An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

-7
votes
2answers
241 views

What are the security risks of pirating video or music?

In the case of pirating multimedia, be it video or music, which problems may be caused by the video or music file itself? Could a video or an audio file be used to spread malware? I'm talking about ...
5
votes
2answers
238 views

Password list generation

I've found during a lot of recent pen-tests that companies will use passwords like c0mp4ny@b( for a company called "company abc" Is there any quick and easy way to generate a list of passwords ...
2
votes
3answers
189 views

How good is validating source with request.referer than checksum?

I have 2 portals(both are under my control & domain names are different) In 1st portal, there is a link on click of which User can directly get logged into 2nd portal. Link which will be hit in ...
6
votes
3answers
440 views

Lessen impact of DoS attack on cpu-expensive login?

This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
3
votes
1answer
221 views

Odd user registered and strange behavior. Is it sinister?

I am running a number of web sites. They are all Drupal based, if that is relevant. Recently I have noticed something odd. All my sites have a user registered with the name "zctonglin". I presume ...
0
votes
2answers
187 views

What service could penetrate my Firewall via UDP on Port 17275?

Has anyone monitored various requests from all over the world on Port 17275 via UDP? My firewall logs show huge amounts of such requests from lots of different IP Adresses. I can't find any ...
2
votes
1answer
180 views

Bypass va_randomize_space and stack-protector

Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks? ...
0
votes
2answers
316 views

WPS vulnerability scanning for handshakes to detect the attack

I was able to sniff the EAP packets from the attacker machine with a wireless card on p-mode, however i was not able to sniff this data off the user using the same card under windows. Wireshark, did ...
8
votes
6answers
675 views

Getting credentials using proxy server

Is it possible to get the username and password we enter into sites like facebook using proxy server? The scenario is like this : 1.My laptop is connected to a network. 2.It is configured to use a ...
3
votes
1answer
93 views

Voice Call Safety

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep. I was wondering if this procedure is secure against a malicious agent who ...
2
votes
1answer
492 views

secure website against the ping of death attacks

Any programmer is interested in securing his website. So I found this http://www.youtube.com/watch?v=DB4eMFrQYiY&feature=youtube_gdata_player which talks about crashing a website using cmd only. ...
0
votes
1answer
531 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
15
votes
4answers
1k views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
2
votes
1answer
606 views

How does Binding Images with Malicious Patches happen?

Well I don't know if this technique is still used, but about 5-7 years ago it was a popular way to deliver a malicious patch (Sub-7 , bifrost etc ..) to a victim. There used to be a program that ...
0
votes
0answers
25 views

CRIME attack clarrification [duplicate]

I am not understanding CRIME attack completealy.. First an attacker runs a script to caputure the encrypted cookies later using the captured value an attacker try to bruteforce the next cookie ...
71
votes
8answers
6k views

How would one crack a weak but unknown encryption protocol?

I was reading this interesting question: Is my developer's home-brew password security right or wrong, and why? It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
4
votes
3answers
141 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
13
votes
2answers
333 views

Concrete figures on password cracking in the wild

While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs. It's easy enough to test online password guessing ...
4
votes
4answers
217 views

What kind of attacks result in an attacker only being able to leak a site's database?

Of the public disclosures I've seen from recently compromised sites, it seems common for only the database to be leaked, rather than the application code, or rather than a complete takeover. Is this ...
32
votes
4answers
3k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
1
vote
1answer
852 views

Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file?

I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks). ...
0
votes
2answers
156 views

How can I encrypt something user provided without risk of the key being exposed?

So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
0
votes
1answer
419 views

How to conduct a disguised LSA attack against OSPF?

I want to do disguised LSA attacks on OSPF network and be able to more analyze, so I do not know how it works in practice. This is a penetration test. The attack is described in the address [+]. I ...
0
votes
1answer
186 views

What type of attack should be used in order to pass this authentication

I am practicing the Astalavista Wargames and i came across this challenge. The question is: Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to log ...
5
votes
2answers
342 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
1
vote
5answers
604 views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. ...
3
votes
2answers
456 views

An attack from my Employer

I am working in an ISP company as a junior support specialist. Recently, I have a serious suspicions that one of our "head" stuff member is compromising me by being able to control(see) my traffic.. ...
4
votes
4answers
257 views

Security risk of adding a HTTP Header with server identifier

We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
1
vote
2answers
484 views

Secure against HTTP FLOOD ATTACK

What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
0
votes
1answer
139 views

What is the method used in the New York Times attack? [closed]

In the recent New York Times attacks, how did the attackers gain access to the server? Additionally, is there any evidence that these attacks were launched by China, aside from the proxy?
4
votes
4answers
382 views

Received a Kindle from a stranger, what are the risks?

While getting a coffee today, a man walked up to me and offered me a kindle. he said he no longer wanted it and that he was looking to give it away. An avid reader, I accepted. It has no accounts on ...
3
votes
2answers
722 views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
8
votes
2answers
2k views

How should one prepare himself for a job interview for penetration testing?

So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this. Should it revolve around the ability to verbally explain ...
4
votes
5answers
221 views

Can SSL requests be proxied by issuing a second certificate?

Alice wants to login to her account at https://www.bobsbank.com/. However she clicks on a malicious link in an email and instead gets sent to the malicious site https://www.charliesbank.com/. The ...
2
votes
3answers
896 views

Disadvantages of HTTP GET/POST Flooding Attack?

I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work. Now I want to find out what are the disadvantages of them.
4
votes
3answers
9k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
2
votes
2answers
1k views

Difference between masquerading and replay attacks?

I know that masquerading is to impersonate a false identity and replaying is the same wherein unauthorized person uses the credentials of the authorized one to have the privileges.Then what is the ...
-1
votes
1answer
292 views

Why is it hard to catch cybercriminals? [duplicate]

Possible Duplicate: Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)? I really want to know why the attackers behind the major attacks like Diginotar hack ...
5
votes
6answers
1k views

What does it actually mean when someone says their website is hacked?

I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means. To me the only way to get control of website is get the FTP ...
0
votes
3answers
155 views

How to retrieve a site whose server is running Linux

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system. Actually, I'd like to be able to test the following command: nmap -O ...
1
vote
1answer
115 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
2
votes
2answers
292 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
3
votes
1answer
244 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
6
votes
1answer
582 views

What is the difference between Simple Power Analysis and Differential Power Analysis?

What is the difference between Simple Power Analysis (SPA) and Differential Power Analysis (DPA) and why is it not possible to do an SPA attack on FPGAs? My basic understanding is they are ...
16
votes
5answers
995 views

Rainbow table concept for Prime numbers

Is there a concept where pre-computed tables can be used for prime number factorization ? Is it possible that a computer can generate millions of prime numbers, store it and then effectively determine ...
2
votes
1answer
227 views

White-Box Cryptography Questions and References

I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on. As far as I can tell, WBC has ...
1
vote
1answer
370 views

Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?

I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable. I tried to test the ICMP rule by ...
4
votes
3answers
833 views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
2
votes
1answer
237 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
5
votes
2answers
2k views

What is a Shrink Wrap code attack?

On my C|EH course I have heard about term "Shrink Wrap Code Attack", but we've only mentioned it. Now trying to do some research and refresh the topics, I can't seem to find serious description of ...