Attack vectors are methods and channels used by attackers during a hacking attempt.
33
votes
5answers
1k views
Why is application crash considered insecure?
If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again.
Crash is a bad behaviour in general and should be avoided, but why are ...
5
votes
2answers
725 views
What type of attacks can be used vs MongoDB?
I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
5
votes
1answer
142 views
Cufon or Prototype as an attack vector for Blackhole exploit kit?
I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
It's being detected as a Blackhole exploit kit inside of a Cufon ...
4
votes
1answer
153 views
Finding all AJAX entrypoints
Is there any tool to (automatically) find all backend JavaScript entrypoints within a site?
I have to check a site for vulnerabilities in the backend code that validates AJAX parameters and I would ...
3
votes
3answers
91 views
Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?
I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
3
votes
1answer
192 views
Odd user registered and strange behavior. Is it sinister?
I am running a number of web sites. They are all Drupal based, if that is relevant. Recently I have noticed something odd. All my sites have a user registered with the name "zctonglin". I presume ...
2
votes
1answer
159 views
ALERT - ASCII-NUL chars not allowed within request variables
In a Drupal site, I get this error in my Debian's syslog.
suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request
variables - dropped variable 'name' (attacker 'x.x.x.x', file
...
2
votes
2answers
116 views
CSRF Login: can Attacker Login using valid credentials?
Considering this picture: taken from here:page21
Is this possible?
If so, How to prevent it?
2
votes
1answer
467 views
What are the most common infection vectors for personal computers?
We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers?
A few example vectors:
Social engineering ...
1
vote
4answers
206 views
Can JavaScript be used to install malware?
Looking at the Pwn2Own contest got me thinking:
http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1
If you have all plugins turned ...
0
votes
3answers
296 views
Attack vectors opened simultaneous wireless and wired networks
I've seen some contention around the issue of whether or not wireless connections should be disabled in an environment where a wired domain and unregulated wireless network are both present.
What ...
0
votes
1answer
96 views
Automating tests for XSS in bash?
The book:"Web Security Testing Cookbook
By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
0
votes
0answers
115 views
What is the most successful attack vector? [closed]
I know this is an odd question, but out side of social engineering is there a single (or perhaps small group) of attack vectors that are responsible for most fiscal damage?
I'm not looking for a ...
