Attack vectors are methods and channels used by attackers during a hacking attempt.

learn more… | top users | synonyms

3
votes
2answers
60 views

How does infection through web surfing work?

Often I read about compromise due to visit a malicious site which download some exploit to your computer. I've never seen a detailed process, all books/tutorials I read just say sentences like "once ...
2
votes
1answer
96 views

What is this attacker trying to accomplish?

My client is who is running a recent version of vBulletin is getting lots strange activity and I'm at a loss to explain what the attacker is trying to accomplish. The attacker registers a fake user ...
1
vote
1answer
69 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
16
votes
4answers
4k views

Can the Windows Schannel vulnerability be exploited by visiting a website?

Microsoft has just patched a vulnerability in Schannel that could allow remote code execution (MS14-066). What I can't find are any reliable details on how this can be exploited. I've seen some people ...
4
votes
1answer
96 views

Use of JavaScript by LastPass to encrypt & decrypt the password database a secure approach?

LastPass is a top-rated password manager that comes as a browser extension and uses a master password to encrypt and decrypt the password database using the JavaScript. Is this a secure way of doing? ...
3
votes
2answers
107 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
2
votes
1answer
125 views

Malicious *URLs*?

Everyone says not to click on "malicious URLs". Are there any attacks where the URL itself, rather than the resource accessed by the URL, is the attack vector?
1
vote
1answer
55 views

How can non-secure or non-https-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and https-only and remaining 5 are neither. In this scenario, in what all ways can we ...
3
votes
0answers
939 views

Comprehensive list of shellshock attack vectors [closed]

Currently I know of three serious attack vectors: crafted cgi parameters from a web client dhclient getting crafted hostnames from a DHCP server restricted SSH users getting full shell access I ...
3
votes
1answer
115 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
0
votes
0answers
262 views

How are you able to inject bash script through the user agent

I was looking over the new Bash exploit and was looking at this post in particular. Attack scenarios of the new Bash vulnerability What I don't understand is how does including bash in the ...
20
votes
1answer
8k views

Attack scenarios of the new Bash vulnerability [duplicate]

Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test". What yet I haven't understand is, what ...
1
vote
1answer
108 views

Worst-case scenario OPEN URL REDIRECTION and why google not covering it in bug bounty

OPEN URL REDIRECTION as per in my opinion can be proved very dangerous by crafting attacks such as phishing. But it seems like google thinks it as a very low level bug and does not provide any ...
1
vote
1answer
43 views

Remote Auditing a Secure WiFi Network-Obtaining enough of the Secured-Network credentials to attack without being in range of WiFi

I was wondering if there are any methods I'm unaware of that will allow an attacker to attempt to obtain WiFi access outside the physical range of the WiFi signal. When using net-stumbler or any ...
0
votes
1answer
136 views

rolling code & keyless entry system [closed]

The security industry typically uses rolling code algorithms to authenticate sender & receivers in keyless entry systems, which is called RKE (ex: KeeLoq). In key-less smart key car system, The ...
1
vote
2answers
74 views

If TLS compression is not supported is a site still vulnerable to attacks such as BREACH?

I have read that BREACH was a side channel compression attack against TLS however focuses on HTTP response compression. If a site has disabled support for TLS compression does that still mean it can ...
2
votes
3answers
204 views

What risks am I taking with a weak password on a laptop?

I'm setting up a Mac laptop for my wife. Mine has a ridiculously strong password, but she finds this annoying. If I give her a (relatively) weak password for convenience, what risks am I taking? A ...
4
votes
4answers
1k views

Is this an attack and how can I fix it?

I don't know where to start in searching the forum for existing threads that might cover my issues. I recently received a spoof email pretending to be from a client for whom I've just started to do ...
1
vote
2answers
154 views

Teamviewer Security Question

Currently we are using Teamviewer 9. We have a couple of desktop machines that are locked down in the following manner: 1). The shell is no longer explorer.exe, it is a custom program we have ...
0
votes
0answers
44 views

What attack vectors are there for a stand-alone saltstack minion?

I'm interested in using SaltStack in stand-alone minion mode as a way of automating the various configs that I want to do for my personal dev environment. But as a good security conscious dev, what ...
0
votes
1answer
61 views

Attacks to jump from SQL server to Web server, without direct network access?

Considering that I have a structure like the following, allowing only the TCP and UDP ports for SQL to be accessed. Specifically no traffic initiated from SQL is allowed to reach SECURE. SECURE-> ...
2
votes
2answers
144 views

Are there any attack vectors for a printer connected through USB in a Windows Environment?

I have the potential for a printer to be connected through USB and through a network cable at the same time. The USB would be connected directly to a computer which is part of a private network. ...
16
votes
3answers
1k views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
4
votes
1answer
101 views

Un-redacting analog redactions on variable width fonts?

The FBI currently prints and redacts documents using analog mechanisms. I'm curious to know if anyone has ever researched the accuracy of inferring the possible words or names. Certainly, given the ...
2
votes
3answers
216 views

hiding javascript in image

I have read a post in thehackernews and searched the net to find how it worked. How can anyone add javascript in an image such that when the image is displayed it can run a script. Can this be done ...
1
vote
1answer
196 views

PHP and max_input_vars configuration

I am looking into php's max_input_vars setting How many input variables may be accepted (limit is applied to $_GET, $_POST and $_COOKIE superglobal separately). Use of this directive mitigates ...
0
votes
1answer
239 views

RAM memory data remanence and double boot, risky?

I wonder if my setup can be risky. To give a good starting point for answers I would briefly sketch the situation setup: double boot system GNU/Linux and Microsoft Windows GNU/Linux is on 2 ...
2
votes
3answers
622 views

Is there a way to exploit unused GET POST parameters in web application?

So there is an application that accepts some data from the outside. Assuming that it accept only finite number of different POST/GET parameters and the application is correctly handling all the data ...
1
vote
1answer
125 views

Are Internet speed tests an attack vector?

I've been performing lots of speed tests lately due to, among some other random things, an Internet programming class and getting Google Fiber hooked up. Then I realized that SpeedTest.net uses a ...
2
votes
2answers
124 views

Are there any known attacks for a laptop with the wifi connection turned off?

I recently got a new laptop. As I usually do, I removed the wifi module from it, since I intend to use it in public places such as my college and I don't need any sort of connectivity outside my home. ...
-2
votes
1answer
132 views

Commonly used url parameters [duplicate]

I'm working on a project that requires me to tamper with/rewrite url parameters. I'd also like to add in something that finds request parameters such as ?admin=false ?debugging=false ?page=example ...
1
vote
1answer
223 views

Any risk of email configured for pop/imap access?

If my mobile phone is infected with some malware and the only connection I have to my corporate network is that the email client in the phone is configured for mail (pop/imap), what would be the risk ...
2
votes
1answer
79 views

Server Detection Vectors

I have a web server, and I would like to anonymise it as much as possible, to prevent unreported exploits directed at my web server (original cracks). My ideas: change server header customize 404 ...
8
votes
1answer
1k views

Cross site scripting and the use of http-only cookies?

I have been a developer and now I am trying to look at XSS from the point of view of a developer. I was thinking of a particular case of reflected XSS . Let us say we have a vulnerable website and if ...
3
votes
2answers
2k views

Exploiting HTTP content in HTTPS page [closed]

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content (say, https://Secure-Site.com loading an image from http://Not-A-Secure-Site.com) ...
3
votes
1answer
233 views

Odd user registered and strange behavior. Is it sinister?

I am running a number of web sites. They are all Drupal based, if that is relevant. Recently I have noticed something odd. All my sites have a user registered with the name "zctonglin". I presume ...
42
votes
7answers
2k views

Why is application crash considered insecure?

If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again. Crash is a bad behaviour in general and should be avoided, but why are ...
2
votes
1answer
1k views

ALERT - ASCII-NUL chars not allowed within request variables

In a Drupal site, I get this error in my Debian's syslog: suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'name' (attacker 'x.x.x.x', file ...
0
votes
1answer
289 views

Automating tests for XSS in bash?

The book:"Web Security Testing Cookbook By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
2
votes
2answers
669 views

CSRF Login: can Attacker Login using valid credentials?

Considering this picture: taken from here:page21 Is this possible? If so, How to prevent it?
1
vote
4answers
2k views

Can JavaScript be used to install malware?

Looking at the Pwn2Own contest got me thinking: http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1 If you have all plugins turned ...
4
votes
1answer
244 views

Finding all AJAX entrypoints

Is there any tool to (automatically) find all backend JavaScript entrypoints within a site? I have to check a site for vulnerabilities in the backend code that validates AJAX parameters and I would ...
3
votes
3answers
321 views

Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?

I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
0
votes
3answers
672 views

Attack vectors opened simultaneous wireless and wired networks

I've seen some contention around the issue of whether or not wireless connections should be disabled in an environment where a wired domain and unregulated wireless network are both present. What ...
5
votes
1answer
338 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
2
votes
2answers
2k views

What are the most common infection vectors for personal computers?

We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers? A few example vectors: Social engineering ...