prevention of an attack vector (e.g. XSS, HPP, CSRF)

learn more… | top users | synonyms

0
votes
1answer
127 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
0
votes
1answer
25 views

jquery $.post CSRF protection

How can I protect the following code from CSRF? $.post("lib/newEmployee.php",{employee_id: employee_id, employee_name: employee_name}, function (output){ //code }); ...
2
votes
0answers
46 views

Arbitrary methods directly callable with Front Controller pattern

I'm working on converting an application that uses the traditional Page Controller pattern to start using the Front Controller pattern. One of the potential problems I'm thinking about is that with a ...
1
vote
0answers
459 views

GnuTLS ServerHello exploit (CVE-2014-3466) - how to verify?

So pretty much all of the GNUTLS world is worrying about CVE-2014-3466. I checked my Kali and it responds with this - # apt-cache rdepends libgnutls26 | grep -v lib Reverse Depends: ...
1
vote
0answers
68 views

Neutralizing or Migitating ARP spoofing once detected

I've seen a few methods to detect ARP Spoofing attacks through code(such as this), and ways to defend against these attacks through software and switches (like arp spoofing protection on LAN). How ...
1
vote
0answers
100 views

Disable HNAP on D-Link router

I'm concerned that Home Network Administration Protocol (HNAP) is a serious vulnerability that exposes consumer network routers to remote management by malicious entities such as government ...
1
vote
0answers
176 views

Possible exploits for PHPword/ PHPexcel

I'm trying to identify what exploits to guard against when anonymous users generate reports with PHPword and PHPexcel (or similar libraries). Specifically, I'm worried about textarea inputs where ...
0
votes
0answers
50 views

How to minimize vulnerability to UI state interference attacks

Yesterday, Ars Technica posted an article explaining that Android was found to be vulnerable to a UI interference attack. This claim originates from a paper published by Alfred Chen et al. of the ...
0
votes
0answers
32 views

secure flash update

The default method for updating flash is through Adobe's unsecured http portal, which seems to be a serious security concern, given the access that flash has on a user's machine. Can anyone recommend ...
0
votes
0answers
21 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
0
votes
0answers
48 views

Old Tool: S.A.T.A.N. (a.k.a. S.A.N.T.A.)

Years ago computer security analysts Dan Farmer and Wietse Venema wrote the security program S.A.T.A.N.. Does anyone know what happened to it (or if it just went out of style) and what people ...
0
votes
0answers
52 views

Which enterprise-class DBMS allow forbiddance of (No)SQL comments?

This question could be renamed "Would forbidding SQL comments inside transactions prevent some SQL injections?", but I'd like to know if some DBMS allow this first. The goal is to reduce the attack ...