An attempt by a threat to exploit a weakness in a system.
0
votes
1answer
49 views
Attacking what isn't normally accessible [closed]
I would like to know if it is possible, without social engineering, to attack, pentest and get into infrastructures that are normally considered to be extremely secure and well protected: all the ...
3
votes
3answers
551 views
Is there a method to detect an active man-in-the-middle?
Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked?
I think one of my friends is a victim of this kind of attack. How can I be ...
13
votes
4answers
938 views
Security risks of scanning an unknown QR code
What are the security risks of scanning a QR code from an untrusted source?
If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
12
votes
2answers
2k views
How to exploit HTTP Methods
Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack.
What do ...
2
votes
2answers
185 views
Can an attacker slow down my server without compromising it?
We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now.
Yesterday, the server became unresponsive (it was definitely there though) for around an hour. ...
3
votes
3answers
357 views
Wireless security attack techniques
Before I ask for some advice, please don't assume I'm a script kiddie or such. This is for one of my wireless security class (CSS 1015).
It's a Saturday class and only 6 students are in the class ...
1
vote
2answers
202 views
Wireless LAN router fingerprinting
Does anyone know of a database that lists the range of MAC addresses that are assigned to each particular brand of router? I would like to use this information for fingerprinting.
I know I can find ...
4
votes
1answer
233 views
How secure is NFC on mobile devices?
Near field communication is becoming more commonly available in modern mobile devices, such as smartphones and tablets. This functionality can be used to communicate between such devices, or with ...
1
vote
1answer
282 views
Are there Bluetooth attacks on Smartphones that will not notify the user of the attack?
Are there Bluetooth attacks on Smartphones that will not notify the user of the attack?
Specifically forcing a reset or opening an application.
2
votes
1answer
164 views
Can JavaScript defeat source port randomization?
Can malicious JavaScript defeat source-port randomization in browsers?
I am reading a research paper which seems to claim that the answer is yes:
many browsers seem to always assign a random ...
3
votes
1answer
109 views
Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?
Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
2
votes
1answer
93 views
Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?
There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
4
votes
1answer
104 views
Computational Feasibility of finding 'Good Links' of the following format
I recently stumbled upon this and am checking here to see if what I am proposing is indeed feasible and can be considered a breach of privacy.
For obvious reasons I am not revealing the website ...
4
votes
2answers
337 views
Memory Dumping - Cause for concern in Virtualization?
Recently, I started exploring threats to Virtual machines in general. The first question that popped into my head was whether a host machine can dump its entire memory onto a file, and inspect the ...
7
votes
2answers
157 views
How to mitigate the risk of a continuous integration service security breach?
We are using a Continuous Integration service to automatically run our product test suite. Every time we push code to our central Git repository production branch, the CI services is notified and ...
-4
votes
4answers
257 views
Should companies use Crowd Source Audit Platform for Manual Penetration Test?
As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues?
LE: So most of you guys downgrade, and said it's wrong to have ...
3
votes
3answers
245 views
TLS Renegotiation Indication Extension vulnerability
I am trying to understand the TLS Renegotiation Indication Extension from the RFC.
I can understand that it is related to the fact that the renegotiation is send under the encrypted stream but can not ...
3
votes
2answers
449 views
How to use attack trees and attack graphs
I am trying to understand how attack trees\graphs can be used in the security process. I read a lot of papers presenting the topic and how this reppresentation can be useful, but I really don't ...
8
votes
5answers
1k views
Access to a router's GUI
During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router.
I realise that someone could log on and be annoying to ...
8
votes
4answers
599 views
Automated encryption detection
Is there any program that, given a cipher text, it would tell me what the encryption algorithm is?
What if I have the plain text? Is there something that can be done in that case?
6
votes
1answer
500 views
How can an admin choose which Snort rules to enable?
The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection
attacks, port ...
2
votes
2answers
302 views
Is it a weakness to be able to see server side scripting?
Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction.
CLARIFICATION: ...
4
votes
2answers
140 views
Most secure response for a server to return to a user scanning for exploits
I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc.
Currently these requests all return 404 because ...
3
votes
2answers
652 views
I'm currently receiving a targeted attack
Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites:
http ...
17
votes
7answers
739 views
Are common passwords at particular risk?
The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
0
votes
0answers
69 views
How to decode this runforestrun gootkit [closed]
Infected site is hxxp://www.infraredpsi.com/Pluginlab/Scripts/menuscript.js
online scan result:
http://urlquery.net/report.php?id=141893
I can de-obfuscate the first layer of the code that use the ...
4
votes
3answers
311 views
VGA/HDMI Based Attack
Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side?
How about HDMI or DVI?
And if so, are there known malware or PoCs to do that? or is it theoretically ...
-1
votes
1answer
60 views
What are the supported versions of RHEL 5 by the NSA?
I have read through the document found at,
NSA RHEL5 Security Requirements
In reading through the document, it seems that you can use any version of RHEL 5 as long as it supports the requirements in ...
1
vote
2answers
492 views
SUN Remote Procedure Call Port 111 [closed]
I have found on my machine port 111 is open. This is listed as RPC.
I understand there are possible attacks on this port. How can my machine be attacked if port 111 is open?
How can I secure this ...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
1
vote
1answer
130 views
Limiting database security
A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
7
votes
1answer
493 views
How to make SQL injection in PostgreSQL's tsquery?
I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format:
PHP raised unknown ...
10
votes
2answers
733 views
Security of Log Files - Injecting malicious code in Log files
As part of my course project I'm trying to understand various security frameworks and best practices.
One of the very popular approach is to maintain Logs. My question is about the security of the ...
-1
votes
4answers
3k views
SQL injection for a username/password form?
This is how user validation happens on my site:
if(!empty($_POST['username']) && !empty($_POST['password']))
{
$query = "SELECT * FROM users WHERE username='".$_POST['username']."' ...
2
votes
4answers
212 views
Can public keys be a security risk when performing password-less SSH logins?
Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins.
The servers being checked put the public key of ...
3
votes
2answers
147 views
Ftp constantly asked for a .exe file, what can i do?
I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
15
votes
4answers
1k views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
1
vote
1answer
515 views
HTTPS and cache injection
I understand the downside of this attack and what wrong can be done.
But I dont understand how is it done ?
Well, I need to educate myself, any pointers would be useful.
2
votes
1answer
2k views
How to Prevent This `Intrusion.Win.MSSQL.worm.Helkern`?
Sometimes my kaspersky Internet Security blocks this attack.
What is this and how can I prevent/solve it for ever?
1
vote
1answer
126 views
What are security risks of serving user uploaded files without Content-Disposition?
Imagine a server that serves untrusted user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without ...
5
votes
2answers
913 views
Need help identifying the OSX process that's generating strange network traffic
Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like:
Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
0
votes
2answers
436 views
How to encode letters in multipart/form-data to include CR/LF characters?
Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:
------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
...
2
votes
3answers
3k views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
1
vote
1answer
411 views
How to fix the audit failure in our web server
We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.
Can anybody help me how to isolate and prevent this from happening?
An ...
0
votes
1answer
455 views
Is this Ubuntu server configuration secure?
I'm new to Linux and security matters. I have a vps with Ubuntu 12.04 server and I wonder how secure this server is.
I set up ssh passwordless login and disabled ssh login for root. I update security ...
31
votes
8answers
2k views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
1
vote
3answers
811 views
MITM: tools for intercepting and modifying traffic?
I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request.
For example:
When I receive a request on port 25, I want to be able to intercept all the ...
3
votes
2answers
728 views
SMS / voice call interception with a fake base station
This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...
1
vote
1answer
2k views
How to use http-get-form in THC-Hydra?
I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App"
brute force section but the problem is when I use http-get-form it said:
Warning: child 1 seems to have died, ...
5
votes
5answers
1k views
What password cracking software is commonly used?
I am curious to know how secure my passwords are.
What password cracking software is commonly used?
Preferably open source.
EDIT: I am actually looking to crack my passwords used on services I ...
