An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

8
votes
2answers
5k views

Do these regex show that I was hacked?

What do these regex commands mean? I found them when I ran the history command: grep --include=\*.php -rnw . -e "update.creditcard" grep --include=\*.php -rnw . -e "e41e" grep --include=\*.php -rnw . ...
8
votes
5answers
7k views

What kind of attacks against home router's NAT do exist?

I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
8
votes
4answers
2k views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
8
votes
3answers
737 views

How does an attacker approach a website?

What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
8
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
8
votes
7answers
2k views

Facebook account keeps getting hacked, can't seem to figure out why or how?

One of my mate, she has a lot of friends on Facebook, uses it for marketing. Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
8
votes
3answers
880 views

What prevents this exploit from working (unix SUID)?

If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system? ...
8
votes
4answers
1k views

Automated encryption detection

Is there any program that, given a cipher text, it would tell me what the encryption algorithm is? What if I have the plain text? Is there something that can be done in that case?
8
votes
3answers
7k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
8
votes
3answers
2k views

iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

With such a big deal being made about the iPhone 5S's fingerprint reader (and formerly the Thinkpads' fingerprint readers) I really wonder how secure it is to use fingerprints in lieu of passwords. ...
8
votes
1answer
1k views

Is it possible to recognise and prevent MitM attacks on devices which use self-signed SSL certs?

I use both Linux and Windows at work on a large enterprise LAN. The majority of the network configuration is out of my reach. Certain SaaS applications that are hosted locally on the enterprise LAN, ...
8
votes
4answers
694 views

CAM table attack in 2011?

Today's switches are vulnerable to CAM Table attack? https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
8
votes
1answer
105 views

Got a spam mail with an htm attachment, is the script harmful?

Today I got an email with an htm attachment, the mth contains the below code: <html> <head> <script> var url = "" window.location.href= url; ...
8
votes
2answers
5k views

How should one prepare himself for a job interview for penetration testing?

So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this. Should it revolve around the ability to verbally explain ...
8
votes
2answers
262 views

Where to find papers / information about spyware, tracking and cookie problems?

I am right now working on a problem and looking for some papers / information about spyware, tracking and cookie problems. I am no expert in that area, so I lack the knowledge where to find material ...
8
votes
1answer
186 views

Deanonymizing users by introducing structured delays to the network?

Here is a scheme for deanonymizing a user that I've been thinking about, just out of curiosity. I tried searching for it but didn't find much. Does this technique have a name? Are there any papers or ...
8
votes
2answers
820 views

Zlib DEFLATE decompression bomb

Can you give me an example of a short data string that, when decompressed using Zlib's DEFLATE method, expands to something much much longer? More precisely: what is the nastiest decompression bomb ...
8
votes
3answers
20k views

How to prevent my website from getting malware injection attacks?

My website was banned as a malware website by Google. When I checked the code, I found out that some code injected many files on my server. I cleaned everything manually, edited all files on my server ...
8
votes
3answers
675 views

How to gain a shell?

I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user. My question is this: I can create application that is guaranteed to be run by the ...
8
votes
2answers
1k views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
8
votes
1answer
2k views

What is the difference between Simple Power Analysis and Differential Power Analysis?

What is the difference between Simple Power Analysis (SPA) and Differential Power Analysis (DPA) and why is it not possible to do an SPA attack on FPGAs? My basic understanding is they are ...
8
votes
4answers
2k views

Keyboard sniffing through audio recorded typing patterns

I've been thinking about this for a while; I know people are aware of wireless wiretapping of keyboards. However, has there been research on how to wiretap keyboards based on typing patterns? I'm ...
8
votes
2answers
428 views

How to mitigate the risk of a continuous integration service security breach?

We are using a Continuous Integration service to automatically run our product test suite. Every time we push code to our central Git repository production branch, the CI services is notified and ...
8
votes
2answers
2k views

Is it possible to do HTTP header injection if CR/LF are stripped?

In HTTP response there is the following header with attacker controlled content: Content-Disposition:attachment; filename="attacker_controlled.html" The only characters that can't appear in ...
8
votes
1answer
2k views

ASP.NET HTTP Response Splitting Attack

By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect: ...
8
votes
3answers
723 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
8
votes
5answers
13k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
7
votes
2answers
3k views

What is the meaning of “something AND 1=0” command in SQL?

I have read somewhere that in SQL injection attacks the attackers use such keywords into application entry points. Whats the purpose of doing this?
7
votes
4answers
713 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
7
votes
4answers
941 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
7
votes
2answers
687 views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
7
votes
4answers
291 views

Security papers or material focusing on the industrial control systems (SCADA)

Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?
7
votes
1answer
2k views

How do I stop attack on my email id from hackers?

We have an email id, info@<ourdomain>.com This email id is being hacked frequently and mails are sent from this email id, Following is the example of one such email. From: ...
7
votes
2answers
5k views

Need help identifying the OSX process that's generating strange network traffic

Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like: Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
7
votes
1answer
161 views

AES-ECB chosen plaintext attack with long secret

I'm having some trouble understanding the methodology for a crypto exercise I'm doing. The goal of the exercise is to recover an encrypted secret string through a chosen key attack on AES in ECB mode. ...
7
votes
5answers
7k views

Is there a method to detect an active man-in-the-middle?

Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked? I think one of my friends is a victim of this kind of attack. How can I be ...
7
votes
1answer
726 views

How secure is NFC on mobile devices?

Near field communication is becoming more commonly available in modern mobile devices, such as smartphones and tablets. This functionality can be used to communicate between such devices, or with ...
7
votes
1answer
316 views

Collision attacks on OCB?

I've been looking into the OCB cipher mode and everything I hear sounds good. I was planning on implementing it. Everything except for this lone voice, that is: Collision attacks on OCB: We ...
7
votes
3answers
1k views

Password list generation

I've found during a lot of recent pen-tests that companies will use passwords like c0mp4ny@b( for a company called "company abc" Is there any quick and easy way to generate a list of passwords ...
7
votes
1answer
9k views

Server attack attempts, what are they trying to achieve?

Recently, I have got a few 404 errors where the user has requested PHP pages. The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of ...
7
votes
2answers
341 views

Profiling attackers via adaptive games: “Strange game, the only winning move is not to play”

Use of Game Design to Profile Attackers: Interested in any research that links concepts in game design to security systems in an effort to profile the attacker's identity, motives, skills, etc.; if ...
7
votes
1answer
524 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
7
votes
1answer
270 views

What is the name for this type of URL attack?

Say a PHP page accepts URL path as a POST parameter (like the answer to this question): $path = $_POST['url_path']; file_get_contents('http://example.com' . $path); A maliicious user POSTs ...
7
votes
1answer
152 views

What should be included in the ground rules for an attack review?

I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics: Link to the policy that I want to enforce. Link to a minimal testbed and ...
7
votes
1answer
199 views

Kaminsky Bug DNS Cache Poisoning

I'm trying to use Kaminsky DNS cache poisoning method. I'm using bind9 server on ubuntu and static port. So far I achieved to insert a line into DNS cache which is ;additional www.blalba.com 80000 ...
7
votes
1answer
2k views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
7
votes
1answer
1k views

I can receive all PADI packets for PPPoE connections of my ISP, is that a problem?

for debugging why my router wasn't connecting to pppoe i've tried to connect via the pc, it worked, then i started wireshark just to see what was going on, and i've seen that i can read all the PADI ...
6
votes
4answers
43k views

How safe is the 256-bit encryption used in bank transactions?

Most of the banks use a 128-bit or 256-bit encryption. What does this mean? Does it mean that the keys used in SSL are 128-bit long or what? If they are the SSL key lengths then 128 bit RSA keys are ...
6
votes
6answers
3k views

What does it actually mean when someone says their website is hacked?

I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means. To me the only way to get control of website is get the FTP ...
6
votes
3answers
624 views

How to respond to attack made from my dedicated server?

There was a sudden unusual peak of outbound traffic from my hosted dedicated server (OS - Windows Server 2008 R2). The hoster threatened to block the server if the problem is not solved. There are an ...