An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

learn more… | top users | synonyms

2
votes
1answer
54 views

Is a 'remote' cookie replay attack possible?

Once a cookie is stolen from the session of a legitimate user, can I perform a 'remote' cookie replay attack on that user? I am successfully able to perform a cookie replay attack on the same system, ...
4
votes
5answers
225 views

What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?

In attacks on programs, such as stack buffer overflows, what is the objective of the attacker? I’m having trouble learning the technical details of the attack (such as overwriting the function’s ...
0
votes
1answer
102 views

Mobile phone tracking, identification of the attacker [closed]

Once I was told that you can identify if your mobile phone is being tracked by someone (e.g. police), by calling placing a specific prefix to the number. This prefix in my country is normally reserved ...
3
votes
1answer
2k views

LogJam hardening OpenSSH and testing it [duplicate]

I would like to harden my OpenSSH (clientsite) after the LogJam attack. I read this article https://weakdh.org/sysadmin.html and there is one paragraph, which says how to do that. Is this enough and ...
1
vote
1answer
122 views

Must an attacker using a Smurf attack be on the same network as the victim?

I'm learning about Smurf Attacks. Since they need to use a broadcast address, doesn't that mean they can't work over the internet? For example if an attacker sends a router the packet with the ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
8
votes
4answers
51k views

How safe is the 256-bit encryption used in bank transactions?

Most of the banks use a 128-bit or 256-bit encryption. What does this mean? Does it mean that the keys used in SSL are 128-bit long or what? If they are the SSL key lengths then 128 bit RSA keys are ...
12
votes
5answers
3k views

How can I help catch an email scammer who is contacting me?

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
6
votes
2answers
102 views

Is there a formal common Internet threat model?

I'm looking for a common Internet threat model that describes active attacks formally. By active attacks I mean attacks of an attacker with literally unlimited resources and full control over the ...
0
votes
1answer
73 views

Man in the middle attack on loopback

We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?
0
votes
1answer
220 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
5
votes
1answer
104 views

Dragnet TEMPEST Surveillance?

Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being ...
1
vote
1answer
111 views

Does NDP (Neighbor Discovery Protocol) reduce ARP (Address Resolution Protocol) attacks?

I read the comparison of NDP with ARP but am uncertain if NDP does reduce any amounts of ARP attacks, given that with NDP, ARP is not used for address resolution. For the discussion to be specific, ...
2
votes
1answer
69 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...
12
votes
4answers
2k views

How was (is?) the ping of death attack possible with IPv4?

While reading about Internet Protocol, I found myself reading about ping of death attacks: the thing that attracted my curiosity was the fact that these attacks could ever work! I mean, why wasn't ...
3
votes
1answer
57 views

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates Never deploy a site into production with DEBUG turned on. Did you catch that? ...
1
vote
3answers
486 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
20
votes
4answers
4k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
-3
votes
1answer
39 views

LFI attacks auth.log , environ , passwd [closed]

paths like /proc/self/environ , /etc/passwd and /var/log/auth.log are targeted by the attackers. how can I hide those files ( passwd ) ( environ ) ( auth.log ) to be not include in LFI attack
1
vote
3answers
195 views

Can man-in-the-middle attacks affect anyone not connected to the attackers network?

I'm trying to understand what these attacks are restricted to. I'm aware that man-in-the-middle attacks can be done if the attacker is on the same network (using something like Wire Shark), but is it ...
1
vote
2answers
40 views

Access LAN services through malicious web page

Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an ...
0
votes
1answer
43 views

Can I modify a ciphertext created in AES with OFB mode?

Suppose a service uses AES to encrypt Cookies, of the form user=username+padding,tmstmp=timestamp where tmstmp is the expiration time and +padding is a series of zeroes to make the total length be ...
7
votes
2answers
7k views

Yahoo mail hacked - how to recover, how did it happen and how to prevent?

I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like firstnamelastname@spacepc.pt and firstnamelastname@revistaplot.com with ...
3
votes
1answer
186 views

What is a sequential injection attack?

From the Financial Times 26th October 2015 "TalkTalk faces mounting calls for compensation" Then, the hackers downloaded customer data using a “sequential injection”. Cyber security experts say ...
11
votes
4answers
2k views

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?

If for example I have Magento-eCommerce and WordPress installed on the same server. Both have a database each with a different database username/password and both have different login details to the ...
-2
votes
1answer
56 views

What is a transient attack?

I just faced a problem of an IP is taking forever to respond, i had been told it might be a transient attack.... I tried googling it, but cant really find more info. Can anyone kindly explain to me ...
4
votes
3answers
2k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
3
votes
1answer
127 views

What sort of attack can reset MySQL Privileges and unmount remote drives without root or shell?

ATTACK VECTOR Monthly hits via a globally DDoS attack. Resolved with Cloudflare. Attacker can now somehow unmount network drive links and reset MySQL user permissions for applications. Attack is ...
0
votes
0answers
76 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
2
votes
1answer
27 views

Revoking AIK Key

How can I prevent attacks via compromised Attestation Identity Key (AIK) keys, such as having an attacker forging the cryptographic signature of an AIK key on TPM?
0
votes
0answers
54 views

CPU instruction encoding on x86 that is free from ROP attacks

x86 has a dense instruction encoding, and thus enables ROP attacks. Are there any CPU instruction encoding schemes that are free from these attacks?
2
votes
1answer
73 views

Defeating code injection attacks in x86

In x86 systems, there are three requirements for a code injection attack to work: write attack payload to memory attack payload to be executable divert control-flow to payload How can we prevent ...
6
votes
1answer
224 views

AES-ECB chosen plaintext attack with long secret

I'm having some trouble understanding the methodology for a crypto exercise I'm doing. The goal of the exercise is to recover an encrypted secret string through a chosen key attack on AES in ECB mode. ...
1
vote
2answers
90 views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
11
votes
8answers
18k views

Is it possible to steal money directly from the systems of a big bank?

Sometimes I imagine: My money in the bank is just a floating point number in a mainframe's memory... So, if I just change 1 bit, I will win a lot of money... The most common way to steal money in ...
1
vote
1answer
94 views

Does adblockers(ublock) protect you from Malvertisement?

With malvertisement on the rise, I was wondering if it's as easy to protect yourself from it by just using an adblocker like ublock origin?
0
votes
1answer
257 views

Was I hacked remotely, how could I find out? Windows 7

I was cleaning out my old windows 7 HP desktop computer approximately 5 months ago. There was only the expired Norton 360 as far as antivirus and no firewall. Up until this point I disabled the wifi ...
6
votes
3answers
591 views

Random URL string: What kind of attack is this, and what can be done to stop it?

EDIT: It's been a little while since this was posted, but I'm here to report that this does NOT appear to have been some sort of attack after all. Rather, this particular URL string indicates a ...
-3
votes
1answer
48 views

What threats involve in cache miss

What are the possible consequences of a cache miss? In other word, is it possible that a cache miss could cause a security threat? Thank you.
1
vote
1answer
42 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
2
votes
2answers
72 views

Violation of security principles?

It's clear that keyless entry fobs, smart entry cards, NFC, etc. are vulnerable to relay attacks. Suppose they were improved by limiting the period of activity, eg let them be active only when they ...
2
votes
3answers
165 views

What prevents a coder from brute forcing a wifi?

I know that a coder is able to connect to a wifi through code so my question is: Is there anything that will make it difficult to brute force a wifi password?
2
votes
2answers
296 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
2
votes
1answer
127 views

How can an attacker redirect victims through proxy

Let's say that an attacker is behind a proxy that's using NAT or PAT. Is it possible for him to redirect victims to his machine to achieve some attacks like web phishing or opening reverse TCP ...
3
votes
1answer
172 views

Challenge: How to find the secret key in homebrew MAC/keyed hash: sha1(key + cookie)?

I am trying to solve a security challenge on a website. Basically, the website computes sha1(key + cookie) to sign a cookie so that the user can't change it himself, and to accomplish the goal you ...
4
votes
3answers
259 views

Passwords propagation, Password Trend and Word Generator in Human Mind

Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits. The users seem to pick up the password suggestions or just copy the ...
13
votes
3answers
4k views

Can you extract memory contents from a hibernated Windows machine?

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk. When ...
19
votes
6answers
3k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
1
vote
3answers
134 views

CRIME attack - If Javascript can be injected on the attacked machine, why not directly sending the cookie to a remove server?

I read about the CRIME - How to beat the BEAST successor? question and answer, but I don't understand that: If Javascript can be injected and run on the attacked machine, why not directly sending the ...
5
votes
2answers
255 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...