An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

0
votes
2answers
295 views

What service could penetrate my Firewall via UDP on Port 17275?

Has anyone monitored various requests from all over the world on Port 17275 via UDP? My firewall logs show huge amounts of such requests from lots of different IP Adresses. I can't find any ...
2
votes
1answer
248 views

Bypass va_randomize_space and stack-protector

Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks? ...
0
votes
2answers
387 views

WPS vulnerability scanning for handshakes to detect the attack

I was able to sniff the EAP packets from the attacker machine with a wireless card on p-mode, however i was not able to sniff this data off the user using the same card under windows. Wireshark, did ...
8
votes
6answers
797 views

Getting credentials using proxy server

Is it possible to get the username and password we enter into sites like facebook using proxy server? The scenario is like this : 1.My laptop is connected to a network. 2.It is configured to use a ...
4
votes
1answer
113 views

Voice Call Safety

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep. I was wondering if this procedure is secure against a malicious agent who ...
2
votes
1answer
597 views

secure website against the ping of death attacks

Any programmer is interested in securing his website. So I found this http://www.youtube.com/watch?v=DB4eMFrQYiY&feature=youtube_gdata_player which talks about crashing a website using cmd only. ...
0
votes
1answer
571 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
16
votes
4answers
1k views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
2
votes
1answer
701 views

How does Binding Images with Malicious Patches happen?

Well I don't know if this technique is still used, but about 5-7 years ago it was a popular way to deliver a malicious patch (Sub-7 , bifrost etc ..) to a victim. There used to be a program that ...
0
votes
0answers
25 views

CRIME attack clarrification [duplicate]

I am not understanding CRIME attack completealy.. First an attacker runs a script to caputure the encrypted cookies later using the captured value an attacker try to bruteforce the next cookie ...
74
votes
8answers
7k views

How would one crack a weak but unknown encryption protocol?

I was reading this interesting question: Is my developer's home-brew password security right or wrong, and why? It shows a weak home-brew algorithm developed by "Dave", and the answers discuss ...
4
votes
3answers
143 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
13
votes
2answers
356 views

Concrete figures on password cracking in the wild

While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs. It's easy enough to test online password guessing ...
5
votes
4answers
234 views

What kind of attacks result in an attacker only being able to leak a site's database?

Of the public disclosures I've seen from recently compromised sites, it seems common for only the database to be leaked, rather than the application code, or rather than a complete takeover. Is this ...
34
votes
4answers
4k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
2
votes
1answer
951 views

Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file?

I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks). ...
0
votes
2answers
159 views

How can I encrypt something user provided without risk of the key being exposed?

So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
0
votes
1answer
539 views

How to conduct a disguised LSA attack against OSPF?

I want to do disguised LSA attacks on OSPF network and be able to more analyze, so I do not know how it works in practice. This is a penetration test. The attack is described in the address [+]. I ...
0
votes
1answer
198 views

What type of attack should be used in order to pass this authentication

I am practicing the Astalavista Wargames and i came across this challenge. The question is: Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to log ...
5
votes
2answers
345 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
1
vote
5answers
718 views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. ...
3
votes
2answers
473 views

An attack from my Employer

I am working in an ISP company as a junior support specialist. Recently, I have a serious suspicions that one of our "head" stuff member is compromising me by being able to control(see) my traffic.. ...
4
votes
4answers
306 views

Security risk of adding a HTTP Header with server identifier

We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
1
vote
2answers
668 views

Secure against HTTP FLOOD ATTACK

What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
0
votes
1answer
145 views

What is the method used in the New York Times attack? [closed]

In the recent New York Times attacks, how did the attackers gain access to the server? Additionally, is there any evidence that these attacks were launched by China, aside from the proxy?
4
votes
4answers
398 views

Received a Kindle from a stranger, what are the risks?

While getting a coffee today, a man walked up to me and offered me a kindle. he said he no longer wanted it and that he was looking to give it away. An avid reader, I accepted. It has no accounts on ...
3
votes
2answers
813 views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
8
votes
2answers
3k views

How should one prepare himself for a job interview for penetration testing?

So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this. Should it revolve around the ability to verbally explain ...
4
votes
5answers
254 views

Can SSL requests be proxied by issuing a second certificate?

Alice wants to login to her account at https://www.bobsbank.com/. However she clicks on a malicious link in an email and instead gets sent to the malicious site https://www.charliesbank.com/. The ...
2
votes
3answers
1k views

Disadvantages of HTTP GET/POST Flooding Attack?

I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work. Now I want to find out what are the disadvantages of them.
4
votes
3answers
12k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
2
votes
2answers
2k views

Difference between masquerading and replay attacks?

I know that masquerading is to impersonate a false identity and replaying is the same wherein unauthorized person uses the credentials of the authorized one to have the privileges.Then what is the ...
-1
votes
1answer
334 views

Why is it hard to catch cybercriminals? [duplicate]

Possible Duplicate: Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)? I really want to know why the attackers behind the major attacks like Diginotar hack ...
5
votes
6answers
2k views

What does it actually mean when someone says their website is hacked?

I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means. To me the only way to get control of website is get the FTP ...
0
votes
3answers
161 views

How to retrieve a site whose server is running Linux

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system. Actually, I'd like to be able to test the following command: nmap -O ...
1
vote
1answer
116 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
2
votes
2answers
306 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
2
votes
1answer
264 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
6
votes
1answer
762 views

What is the difference between Simple Power Analysis and Differential Power Analysis?

What is the difference between Simple Power Analysis (SPA) and Differential Power Analysis (DPA) and why is it not possible to do an SPA attack on FPGAs? My basic understanding is they are ...
16
votes
5answers
1k views

Rainbow table concept for Prime numbers

Is there a concept where pre-computed tables can be used for prime number factorization ? Is it possible that a computer can generate millions of prime numbers, store it and then effectively determine ...
2
votes
1answer
250 views

White-Box Cryptography Questions and References

I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on. As far as I can tell, WBC has ...
1
vote
1answer
450 views

Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?

I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable. I tried to test the ICMP rule by ...
4
votes
3answers
1k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
2
votes
1answer
273 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
5
votes
3answers
2k views

What is a Shrink Wrap code attack?

On my C|EH course I have heard about term "Shrink Wrap Code Attack", but we've only mentioned it. Now trying to do some research and refresh the topics, I can't seem to find serious description of ...
1
vote
1answer
203 views

uninstall and reinstall after hacking [closed]

My computer has been hacked. If I uninstall and reinstall do I loose my files? The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
3
votes
3answers
366 views

Is this a web attack I should be concerned about - trying to enter code for form vars

I have a created a simple CGI script running on a web server where a user can login using a username and password. The username and password are entered via a html form and the form POST's the data ...
8
votes
2answers
9k views

Advice on what to do after being hacked?

After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering. ...
7
votes
3answers
1k views

Can you extract memory contents from a hibernated Windows machine?

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk. When ...
18
votes
2answers
2k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...