prevention of an attack vector (e.g. XSS, HPP, CSRF)

learn more… | top users | synonyms

4
votes
1answer
115 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
7
votes
1answer
466 views

How does ASCII-Armoring help to prevent buffer-overflow attacks?

I was reading about return-to-libc attacks at Wikipedia. According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
3
votes
1answer
269 views

Vim Modeline Vulnerabilities

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like: # vim: set someoption=somevalue and will then set those options. This is awesome if ...
2
votes
3answers
257 views

How good is validating source with request.referer than checksum?

I have 2 portals(both are under my control & domain names are different) In 1st portal, there is a link on click of which User can directly get logged into 2nd portal. Link which will be hit in ...
0
votes
1answer
70 views

How to specify a Snort rule connection duration?

Is it even possible to specify into a snort rule the duration of a connection? For example: in this format Hour, Minute, Second H, M, S = 0, 2, 1 If a connection that has the duration of 2 minutes ...
3
votes
2answers
390 views

What is the disadvantage of using spoofing protected version of ARP protocol

I read this article about man-in-the-middle arp poisoning and how it works , it seems that arp poisoning programs exploits the fact that ARP protocols trusts any packet to be true and modify its ...
2
votes
1answer
499 views

External network DNS spoofing

I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios: 1. ...
6
votes
4answers
616 views

How can Antivirus differentiate between a Trojan and a normal remote desktop application software?

RAT (Remote Access Tool, e.g. Sub7) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like NetSupport ...
1
vote
1answer
75 views

How non-executable are implemented? [duplicate]

In the "Hacking the art of Exploitation" its said that the basic idea of stack overflows attacks is that the operating system can't differentiate instructions from data inside the stack ,and the ...
3
votes
2answers
108 views

User privileges for unsanatized code

We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
12
votes
2answers
310 views

Why do browsers allow public websites to attack intranet sites?

When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
2
votes
3answers
87 views

Prevent request forgery attack

I don't know if I used the term correctly but basically this is the scenario: I am working at an application witch on every computer install must make a request to a server notifying the server that ...
1
vote
2answers
348 views

How to stop a (malicious) endless loop

Few days ago someone tried to crack my site using a Remote File Inclusion attack. The attack was blocked by my Web Application Firewall, but I was curious about the file. So I downloaded it started to ...
18
votes
3answers
5k views

DNS Amplification DDOS attack

During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
-6
votes
1answer
1k views

How to find bugs/ vulnerabilities in web apps/sites? [closed]

What knowledge is needed? What software is to be used? How are the reports written? PS: Websites like facebook.com
3
votes
2answers
251 views

Will using SSL to secure Wordpress admin area only still actually be secure?

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas. There ...
0
votes
1answer
587 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
3
votes
2answers
204 views

Defense against same origin attacks?

The Question: How do I, as the victim, protect my site from being manipulated into doing something it's not supposed to, on a shared host? Same-Origin policy looks the other way. Most convenient ...
147
votes
12answers
28k views

How is an ATM secure?

I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since ...
2
votes
1answer
108 views

Where can I find articles about identity disclosure attack?

Where can I find more details about identity disclosure attack and it's prevention? If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
-1
votes
1answer
828 views

Solutions to TCP FIN Host Sweep (Signature 3032)

The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
3
votes
2answers
4k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
3
votes
3answers
2k views

How to detect & prevent fake emails?

I hope This not same as this one E-mail can be made to appear like it came from a big organization? I'm not asking how to protect a brands & and large organizations (Google , yahoo, etc ..), ...
1
vote
1answer
876 views

CSRF with OAuth or Bearer Authorization headers

I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication. I understand the concept of CSRF, and the mitigations proposed (I found both ...
2
votes
2answers
602 views

CSRF Login: can Attacker Login using valid credentials?

Considering this picture: taken from here:page21 Is this possible? If so, How to prevent it?
4
votes
2answers
724 views

when to escape user input

I wonder when is the best way to handle escaping user input. Two options come to my mind 1) User sends data to server we escape it and then store it into database 2) we store data as it is and ...
5
votes
3answers
561 views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
5
votes
2answers
6k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
35
votes
4answers
5k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
4
votes
3answers
530 views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
2
votes
3answers
1k views

How dangerous is game guard?

Game guard is an anti-cheating application used with MMORPGs . I have read that such applications acts as rootkit over the pc. How dangerous it is to play MMORPGs that uses this application? How ...
0
votes
2answers
160 views

How can I encrypt something user provided without risk of the key being exposed?

So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
19
votes
2answers
634 views

How is “<scrscriptipt>” or “selselectect” used to avoid filtering?

A technique for avoid filtering of common words is the one I described in the title. However, why does this technique work? SELECT isn't the same as SELSELECTECT for example.
1
vote
1answer
207 views

Compromised server with psyBNC - what are our next steps?

One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
4
votes
4answers
987 views

How to prevent attacks against client side validations?

I have a login form where am accepting Mobile Number of the User for login. When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations ...
4
votes
4answers
329 views

Security risk of adding a HTTP Header with server identifier

We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
3
votes
2answers
566 views

Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?

Suppose you have a system whose OS drive is encrypted with bitlocker and uses TPM + PIN authentication to authenticate the boot path against tampering. As I understand it, this setup theoretically ...
31
votes
7answers
2k views

Is there a difference between GET and POST for web application security?

I have 2 choices in sending data between 2 web applications. I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters. ...
22
votes
3answers
2k views

Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?

I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
1
vote
1answer
112 views

Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)

Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of ...
6
votes
2answers
315 views

Safe YAML parser?

I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
2
votes
2answers
413 views

Attacks in SSL and SSH

Assume that we have two end-host A and B connected by two routers R1 and R2. A wants to send a large file to B. A decides to establish SSH connection with host B using public key authentication. ...
2
votes
1answer
145 views

Reflection Attacks on Server

I was reading a research paper entitled "Steps to Defend Against DoS Attacks" when I came across this point: "A reflection attack on a server would require server-client-server communication, ...
4
votes
1answer
5k views

What is the fail2ban default setting for SSH login attempts?

I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
4
votes
1answer
1k views

How does automated query compromise other Google users?

Sometimes when using TOR browser / tor proxy, Google refuses to process the request you issue, especially if it's in a different language (e.g. searching for Arabic word while using German proxy). ...
5
votes
3answers
2k views

System time and certificates

Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate ...
2
votes
1answer
258 views

White-Box Cryptography Questions and References

I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on. As far as I can tell, WBC has ...
12
votes
5answers
1k views

Securing a laptop against attacks (article)

I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
6
votes
3answers
669 views

How dangerous is it to use CSS styles from an untrusted source?

I'm a moderator at a forum. We want to have a new style for the forum. We're thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best ...
3
votes
3answers
302 views

Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?

I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...