An attempt by a threat to exploit a weakness in a system.
4
votes
2answers
141 views
Most secure response for a server to return to a user scanning for exploits
I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc.
Currently these requests all return 404 because ...
3
votes
2answers
671 views
I'm currently receiving a targeted attack
Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites:
http ...
0
votes
0answers
70 views
How to decode this runforestrun gootkit [closed]
Infected site is hxxp://www.infraredpsi.com/Pluginlab/Scripts/menuscript.js
online scan result:
http://urlquery.net/report.php?id=141893
I can de-obfuscate the first layer of the code that use the ...
4
votes
3answers
326 views
VGA/HDMI Based Attack
Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side?
How about HDMI or DVI?
And if so, are there known malware or PoCs to do that? or is it theoretically ...
7
votes
1answer
522 views
How to make SQL injection in PostgreSQL's tsquery?
I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format:
PHP raised unknown ...
2
votes
4answers
225 views
Can public keys be a security risk when performing password-less SSH logins?
Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins.
The servers being checked put the public key of ...
10
votes
2answers
741 views
Security of Log Files - Injecting malicious code in Log files
As part of my course project I'm trying to understand various security frameworks and best practices.
One of the very popular approach is to maintain Logs. My question is about the security of the ...
3
votes
2answers
149 views
Ftp constantly asked for a .exe file, what can i do?
I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
1
vote
1answer
287 views
Are there Bluetooth attacks on Smartphones that will not notify the user of the attack?
Are there Bluetooth attacks on Smartphones that will not notify the user of the attack?
Specifically forcing a reset or opening an application.
-4
votes
4answers
261 views
Should companies use Crowd Source Audit Platform for Manual Penetration Test?
As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues?
LE: So most of you guys downgrade, and said it's wrong to have ...
-1
votes
1answer
65 views
What are the supported versions of RHEL 5 by the NSA?
I have read through the document found at,
NSA RHEL5 Security Requirements
In reading through the document, it seems that you can use any version of RHEL 5 as long as it supports the requirements in ...
1
vote
2answers
366 views
How is iptables useful to prevent attacks against a LAN?
I need some advice securing a LAN using iptables.
I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
1answer
563 views
HTTPS and cache injection
I understand the downside of this attack and what wrong can be done.
But I dont understand how is it done ?
Well, I need to educate myself, any pointers would be useful.
1
vote
1answer
138 views
What are security risks of serving user uploaded files without Content-Disposition?
Imagine a server that serves untrusted user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without ...
1
vote
2answers
539 views
SUN Remote Procedure Call Port 111 [closed]
I have found on my machine port 111 is open. This is listed as RPC.
I understand there are possible attacks on this port. How can my machine be attacked if port 111 is open?
How can I secure this ...
5
votes
2answers
999 views
Need help identifying the OSX process that's generating strange network traffic
Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like:
Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
6
votes
2answers
857 views
Is it possible to do HTTP header injection if CR/LF are stripped?
In HTTP response there is the following header with attacker controlled content:
Content-Disposition:attachment; filename="attacker_controlled.html"
The only characters that can't appear in ...
1
vote
1answer
420 views
How to fix the audit failure in our web server
We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.
Can anybody help me how to isolate and prevent this from happening?
An ...
0
votes
2answers
444 views
How to encode letters in multipart/form-data to include CR/LF characters?
Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:
------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
...
0
votes
1answer
462 views
Is this Ubuntu server configuration secure?
I'm new to Linux and security matters. I have a vps with Ubuntu 12.04 server and I wonder how secure this server is.
I set up ssh passwordless login and disabled ssh login for root. I update security ...
13
votes
3answers
448 views
What prevents people getting charged over NFC in crowded places?
I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
1
vote
3answers
841 views
MITM: tools for intercepting and modifying traffic?
I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request.
For example:
When I receive a request on port 25, I want to be able to intercept all the ...
-1
votes
1answer
157 views
Impact of attack occured in Radius, DHCP and HTTP servers on VOIP?
Assume we can crash the RADIUS server in a VOIP system. What would be the impact on the confidentiality, integrity, and availability of VOIP service. What would be the impact if the same question if ...
2
votes
2answers
63 views
Does the CVSS impact score correpond to probability?
From http://nvd.nist.gov/cvsseq2.htm , I noticed that the CVSS standard attributes the following impact values for confidentiality, integrity and availability: 0 for none impact , 0.275 for partial ...
0
votes
2answers
79 views
Looking for information about CVE-2006-6876 vulnerability
In order to study vulnerabilities of a SIP server and the impacts of DOS attacks on the QoS of VoIP service, I have found this vulnerability which can be exploited to cause DoS on SIP server.
But I ...
3
votes
3answers
5k views
How to prevent my website from getting malware injection attacks?
I found that my website is banned as malware website by Google. When I checked the code, I found some code injected to many files on my server. I cleaned everything manually editing all files in my ...
0
votes
0answers
35 views
more justification for the impact scores used by the national vulnerability database [duplicate]
Possible Duplicate:
why CVSS give a score of 0.66 for a full impact on CIA?
Good day ;
the CVSS attributes the following impact values for confidentiality, integrity and availability:
...
0
votes
1answer
101 views
How can I remotely detect versions? [closed]
I want to know how to remotely detect a software version.
Once attacker knows the version installed, he can exploit published vulnerabilities. So it will be useful to know it when doing penetration ...
1
vote
1answer
381 views
syn flood size per second
Given the size of a TCP packet is 60 bytes, there is a SYN Flood attack on a computer made by a 100 Mb bandwidth, the question is how many syn packets are sent in a second? Is there any formula for ...
0
votes
1answer
656 views
More information about CVE-2012-0883 vulnerability
I need to have more details about CVE-2012-0883 vulnerability published on : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883
Second, I need to know , what mean DSos mentioned on the ...
0
votes
1answer
118 views
why CVSS give a score of 0.66 for a full impact on CIA?
By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values for confidentiality, integrity and availability:
none : 0.0
partial impact : ...
1
vote
3answers
1k views
How should I defend against TightVNC brute-force attacks?
How should I defend against this type of attack? This is a tightvnc logfile excerpt from a linode cloud server running Ubuntu 12.04 (Precise) with the ubuntu-desktop package added to the bare server. ...
1
vote
1answer
133 views
Limiting database security
A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
1
vote
1answer
162 views
SNMP trap by legitimate program?
Is there any way to tell if this SNMP trap is something created by a legitimate program?
Update: Hex Dump
0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
1
vote
1answer
412 views
Example of attack trees in the web application security analysis
Here I am again asking for some informations about attack trees usage in web application analysis.
For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
1
vote
1answer
2k views
How to use http-get-form in THC-Hydra?
I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App"
brute force section but the problem is when I use http-get-form it said:
Warning: child 1 seems to have died, ...
17
votes
7answers
741 views
Are common passwords at particular risk?
The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
6
votes
4answers
4k views
How to trace a DDOS attack on a dedicated server and block it?
I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.
The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
2
votes
1answer
293 views
Categories of attacks in Snort
Is there any category for Snort rules that classifies them according to attcks such as U2R, R2L, .. ?!!
Or how many well known attacks can it finds?!
2
votes
2answers
325 views
SSH : Remote Host Identification Changed
As part of my daily routine, I was SSH'ing to one of the corporate servers.
However this time I was presented with following message
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ ...
-2
votes
1answer
113 views
Why did I get unresponsive script when I start my system and open web browser? [closed]
The script on opening web broswersays Warning: Unresponsive Script
A script on this page may be busy,or it may have stopped responding.You can stop the script now,or you can continue to see if the ...
7
votes
4answers
303 views
What would happen if one of the popular Linux repositories is hacked?
Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling.
What ...
1
vote
2answers
1k views
Snort false positive?
I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off:
GPL SHELLCODE x86 inc ebx NOOP
The payload is as ...
2
votes
1answer
97 views
ISP security compared to enterprise
I've just started reading IT Security, and found some interesting reads on man-in-the-middle and different types of "attacks" that could be used by an enterprise to intercept communications on their ...
4
votes
2answers
169 views
Can a MitM attack occur on an ISP's local exchange or street wiring cabinet?
If an attacker were to dig up the 'outgoing feed' from my local exchange or the street cabinet, could they sniff my entire neighborhood's network traffic? Or is this infrastructure secured against ...
1
vote
2answers
219 views
Wireless LAN router fingerprinting
Does anyone know of a database that lists the range of MAC addresses that are assigned to each particular brand of router? I would like to use this information for fingerprinting.
I know I can find ...
-2
votes
3answers
144 views
Is cracking really important systems possible?
We always hear about "hacking" (or cracking) banks, websites or the like. Nothing really "important" like centrals, or even satellites (like TV channels). Those we only see in movies - but are they ...
3
votes
2answers
463 views
How to use attack trees and attack graphs
I am trying to understand how attack trees\graphs can be used in the security process. I read a lot of papers presenting the topic and how this reppresentation can be useful, but I really don't ...
3
votes
3answers
258 views
TLS Renegotiation Indication Extension vulnerability
I am trying to understand the TLS Renegotiation Indication Extension from the RFC.
I can understand that it is related to the fact that the renegotiation is send under the encrypted stream but can not ...
16
votes
4answers
1k views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
