An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

learn more… | top users | synonyms

0
votes
0answers
30 views

Is there a way for someone to block an email from reaching its recipient?

I don't know if this can be done with people who can email spoof your contacts but I've been noticing that my emails just aren't getting to where it needs to go. In the same vein, I also don't get ...
3
votes
1answer
102 views

How can I mitigate against chosen plaintext attacks for AES ECB?

I am developing on a platform where my only encryption option uses AES ECB. The encryption is used to protect parameters that the user can set, and so it susceptible to a chosen plaintext attack. It'...
61
votes
8answers
14k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
3
votes
1answer
88 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-...
32
votes
3answers
32k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
2
votes
2answers
7k views

Break in attempts from secureserver.net

Over the last few weeks I have seen dozens if not hundreds of break-in attempts from ip addresses which map back to secureserver.net. I know these are GoDaddy machines from the who is look up. ...
1
vote
0answers
56 views

How to find which domain in my VPS triggered a DDoS attack with WP xmlrpc

Today, my data center suspended my VPS for DDoS attack reasons. They say one of my clients, that has WordPress website, started a DDOS attack to another websites using xmlrpc. But I don't know which ...
12
votes
2answers
182 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS ...
2
votes
1answer
111 views

Security implications of the contents of /proc/self/environ in LFI attacks

During penetration testing on a website, the tests have found a local file inclusion vulnerability in an old wordpress plugin that was installed. An attacker can exploit the LFI vulnerability to ...
4
votes
1answer
286 views

Antivirus constantly detecting tmp files as threats

Recently my antivirus has been constantly detecting threats and it's always tmp files. I delete maybe 50 of these files each day. A few days ago it detected a trojan. Last week it detected many '.json'...
1
vote
4answers
281 views

How to find public IP, if it replaced by NAT IP?

I designed a network architecture in cloud. I placed first IPS and then firewall (with Nat). I want to know if some attacks gone to internal networks which are not blocked by IPS. But I think these ...
-4
votes
1answer
130 views

I've been hacked what do I do? [closed]

I believe I may have been hacked, However I am not certain of this. I fear they are able to access my computer remotely. I have done several checks with advice from people online and it to some extent ...
8
votes
3answers
22k views

How to prevent my website from getting malware injection attacks?

My website was banned as a malware website by Google. When I checked the code, I found out that some code injected many files on my server. I cleaned everything manually, edited all files on my server ...
8
votes
1answer
137 views

Got a spam mail with an htm attachment, is the script harmful?

Today I got an email with an htm attachment, the mth contains the below code: <html> <head> <script> var url = "" window.location.href= url; ...
1
vote
1answer
114 views

What was the purpose of this attack if one took place?

Background Windows 7 Home Edition HP desktop (no av/no firewall/ remote assistance enabled) two external drives attached/no documents on internal drive connected to fios wifi (wep protection/...
1
vote
2answers
177 views

Router or Switch can defend against ARP spoofing attack?

I'm learning about ARP spoofing attacks. Can a router or switch defend against ARP attacks?
2
votes
1answer
60 views

Is a 'remote' cookie replay attack possible?

Once a cookie is stolen from the session of a legitimate user, can I perform a 'remote' cookie replay attack on that user? I am successfully able to perform a cookie replay attack on the same system, ...
4
votes
5answers
232 views

What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?

In attacks on programs, such as stack buffer overflows, what is the objective of the attacker? I’m having trouble learning the technical details of the attack (such as overwriting the function’s ...
0
votes
1answer
112 views

Mobile phone tracking, identification of the attacker [closed]

Once I was told that you can identify if your mobile phone is being tracked by someone (e.g. police), by calling placing a specific prefix to the number. This prefix in my country is normally reserved ...
3
votes
1answer
2k views

LogJam hardening OpenSSH and testing it [duplicate]

I would like to harden my OpenSSH (clientsite) after the LogJam attack. I read this article https://weakdh.org/sysadmin.html and there is one paragraph, which says how to do that. Is this enough and ...
1
vote
1answer
139 views

Must an attacker using a Smurf attack be on the same network as the victim?

I'm learning about Smurf Attacks. Since they need to use a broadcast address, doesn't that mean they can't work over the internet? For example if an attacker sends a router the packet with the ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
8
votes
4answers
52k views

How safe is the 256-bit encryption used in bank transactions?

Most of the banks use a 128-bit or 256-bit encryption. What does this mean? Does it mean that the keys used in SSL are 128-bit long or what? If they are the SSL key lengths then 128 bit RSA keys are ...
12
votes
5answers
3k views

How can I help catch an email scammer who is contacting me?

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
6
votes
2answers
112 views

Is there a formal common Internet threat model?

I'm looking for a common Internet threat model that describes active attacks formally. By active attacks I mean attacks of an attacker with literally unlimited resources and full control over the ...
0
votes
1answer
79 views

Man in the middle attack on loopback

We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?
0
votes
1answer
230 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
5
votes
1answer
104 views

Dragnet TEMPEST Surveillance?

Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being ...
1
vote
1answer
118 views

Does NDP (Neighbor Discovery Protocol) reduce ARP (Address Resolution Protocol) attacks?

I read the comparison of NDP with ARP but am uncertain if NDP does reduce any amounts of ARP attacks, given that with NDP, ARP is not used for address resolution. For the discussion to be specific, ...
2
votes
1answer
70 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...
12
votes
4answers
2k views

How was (is?) the ping of death attack possible with IPv4?

While reading about Internet Protocol, I found myself reading about ping of death attacks: the thing that attracted my curiosity was the fact that these attacks could ever work! I mean, why wasn't ...
3
votes
1answer
61 views

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates Never deploy a site into production with DEBUG turned on. Did you catch that? ...
1
vote
3answers
580 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
20
votes
4answers
4k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
-3
votes
1answer
45 views

LFI attacks auth.log , environ , passwd [closed]

paths like /proc/self/environ , /etc/passwd and /var/log/auth.log are targeted by the attackers. how can I hide those files ( passwd ) ( environ ) ( auth.log ) to be not include in LFI attack
1
vote
3answers
205 views

Can man-in-the-middle attacks affect anyone not connected to the attackers network?

I'm trying to understand what these attacks are restricted to. I'm aware that man-in-the-middle attacks can be done if the attacker is on the same network (using something like Wire Shark), but is it ...
1
vote
2answers
42 views

Access LAN services through malicious web page

Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an ...
0
votes
1answer
43 views

Can I modify a ciphertext created in AES with OFB mode?

Suppose a service uses AES to encrypt Cookies, of the form user=username+padding,tmstmp=timestamp where tmstmp is the expiration time and +padding is a series of zeroes to make the total length be ...
7
votes
2answers
7k views

Yahoo mail hacked - how to recover, how did it happen and how to prevent?

I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like firstnamelastname@spacepc.pt and firstnamelastname@revistaplot.com with ...
3
votes
1answer
190 views

What is a sequential injection attack?

From the Financial Times 26th October 2015 "TalkTalk faces mounting calls for compensation" Then, the hackers downloaded customer data using a “sequential injection”. Cyber security experts say ...
11
votes
4answers
2k views

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?

If for example I have Magento-eCommerce and WordPress installed on the same server. Both have a database each with a different database username/password and both have different login details to the ...
-2
votes
1answer
56 views

What is a transient attack?

I just faced a problem of an IP is taking forever to respond, i had been told it might be a transient attack.... I tried googling it, but cant really find more info. Can anyone kindly explain to me ...
4
votes
3answers
2k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software (...
3
votes
1answer
129 views

What sort of attack can reset MySQL Privileges and unmount remote drives without root or shell?

ATTACK VECTOR Monthly hits via a globally DDoS attack. Resolved with Cloudflare. Attacker can now somehow unmount network drive links and reset MySQL user permissions for applications. Attack is ...
0
votes
0answers
83 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
2
votes
1answer
27 views

Revoking AIK Key

How can I prevent attacks via compromised Attestation Identity Key (AIK) keys, such as having an attacker forging the cryptographic signature of an AIK key on TPM?
0
votes
0answers
62 views

CPU instruction encoding on x86 that is free from ROP attacks

x86 has a dense instruction encoding, and thus enables ROP attacks. Are there any CPU instruction encoding schemes that are free from these attacks?
2
votes
1answer
76 views

Defeating code injection attacks in x86

In x86 systems, there are three requirements for a code injection attack to work: write attack payload to memory attack payload to be executable divert control-flow to payload How can we prevent 2)...
6
votes
1answer
256 views

AES-ECB chosen plaintext attack with long secret

I'm having some trouble understanding the methodology for a crypto exercise I'm doing. The goal of the exercise is to recover an encrypted secret string through a chosen key attack on AES in ECB mode. ...
1
vote
2answers
93 views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...