Attack vectors are methods and channels used by attackers during a hacking attempt.
-5
votes
1answer
42 views
History of Buffer Overflow attacks and it's countermeasures? [closed]
I want to know the chronology of BoF attacks and it's countermeasures.
We know it's started about 1972, here's a hypothetical of it:
Buffer Overflow Simple (attack)
ASLR (Contermeasure)
ret2reg ...
-4
votes
0answers
59 views
10 Most Common Windows PC Attacks [closed]
I’m trying to make a list of the ten most common attacks a windows computer faces when attacked by an intentional hacker. What I mean by intentional hacker is someone who has set his sights on ...
3
votes
1answer
199 views
Odd user registered and strange behavior. Is it sinister?
I am running a number of web sites. They are all Drupal based, if that is relevant. Recently I have noticed something odd. All my sites have a user registered with the name "zctonglin". I presume ...
34
votes
5answers
1k views
Why is application crash considered insecure?
If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again.
Crash is a bad behaviour in general and should be avoided, but why are ...
2
votes
1answer
209 views
ALERT - ASCII-NUL chars not allowed within request variables
In a Drupal site, I get this error in my Debian's syslog.
suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request
variables - dropped variable 'name' (attacker 'x.x.x.x', file
...
0
votes
1answer
101 views
Automating tests for XSS in bash?
The book:"Web Security Testing Cookbook
By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
2
votes
2answers
119 views
CSRF Login: can Attacker Login using valid credentials?
Considering this picture: taken from here:page21
Is this possible?
If so, How to prevent it?
1
vote
4answers
242 views
Can JavaScript be used to install malware?
Looking at the Pwn2Own contest got me thinking:
http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1
If you have all plugins turned ...
4
votes
1answer
167 views
Finding all AJAX entrypoints
Is there any tool to (automatically) find all backend JavaScript entrypoints within a site?
I have to check a site for vulnerabilities in the backend code that validates AJAX parameters and I would ...
3
votes
3answers
102 views
Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?
I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
0
votes
3answers
321 views
Attack vectors opened simultaneous wireless and wired networks
I've seen some contention around the issue of whether or not wireless connections should be disabled in an environment where a wired domain and unregulated wireless network are both present.
What ...
5
votes
2answers
862 views
What type of attacks can be used vs MongoDB?
I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
5
votes
1answer
154 views
Cufon or Prototype as an attack vector for Blackhole exploit kit?
I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
It's being detected as a Blackhole exploit kit inside of a Cufon ...
0
votes
0answers
125 views
What is the most successful attack vector? [closed]
I know this is an odd question, but out side of social engineering is there a single (or perhaps small group) of attack vectors that are responsible for most fiscal damage?
I'm not looking for a ...
2
votes
1answer
494 views
What are the most common infection vectors for personal computers?
We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers?
A few example vectors:
Social engineering ...
