prevention of an attack vector (e.g. XSS, HPP, CSRF)

learn more… | top users | synonyms

4
votes
4answers
298 views

Security risk of adding a HTTP Header with server identifier

We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
4
votes
2answers
377 views

How effective is changing the MAC address?

Since every vendor has a MAC address range, and Apple has network card models that only they use (Airport), I suppose that it is very easy to identify a network package as coming from an Apple device, ...
4
votes
4answers
211 views

Attack where browser URL appears valid

I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an ...
4
votes
2answers
214 views

Escaping rich text editor output

When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
4
votes
2answers
244 views

FrameBusting script

It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to ...
4
votes
2answers
615 views

when to escape user input

I wonder when is the best way to handle escaping user input. Two options come to my mind 1) User sends data to server we escape it and then store it into database 2) we store data as it is and ...
4
votes
2answers
618 views

XSS prevention for RESTful services

A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
4
votes
4answers
3k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
4
votes
4answers
3k views

Detecting or preventing process memory injections on Windows (anti-hack)

Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call. The situation is like this: we are hosting a game server clients join ...
4
votes
1answer
684 views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
4
votes
1answer
1k views

How does automated query compromise other Google users?

Sometimes when using TOR browser / tor proxy, Google refuses to process the request you issue, especially if it's in a different language (e.g. searching for Arabic word while using German proxy). ...
4
votes
1answer
113 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
4
votes
1answer
5k views

What is the fail2ban default setting for SSH login attempts?

I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
4
votes
4answers
11k views

How to prevent my website from getting malware injection attacks?

My website was banned as a malware website by Google. When I checked the code, I found out that some code injected many files on my server. I cleaned everything manually, edited all files on my server ...
4
votes
1answer
191 views

Can I safely post the output of lspci, lsusb, lshw?

I'm having trouble with my SD card, and have been asked to inspect the output of tail -f /var/log/syslog, sudo lspci -v -nn, sudo lsusb, and sudo lshw. tail shows nothing when I insert the card, so ...
4
votes
2answers
164 views

How can my country's legal/telecoms environment protect against cold-callers conning a remote-access session to the victim's computer?

My local region in Australia is being targeted by a scam whereby victims are cold-called and told that their computer is sending 'errors' to caller at 'Windows' which should be fixed ASAP, and they ...
4
votes
2answers
93 views

SQL abstraction layer : A preventive mechanism for SQLi?

While performing a pentest for a Java based application I came across an SQL (actually HQL) error by simply putting a single quote in one of the request parameters and breaking the syntax of the ...
3
votes
2answers
3k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
3
votes
2answers
416 views

Are smart watches secure?

My Pebble smartwatch, like many (most?) other smart watches, uses Bluetooth Low Energy (Bluetooth Smart, BLE, BTLE, etc) to communicate with my smart phone. There's some security in the link, ...
3
votes
3answers
2k views

How to detect & prevent fake emails?

I hope This not same as this one E-mail can be made to appear like it came from a big organization? I'm not asking how to protect a brands & and large organizations (Google , yahoo, etc ..), ...
3
votes
3answers
800 views

What are methods for preventing browser hooking / drive-by downloads?

This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this. With the advent of BeEF and more and more of the computers in networks being infected just by ...
3
votes
3answers
409 views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
3
votes
2answers
189 views

Defense against same origin attacks?

The Question: How do I, as the victim, protect my site from being manipulated into doing something it's not supposed to, on a shared host? Same-Origin policy looks the other way. Most convenient ...
3
votes
1answer
6k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
3
votes
2answers
342 views

What is the disadvantage of using spoofing protected version of ARP protocol

I read this article about man-in-the-middle arp poisoning and how it works , it seems that arp poisoning programs exploits the fact that ARP protocols trusts any packet to be true and modify its ...
3
votes
2answers
169 views

How to demo a new 0-day security product?

We are a development team working on a new 0-day protection security product. We aim to protect against new unknown 0-days attacks against servers. We have a very strong solution ready to demo. The ...
3
votes
1answer
280 views

What steps need to do to identify security hole

I use VPS hosting. Installed CentOS 6 and ZPanel according to this tutorial http://www.zvps.co.uk/zpanelcp/centos-6 Received warning from hosting provider: This URL has been identified as a phishing ...
3
votes
3answers
455 views

How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)

After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out: Many of the websites severely restrict the size and ...
3
votes
3answers
273 views

Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?

I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
3
votes
1answer
386 views

Can format string exploit bypass the PaX protection?

I'm trying to find info regarding how format string exploit can bypass the PaX protection mechanism. As I understood PaX just features ASLR and NX protection. So I wonder if an attacker should use ...
3
votes
1answer
218 views

Vim Modeline Vulnerabilities

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like: # vim: set someoption=somevalue and will then set those options. This is awesome if ...
3
votes
2answers
105 views

User privileges for unsanatized code

We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
3
votes
2answers
502 views

Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?

Suppose you have a system whose OS drive is encrypted with bitlocker and uses TPM + PIN authentication to authenticate the boot path against tampering. As I understand it, this setup theoretically ...
3
votes
1answer
212 views

eBay account compromised/Credit Card used/Hosts files changed

To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
3
votes
1answer
176 views

What useful security reports can be extracted from a Windows-based machine and its' related logs?

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)? Assuming I can aggregate them into a report what ...
3
votes
1answer
241 views

3000 new contacts being added to gmail after receiving an email

Recently I realized that there are three thousand contacts with same name and email address in my Google contacts. The name belongs to an email that I have recently received and responded to, nothing ...
3
votes
1answer
82 views

Is it possible to verify identity of site that sent request to you?

I'm developing a JS widget that can be embedded by 3rd party websites. When widget is shown, it sends request to my site. When this request is received, I know that it was shown to the user and pay ...
2
votes
7answers
966 views

Which forensic techniques should I use to identify intrusion or monitoring of my computer or cellphone

If I suspect my computer or cellphone is being monitored by an unknown attacker, what tools or techniques could I use to detect or identify such monitoring?
2
votes
4answers
192 views

How is “security word” safe from man in the middle attack?

In this bank site I read the following lines Item #2 - You will also need to create a "Security Word". This allows you to verify that you have reached our Internet Banking site, and not some other ...
2
votes
3answers
269 views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
2
votes
3answers
1k views

How dangerous is game guard?

Game guard is an anti-cheating application used with MMORPGs . I have read that such applications acts as rootkit over the pc. How dangerous it is to play MMORPGs that uses this application? How ...
2
votes
3answers
86 views

Prevent request forgery attack

I don't know if I used the term correctly but basically this is the scenario: I am working at an application witch on every computer install must make a request to a server notifying the server that ...
2
votes
2answers
385 views

Attacks in SSL and SSH

Assume that we have two end-host A and B connected by two routers R1 and R2. A wants to send a large file to B. A decides to establish SSH connection with host B using public key authentication. ...
2
votes
2answers
672 views

Is Drupal's filter_xss enough for filtering HTML?

Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input? If not, what should be used instead when using Drupal 7? This questuion is a duplicate of Drupal's built-in ...
2
votes
2answers
3k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
2
votes
3answers
447 views

What are the risks of a rogue Access Point? What lessons can be learned from the Wifi Pineapple?

I'd like to educate colleagues and peers on rogue access points using the tool "Wifi Pineapple". What are some specific security-related lessons I could demonstrate? If applicable, what are the ...
2
votes
3answers
1k views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
2
votes
1answer
125 views

Why don't servers vulnerable to NTP and DNS reflection attacks get blacklisted immediately?

With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore ...
2
votes
1answer
85 views

Risks and prevention methods associated with flagging or downvoting?

Similar to bots posting spam posts and blogs is it possible that bots with legible registered accounts go around the site flagging or downvoting everything on the site. If yes, what can I do to ...
2
votes
1answer
75 views

Server Detection Vectors

I have a web server, and I would like to anonymise it as much as possible, to prevent unreported exploits directed at my web server (original cracks). My ideas: change server header customize 404 ...