Attack vectors are methods and channels used by attackers during a hacking attempt.
3
votes
1answer
192 views
Odd user registered and strange behavior. Is it sinister?
I am running a number of web sites. They are all Drupal based, if that is relevant. Recently I have noticed something odd. All my sites have a user registered with the name "zctonglin". I presume ...
33
votes
5answers
1k views
Why is application crash considered insecure?
If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again.
Crash is a bad behaviour in general and should be avoided, but why are ...
2
votes
1answer
152 views
ALERT - ASCII-NUL chars not allowed within request variables
In a Drupal site, I get this error in my Debian's syslog.
suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request
variables - dropped variable 'name' (attacker 'x.x.x.x', file
...
0
votes
1answer
94 views
Automating tests for XSS in bash?
The book:"Web Security Testing Cookbook
By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
2
votes
2answers
116 views
CSRF Login: can Attacker Login using valid credentials?
Considering this picture: taken from here:page21
Is this possible?
If so, How to prevent it?
1
vote
4answers
199 views
Can JavaScript be used to install malware?
Looking at the Pwn2Own contest got me thinking:
http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1
If you have all plugins turned ...
4
votes
1answer
150 views
Finding all AJAX entrypoints
Is there any tool to (automatically) find all backend JavaScript entrypoints within a site?
I have to check a site for vulnerabilities in the backend code that validates AJAX parameters and I would ...
3
votes
3answers
88 views
Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?
I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
0
votes
3answers
295 views
Attack vectors opened simultaneous wireless and wired networks
I've seen some contention around the issue of whether or not wireless connections should be disabled in an environment where a wired domain and unregulated wireless network are both present.
What ...
5
votes
2answers
685 views
What type of attacks can be used vs MongoDB?
I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
5
votes
1answer
138 views
Cufon or Prototype as an attack vector for Blackhole exploit kit?
I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
It's being detected as a Blackhole exploit kit inside of a Cufon ...
0
votes
0answers
115 views
What is the most successful attack vector? [closed]
I know this is an odd question, but out side of social engineering is there a single (or perhaps small group) of attack vectors that are responsible for most fiscal damage?
I'm not looking for a ...
2
votes
1answer
460 views
What are the most common infection vectors for personal computers?
We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers?
A few example vectors:
Social engineering ...
