An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

learn more… | top users | synonyms

12
votes
4answers
2k views

How was (is?) the ping of death attack possible with IPv4?

While reading about Internet Protocol, I found myself reading about ping of death attacks: the thing that attracted my curiosity was the fact that these attacks could ever work! I mean, why wasn't ...
2
votes
1answer
55 views

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates Never deploy a site into production with DEBUG turned on. Did you catch that? ...
1
vote
3answers
429 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
20
votes
4answers
4k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
-3
votes
1answer
35 views

LFI attacks auth.log , environ , passwd [closed]

paths like /proc/self/environ , /etc/passwd and /var/log/auth.log are targeted by the attackers. how can I hide those files ( passwd ) ( environ ) ( auth.log ) to be not include in LFI attack
1
vote
3answers
180 views

Can man-in-the-middle attacks affect anyone not connected to the attackers network?

I'm trying to understand what these attacks are restricted to. I'm aware that man-in-the-middle attacks can be done if the attacker is on the same network (using something like Wire Shark), but is it ...
1
vote
2answers
39 views

Access LAN services through malicious web page

Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an ...
0
votes
1answer
42 views

Can I modify a ciphertext created in AES with OFB mode?

Suppose a service uses AES to encrypt Cookies, of the form user=username+padding,tmstmp=timestamp where tmstmp is the expiration time and +padding is a series of zeroes to make the total length be ...
7
votes
2answers
6k views

Yahoo mail hacked - how to recover, how did it happen and how to prevent?

I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like firstnamelastname@spacepc.pt and firstnamelastname@revistaplot.com with ...
3
votes
1answer
178 views

What is a sequential injection attack?

From the Financial Times 26th October 2015 "TalkTalk faces mounting calls for compensation" Then, the hackers downloaded customer data using a “sequential injection”. Cyber security experts say ...
11
votes
4answers
2k views

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?

If for example I have Magento-eCommerce and WordPress installed on the same server. Both have a database each with a different database username/password and both have different login details to the ...
-2
votes
1answer
56 views

What is a transient attack?

I just faced a problem of an IP is taking forever to respond, i had been told it might be a transient attack.... I tried googling it, but cant really find more info. Can anyone kindly explain to me ...
4
votes
3answers
2k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
3
votes
1answer
125 views

What sort of attack can reset MySQL Privileges and unmount remote drives without root or shell?

ATTACK VECTOR Monthly hits via a globally DDoS attack. Resolved with Cloudflare. Attacker can now somehow unmount network drive links and reset MySQL user permissions for applications. Attack is ...
0
votes
0answers
65 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
2
votes
1answer
27 views

Revoking AIK Key

How can I prevent attacks via compromised Attestation Identity Key (AIK) keys, such as having an attacker forging the cryptographic signature of an AIK key on TPM?
0
votes
0answers
47 views

CPU instruction encoding on x86 that is free from ROP attacks

x86 has a dense instruction encoding, and thus enables ROP attacks. Are there any CPU instruction encoding schemes that are free from these attacks?
2
votes
1answer
70 views

Defeating code injection attacks in x86

In x86 systems, there are three requirements for a code injection attack to work: write attack payload to memory attack payload to be executable divert control-flow to payload How can we prevent ...
6
votes
1answer
208 views

AES-ECB chosen plaintext attack with long secret

I'm having some trouble understanding the methodology for a crypto exercise I'm doing. The goal of the exercise is to recover an encrypted secret string through a chosen key attack on AES in ECB mode. ...
1
vote
2answers
87 views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
11
votes
8answers
17k views

Is it possible to steal money directly from the systems of a big bank?

Sometimes I imagine: My money in the bank is just a floating point number in a mainframe's memory... So, if I just change 1 bit, I will win a lot of money... The most common way to steal money in ...
1
vote
1answer
92 views

Does adblockers(ublock) protect you from Malvertisement?

With malvertisement on the rise, I was wondering if it's as easy to protect yourself from it by just using an adblocker like ublock origin?
0
votes
1answer
233 views

Was I hacked remotely, how could I find out? Windows 7

I was cleaning out my old windows 7 HP desktop computer approximately 5 months ago. There was only the expired Norton 360 as far as antivirus and no firewall. Up until this point I disabled the wifi ...
6
votes
3answers
569 views

Random URL string: What kind of attack is this, and what can be done to stop it?

EDIT: It's been a little while since this was posted, but I'm here to report that this does NOT appear to have been some sort of attack after all. Rather, this particular URL string indicates a ...
-3
votes
1answer
46 views

What threats involve in cache miss

What are the possible consequences of a cache miss? In other word, is it possible that a cache miss could cause a security threat? Thank you.
1
vote
1answer
40 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
2
votes
2answers
71 views

Violation of security principles?

It's clear that keyless entry fobs, smart entry cards, NFC, etc. are vulnerable to relay attacks. Suppose they were improved by limiting the period of activity, eg let them be active only when they ...
2
votes
3answers
164 views

What prevents a coder from brute forcing a wifi?

I know that a coder is able to connect to a wifi through code so my question is: Is there anything that will make it difficult to brute force a wifi password?
2
votes
2answers
291 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
2
votes
1answer
109 views

How can an attacker redirect victims through proxy

Let's say that an attacker is behind a proxy that's using NAT or PAT. Is it possible for him to redirect victims to his machine to achieve some attacks like web phishing or opening reverse TCP ...
3
votes
1answer
167 views

Challenge: How to find the secret key in homebrew MAC/keyed hash: sha1(key + cookie)?

I am trying to solve a security challenge on a website. Basically, the website computes sha1(key + cookie) to sign a cookie so that the user can't change it himself, and to accomplish the goal you ...
4
votes
3answers
256 views

Passwords propagation, Password Trend and Word Generator in Human Mind

Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits. The users seem to pick up the password suggestions or just copy the ...
12
votes
3answers
4k views

Can you extract memory contents from a hibernated Windows machine?

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk. When ...
19
votes
6answers
3k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
1
vote
3answers
129 views

CRIME attack - If Javascript can be injected on the attacked machine, why not directly sending the cookie to a remove server?

I read about the CRIME - How to beat the BEAST successor? question and answer, but I don't understand that: If Javascript can be injected and run on the attacked machine, why not directly sending the ...
5
votes
2answers
241 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
89
votes
2answers
29k views

What are rainbow tables and how are they used?

Where can I find one? Is there a pot of gold at the end? How do I protect against them? From the Area51 proposal This question was IT Security Question of the Week. Read the Sep 09, 2011 blog ...
3
votes
1answer
72 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
3
votes
2answers
298 views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...
79
votes
5answers
10k views

Can simply decompressing a JPEG image trigger an exploit?

The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords. However, this struck me as unrealistic: Gragg's e-mail contained a poisoned JPEG of ...
1
vote
2answers
370 views

TCP- or UDP-based Port Scans, IP Fragmented Packet

Is this normal or is someone trying to hack/attack me? How can I stop this? My router is a Cg3000v2 netgear provided to me by Optus. [TCP- or UDP-based Port Scan]411 Wed Aug 26 00:28:08 2015 ...
2
votes
3answers
173 views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
3
votes
1answer
262 views

SSD Self Encrypting Drives - Setup / warm boot bypass

I've seen folks deploying the SED on laptops recently. I've discovered that there is a setting in which you can do a warm boot and NOT require the bootup password to be put in again. Which makes ...
0
votes
1answer
212 views

Thousands of 404s from various search engines

Since early April of 2015, my web site has been getting thousands of requests from many search engines for URLs that don't exist and never have existed. I found a similar, but less detailed, ...
2
votes
1answer
203 views

Rootkits, Bootkits detection and protection and Firmware alteration

I was hacked in an extremely intrusive manner in late 2013. Ever since then, not a day has passed where I don't think about this. A lot. My question has to do with the likelihood of the attackers ...
6
votes
2answers
815 views

UDP flood from my machine, or false positive?

The company that hosts my dedicated server has alerted me to what they think is malicious traffic coming from my machine. They supplied me with graphs showing a large amount of UDP traffic coming from ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
5
votes
1answer
150 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
15
votes
4answers
15k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
3
votes
1answer
93 views

Is this an attempted cross-site attack?

I have found various 404 errors in my web server log that look like this: http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd ...