prevention of an attack vector (e.g. XSS, HPP, CSRF)
0
votes
1answer
37 views
How to specify a Snort rule connection duration?
Is it even possible to specify into a snort rule the duration of a connection?
For example: in this format Hour, Minute, Second
H, M, S = 0, 2, 1
If a connection that has the duration of 2 minutes ...
0
votes
1answer
205 views
Sanitizing JavaScript to prevent XSS
I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
0
votes
1answer
375 views
How to escape user input in a value of javascript object?
How to properly escape user-controlled input when it's inserted as a value in JSON object?
<script>
$(document).ready(function() {
new MyObject({
key1: "user_input",
key2: ...
0
votes
2answers
184 views
Any Books/Sites/Writeups on IRC bot Security?
I've written a scriptable IRC Bot and I want to harden it against exploits. To that end I've already written it so that it ignores its own messages (so that, for example, even if it echoes back valid ...
0
votes
0answers
106 views
KDD CUP'99 flag feature's trouble with prevension [closed]
In KDD CUP'99 dataset, "flag" feature refers to "normal or error status of the connection",
which should changes as the TCP connection state changes. However in the training dataset it refers to the ...
0
votes
0answers
35 views
more justification for the impact scores used by the national vulnerability database [duplicate]
Possible Duplicate:
why CVSS give a score of 0.66 for a full impact on CIA?
Good day ;
the CVSS attributes the following impact values for confidentiality, integrity and availability:
...
0
votes
0answers
519 views
Topics for undergrad thesis, suggestions please [closed]
I'm a CS university undergraduate student, currently in my last year of studies for my BSc (not MSc). Every student needs to submit a thesis in order to get the degree. I have the option to suggest a ...
-1
votes
1answer
155 views
Impact of attack occured in Radius, DHCP and HTTP servers on VOIP?
Assume we can crash the RADIUS server in a VOIP system. What would be the impact on the confidentiality, integrity, and availability of VOIP service. What would be the impact if the same question if ...
-1
votes
1answer
72 views
Solutions to TCP FIN Host Sweep (Signature 3032)
The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
-1
votes
1answer
286 views
MITM Attacks over SSL [duplicate]
Possible Duplicate:
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?
If I have a server (call it server 1) set up to receive ...
-1
votes
2answers
358 views
What can one define as quality criteria for an XML Schema?
One of the usage of Input validation, is to be protect against XSS. In case one would need to define best practice for the functions validating the input, then some (which I am calling quality ...
-2
votes
1answer
138 views
What do I need to worry about when moving from a compromised system to a clean one?
As a result of a targeted attack, my computer was compromised? What should I be worried about when trying to move to a new system and prevent reinfection?
I purchased a new clean computer and am ...
-3
votes
2answers
113 views
how to protect a personal computer? [closed]
I am Linux user with no knowledge on security , up to now i dont know that is my system was in attack or not . I havent felt anything wrong with my system . but every Computer user must have some ...
-3
votes
3answers
124 views
I use an online email provider - how can I test my password strength?
I want to test my password strength, is there a program out there that can crack my password relatively quickly? I am familiar with BackTrack 5, but I usually use it to test WEP password strength. I ...
-3
votes
0answers
73 views
My Evaluation on the Recent Honeywords Paper [closed]
I just read the paper "Honeywords: Making Password-Cracking Detectable" and have some thoughts about the reality and viability - as well as weaknesses of this approach.
My initial take is that this ...
-5
votes
1answer
122 views
How to find bugs/ vulnerabilities in web apps/sites? [closed]
What knowledge is needed?
What software is to be used?
How are the reports written? PS: Websites like facebook.com
