An attempt by a threat to exploit a weakness in a system.
0
votes
1answer
2k views
If a router has port 5060 open, and I know that there is unencrypted SIP traffic going through this port, how could one take advantage of this
Ok so an Nmap scan against an IP address shows that port 5060 is open. I know that 5060 indicates that this is SIP traffic. Also, 5060 indiciates that this is unencrypted traffic, where if the port ...
2
votes
1answer
290 views
What attacks use enabled Apache's PATH_INFO?
In Tangled Web Michal Zalewski says:
If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature.
He gave only one example of this vulnerability. There ...
2
votes
3answers
3k views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
2
votes
2answers
168 views
What are stolen passwords used for?
Say there is a line of business application which has username/password datatable in the DB. Personal email address is not stored, and usernames are assigned by an administrator. Someone gains access ...
3
votes
3answers
357 views
Wireless security attack techniques
Before I ask for some advice, please don't assume I'm a script kiddie or such. This is for one of my wireless security class (CSS 1015).
It's a Saturday class and only 6 students are in the class ...
1
vote
0answers
219 views
Unauthorised Perl Scripts [closed]
One of my servers just had the memory exhausted by a load of Perl scripts, we use plesk and they seem to have appeared under the /var/www/vhosts/domainexample.com/cgi-bin/ directory, I managed to stop ...
7
votes
3answers
379 views
How to gain a shell?
I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user.
My question is this: I can create application that is guaranteed to be run by the ...
6
votes
2answers
173 views
Where to find papers / information about spyware, tracking and cookie problems?
I am right now working on a problem and looking for some papers / information about spyware, tracking and cookie problems. I am no expert in that area, so I lack the knowledge where to find material ...
4
votes
2answers
496 views
How effective is an IDS at catching targeted attacks
I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies.
I was ...
12
votes
6answers
2k views
Can I detect a MITM attack?
Based on this question here:
Are "man in the middle" attacks extremely rare?
Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it?
In addition, what if ...
96
votes
8answers
8k views
Are “man in the middle” attacks extremely rare?
In
http://cdixon.org/2012/02/12/the-iphone-contact-list-controversy-and-app-security/
Chris Dixon makes a statement about web security
Many commentators have suggested that a primary security ...
4
votes
2answers
269 views
Are there volatile memory chips which dont retain data after power off?
It was demonstrated that dram modules can retain information up to 10 min after power off in certain conditions. My question - are there memory types which will retain data 10 sec at max even if being ...
5
votes
2answers
2k views
How can someone hack my PC if I am connecting to the internet through NAT?
If I own a private IP address, 192.168.2.1 for the sake of it, and I am physically connected to my router, which it's internal interface is 192.168.2.254 and it's external interface is some public IP ...
7
votes
10answers
385 views
Contract requires me to work with sensitive IP, severe penalties for loss of data to 3rd parties. Some protection pointers please
Background:
The company I will be working for as a consultant has developed IP which could potentially be worth billions. The confidentiality clause in the contract has penalties for breaching the ...
3
votes
2answers
728 views
SMS / voice call interception with a fake base station
This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...
3
votes
3answers
289 views
Is this a symptom of an attack (DoS/DDoS)?
I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one.
We have a search functionality in our website and the supposed attacker is ...
2
votes
3answers
119 views
I want to implement a new type of security feature over several platforms
I want to make a security feature that will go farther in discouraging people from looking through a secure system or server than what I have seen being implemented.
Specifically, is there a way (or ...
1
vote
1answer
577 views
How can log poisoning be successful with a Local File Inclusion attack?
I just read a paper about Local File Inclusion on exploit-db.com, it can be found here. One technique with LFI is log poisoning as you may know already. You do an HTTP GET request that contains PHP ...
4
votes
1answer
243 views
How do I check the code of a Chrome extension to make sure it's not stealing my info?
I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
1
vote
1answer
180 views
types of intrusions on host [closed]
I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur.I am just doing a literature survey over the atacks possible so I want to know that ...
4
votes
2answers
8k views
How do hackers take advantage of open ports as a vector for an attack?
It is widespread knowledge, and therefore a common practice, to close open ports on any machines connected to the internet.
If for example, a typical program uses port xyz as it's communication ...
6
votes
1answer
587 views
ASP.NET HTTP Response Splitting Attack
By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect:
...
1
vote
2answers
709 views
Microsoft ASMX Web Services Test form available on remote machines
I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized ...
3
votes
3answers
18k views
Is Teredo in my router a back door?
I use the school computer, which I bought from school, administered by the IT-department. I opened a port to my computer when I stumbled upon this:
It points to my computer IP. (I have a static IP ...
0
votes
1answer
119 views
Can web connections from a virtual machine guest using NAT attract attacks from the Web to the host?
The hosts OS might be Windows 7 and its firewall activated and the visualization is done by Virtual Box , but I think these details are less important.
This question might be related in some way to ...
7
votes
3answers
572 views
How bad is a Self Contained XSS attack?
Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
4
votes
2answers
245 views
How can I find out who owns a block of IPs?
I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
5
votes
3answers
206 views
Should user input be validated for it's length?
Is it bad not to validate length of user input to text field at server side. May it lead to such vulnerabilities as buffer overflows and other?
I think it depends on programming language of ...
11
votes
5answers
2k views
Index page has been compromised, suspicious files are showing up
My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
5
votes
1answer
342 views
Trying to prevent Cisco toll fraud
A little back story on the setup first; We have a Cisco VoIP setup at our remote office(where I'm at) and the main CCM/CCX/Unity setup is at the parent company across the US in Connecticut. We have ...
5
votes
4answers
718 views
Is this type of ARP poisoning attack possible?
I am wondering if it is possible to paralyze a network by sending out a bunch of fake ARP response packets.
Some basis: I recently read a moderately detailed description of how ARP and ARP poisoning ...
8
votes
4answers
597 views
Automated encryption detection
Is there any program that, given a cipher text, it would tell me what the encryption algorithm is?
What if I have the plain text? Is there something that can be done in that case?
5
votes
2answers
388 views
Is that possible? A router with arpspoof from factory
Just bought a 3G router from China and then checked the log:
[1970-01-01 00:00:00] The system will be restored the factory value.
[1970-01-01 00:00:00] The system current version: 1.0.5.1.
...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
3
votes
1answer
349 views
challenge-responce and man-in-the-middle
Is man in the middle attack possible in a typical challenge-response based authentication? For a typical reference one can go through this paper.
My question is that is it possible for an intruder to ...
9
votes
4answers
881 views
Real life examples of web site attacks
I've been put in charge of educating developers on web application security. One way I will be doing this is through an explanation of various web attacks (e.g., OWASP top ten).
In addition to an ...
15
votes
1answer
818 views
Security implications of rooting your android phone
My android smart phone has fancy features that I can get if and only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone has me ...
6
votes
1answer
99 views
Creating a Private Key using Human Intervention
In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain ...
4
votes
4answers
2k views
How to catch a gmail hacker/money-scammer? (in conversation with one right now!)
My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
3
votes
1answer
178 views
How to get informed in metasploit when a user does a reverse shell to my computer
I sometimes do reverse shells on metasploit but I'm not sure when my target will actually execute the payload. I would like an alarm of some sort to tell me when he does. this can easily be done in a ...
4
votes
8answers
5k views
How to simulate DDoS attacks from the Internet?
The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
2
votes
1answer
288 views
Need assistance diagnosing hacked website
Despite all my work to harden my website, someone has managed to hack it.
When loading the homepage in IE8, the page appears to load normally. Then, the status bar briefly displays a request to a ...
5
votes
5answers
2k views
What kind of attacks against home router's NAT do exist?
I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
3
votes
2answers
1k views
Some questions about penetration testing distribution Backtrack 5
I know just the basics of backtrack and I want to ask some questions about it:
Can you attack an ftp server using backtrack? an email server?
I have a Centos virtual private server and backtrack is ...
2
votes
1answer
2k views
How to Prevent This `Intrusion.Win.MSSQL.worm.Helkern`?
Sometimes my kaspersky Internet Security blocks this attack.
What is this and how can I prevent/solve it for ever?
3
votes
2answers
377 views
ICMP redirects and source routing in the wild?
Theoretically, ICMP redirect messages (IPv4 and IPv6) and source routing (IPv4) / routing headers (IPv6) are very dangerous. However, I'm curious as to if attacks using these features really work in ...
1
vote
2answers
377 views
How effective have statistical methods been at breaking encryption?
If we look at how statistical engines run on-line translators, and how they are built, we see that they look at a new language and run a statistical model over it searching for what's probably the ...
1
vote
1answer
225 views
Information on the phpMyAdmin probe?
Various IP addresses call various domains looking for various paths that might lead to PHP My Admin/scripts/setup.php
One of those IP addresses is 74.63.212.48 which I just now found out I could ...
3
votes
2answers
542 views
Reverse shell connections
Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice.
Would not most servers restrict outgoing ...
10
votes
8answers
698 views
Randomizing MAC addresses on bootup
Since it is possible to set custom MAC addresses, wouldn't it make sense to have a new one as often as possible/convenient (i.e. on bootup)?
It would seem that is useful to both attacker and victim ...
