that ARP protocols trusts any packet to be true and modify its ...
2
votes
1answer
120 views
External network DNS spoofing
I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios:
1. ...
6
votes
4answers
352 views
How can Antivirus differentiate between a Trojan and a normal remote desktop application software?
RAT (Remote Access Tool, e.g. Sub7) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like NetSupport ...
1
vote
1answer
60 views
How non-executable are implemented? [duplicate]
In the "Hacking the art of Exploitation" its said that the basic idea of stack overflows attacks is that the operating system can't differentiate instructions from data inside the stack ,and the ...
3
votes
2answers
93 views
User privileges for unsanatized code
We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
11
votes
2answers
191 views
Why do browsers allow public websites to attack intranet sites?
When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
2
votes
3answers
72 views
Prevent request forgery attack
I don't know if I used the term correctly but basically this is the scenario:
I am working at an application witch on every computer install must make a request to a server notifying the server that ...
1
vote
2answers
132 views
How to stop a (malicious) endless loop
Few days ago someone tried to crack my site using a Remote File Inclusion attack.
The attack was blocked by my Web Application Firewall, but I was curious about the file.
So I downloaded it started to ...
15
votes
3answers
1k views
DNS Amplification DDOS attack
During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
-5
votes
1answer
173 views
How to find bugs/ vulnerabilities in web apps/sites? [closed]
What knowledge is needed?
What software is to be used?
How are the reports written? PS: Websites like facebook.com
2
votes
2answers
62 views
Will using SSL to secure Wordpress admin area only still actually be secure?
The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.
There ...
0
votes
1answer
263 views
Sanitizing JavaScript to prevent XSS
I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
3
votes
2answers
130 views
Defense against same origin attacks?
The Question:
How do I, as the victim, protect my site from being manipulated into doing something it's not supposed to, on a shared host? Same-Origin policy looks the other way. Most convenient ...
128
votes
12answers
18k views
How is an ATM secure?
I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since ...
3
votes
1answer
65 views
Where can I find articles about identity disclosure attack?
Where can I find more details about identity disclosure attack and it's prevention?
If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
-1
votes
1answer
89 views
Solutions to TCP FIN Host Sweep (Signature 3032)
The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
1
vote
2answers
578 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
3
votes
3answers
286 views
How to detect & prevent fake emails?
I hope This not same as this one
E-mail can be made to appear like it came from a big organization?
I'm not asking how to protect a brands & and large organizations (Google , yahoo, etc ..), ...
1
vote
1answer
180 views
CSRF with OAuth or Bearer Authorization headers
I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication.
I understand the concept of CSRF, and the mitigations proposed (I found both ...
2
votes
2answers
119 views
CSRF Login: can Attacker Login using valid credentials?
Considering this picture: taken from here:page21
Is this possible?
If so, How to prevent it?
3
votes
2answers
133 views
when to escape user input
I wonder when is the best way to handle escaping user input.
Two options come to my mind
1) User sends data to server we escape it and then store it into database
2) we store data as it is and ...
5
votes
3answers
224 views
Why must all classes' data members be set to private?
In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured".
How does setting members to private makes the program ...
3
votes
1answer
1k views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
2
votes
3answers
166 views
is it safe to allow external images to be attached to Blog or any Web content?
I am filtering all images that attached to any content of my blog:
Check for file extension.
Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE);
I also save the image temporary on my ...
2
votes
3answers
233 views
How dangerous is game guard?
Game guard is an anti-cheating application used with MMORPGs . I have read that such applications acts as rootkit over the pc. How dangerous it is to play MMORPGs that uses this application? How ...
0
votes
2answers
138 views
How can I encrypt something user provided without risk of the key being exposed?
So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
19
votes
2answers
522 views
How is “<scrscriptipt>” or “selselectect” used to avoid filtering?
A technique for avoid filtering of common words is the one I described in the title.
However, why does this technique work? SELECT isn't the same as SELSELECTECT for example.
1
vote
1answer
84 views
Compromised server with psyBNC - what are our next steps?
One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
4
votes
4answers
386 views
How to prevent attacks against client side validations?
I have a login form where am accepting Mobile Number of the User for login.
When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations ...
4
votes
4answers
167 views
Security risk of adding a HTTP Header with server identifier
We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
3
votes
2answers
222 views
Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
Suppose you have a system whose OS drive is encrypted with bitlocker and uses TPM + PIN authentication to authenticate the boot path against tampering. As I understand it, this setup theoretically ...
23
votes
6answers
1k views
Is there a difference between GET and POST for web application security?
I have 2 choices in sending data between 2 web applications.
I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters.
...
19
votes
3answers
994 views
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
1
vote
1answer
85 views
Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)
Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of ...
6
votes
2answers
191 views
Safe YAML parser?
I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
2
votes
1answer
113 views
Reflection Attacks on Server
I was reading a research paper entitled "Steps to Defend Against DoS Attacks" when I came across this point:
"A reflection attack on a server would require server-client-server
communication, ...
3
votes
1answer
583 views
What is the fail2ban default setting for SSH login attempts?
I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
1
vote
0answers
68 views
Are there any case studies for a large (think Twitter or Facebook) Web application vulvnerability so severe it caused a total shutdown of services? [closed]
I'm looking for either a case study, or an article from a news source that discusses the vulnerability and methods for recoverability.
4
votes
1answer
553 views
How does automated query compromise other Google users?
Sometimes when using TOR browser / tor proxy, Google refuses to process the request you issue, especially if it's in a different language (e.g. searching for Arabic word while using German proxy).
...
4
votes
3answers
241 views
System time and certificates
Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate ...
