An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

learn more… | top users | synonyms

7
votes
2answers
6k views

Need help identifying the OSX process that's generating strange network traffic

Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like: Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
7
votes
5answers
9k views

Is there a method to detect an active man-in-the-middle?

Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked? I think one of my friends is a victim of this kind of attack. How can I be ...
7
votes
1answer
324 views

Collision attacks on OCB?

I've been looking into the OCB cipher mode and everything I hear sounds good. I was planning on implementing it. Everything except for this lone voice, that is: Collision attacks on OCB: We ...
7
votes
3answers
1k views

Password list generation

I've found during a lot of recent pen-tests that companies will use passwords like c0mp4ny@b( for a company called "company abc" Is there any quick and easy way to generate a list of passwords ...
7
votes
2answers
352 views

Profiling attackers via adaptive games: “Strange game, the only winning move is not to play”

Use of Game Design to Profile Attackers: Interested in any research that links concepts in game design to security systems in an effort to profile the attacker's identity, motives, skills, etc.; if ...
7
votes
1answer
564 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
7
votes
2answers
7k views

Yahoo mail hacked - how to recover, how did it happen and how to prevent?

I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like firstnamelastname@spacepc.pt and firstnamelastname@revistaplot.com with ...
7
votes
1answer
328 views

What is the name for this type of URL attack?

Say a PHP page accepts URL path as a POST parameter (like the answer to this question): $path = $_POST['url_path']; file_get_contents('http://example.com' . $path); A maliicious user POSTs ...
7
votes
1answer
152 views

What should be included in the ground rules for an attack review?

I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics: Link to the policy that I want to enforce. Link to a minimal testbed and ...
7
votes
1answer
222 views

Kaminsky Bug DNS Cache Poisoning

I'm trying to use Kaminsky DNS cache poisoning method. I'm using bind9 server on ubuntu and static port. So far I achieved to insert a line into DNS cache which is ;additional www.blalba.com 80000 ...
7
votes
1answer
1k views

I can receive all PADI packets for PPPoE connections of my ISP, is that a problem?

for debugging why my router wasn't connecting to pppoe i've tried to connect via the pc, it worked, then i started wireshark just to see what was going on, and i've seen that i can read all the PADI ...
6
votes
3answers
652 views

How to respond to attack made from my dedicated server?

There was a sudden unusual peak of outbound traffic from my hosted dedicated server (OS - Windows Server 2008 R2). The hoster threatened to block the server if the problem is not solved. There are an ...
6
votes
3answers
26k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
6
votes
4answers
2k views

Is this type of ARP poisoning attack possible?

I am wondering if it is possible to paralyze a network by sending out a bunch of fake ARP response packets. Some basis: I recently read a moderately detailed description of how ARP and ARP poisoning ...
6
votes
8answers
4k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
6
votes
3answers
6k views

What is a Shrink Wrap code attack?

On my C|EH course I have heard about term "Shrink Wrap Code Attack", but we've only mentioned it. Now trying to do some research and refresh the topics, I can't seem to find serious description of ...
6
votes
4answers
2k views

VGA/HDMI Based Attack

Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side? How about HDMI or DVI? And if so, are there known malware or PoCs to do that? or is it theoretically ...
6
votes
3answers
1k views

Attack vectors for brute-forcing website passwords

When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
6
votes
2answers
2k views

How effective is an IDS at catching targeted attacks

I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies. I was ...
6
votes
2answers
865 views

UDP flood from my machine, or false positive?

The company that hosts my dedicated server has alerted me to what they think is malicious traffic coming from my machine. They supplied me with graphs showing a large amount of UDP traffic coming from ...
6
votes
3answers
563 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
6
votes
2answers
2k views

Memory Dumping - Cause for concern in Virtualization?

Recently, I started exploring threats to Virtual machines in general. The first question that popped into my head was whether a host machine can dump its entire memory onto a file, and inspect the ...
6
votes
1answer
10k views

What is packet drop, packet loss and how Packet drop attack works?

I confused with the three terms: Packet drop. Packet loss. Packet drop attack.
6
votes
2answers
2k views

Using skype for an attack

I am curious about something; let's say someone randomly added me to Skype and tried to initiate a chat with me and I want to know more about them but I am worried if they can do some damage. My ...
6
votes
1answer
255 views

AES-ECB chosen plaintext attack with long secret

I'm having some trouble understanding the methodology for a crypto exercise I'm doing. The goal of the exercise is to recover an encrypted secret string through a chosen key attack on AES in ECB mode. ...
6
votes
3answers
1k views

Lessen impact of DoS attack on cpu-expensive login?

This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing functions?...
6
votes
3answers
943 views

How to use and create attack graphs

I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I ...
6
votes
3answers
645 views

Random URL string: What kind of attack is this, and what can be done to stop it?

EDIT: It's been a little while since this was posted, but I'm here to report that this does NOT appear to have been some sort of attack after all. Rather, this particular URL string indicates a ...
6
votes
2answers
4k views

Strange STP traffic in my network, possible MitM attack?

I live at a student dorm, where we are connected to a student network. The administrators of this network have forgotten to disable STP broadcast on non-infrastructure ports. Periodically, I lose my ...
6
votes
2answers
112 views

Is there a formal common Internet threat model?

I'm looking for a common Internet threat model that describes active attacks formally. By active attacks I mean attacks of an attacker with literally unlimited resources and full control over the ...
6
votes
2answers
392 views

Tor versus direct monitoring

I know if I use Tor and maybe made a tweet, it gives the government a really tough time tracing the originator. But what if like a police car was directly outside my home for instance. Is it still ...
6
votes
1answer
195 views

Creating a Private Key using Human Intervention

In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain ...
6
votes
2answers
795 views

DNSspoof not working

My aim is to DNSspoof. My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address. I have enabled Kernel IP forward in Linux. DNS host file ...
5
votes
5answers
2k views

What password cracking software is commonly used?

I am curious to know how secure my passwords are. What password cracking software is commonly used? Preferably open source. EDIT: I am actually looking to crack my passwords used on services I don'...
5
votes
3answers
347 views

Can anyone be hacked?

I have often heard that if you are the target of a directed hacking campaign by say, a team of government hackers (whether Chinese, NSA, etc.), there is no way to prevent being hacked if they highly ...
5
votes
3answers
658 views

How do I protect myself against the attacks in this php script?

Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain directories),...
5
votes
1answer
6k views

Are passwords stored in the cookie? encrypted?

Whenever I connect to security.stack.exchange, I am automatically logged in. I haven't allowed the browser to store my password. When I delete all cookies stored by the security.stack.exchange, I have ...
5
votes
3answers
25k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
5
votes
4answers
1k views

Is this an attack and how can I fix it?

I don't know where to start in searching the forum for existing threads that might cover my issues. I recently received a spoof email pretending to be from a client for whom I've just started to do ...
5
votes
4answers
285 views

What kind of attacks result in an attacker only being able to leak a site's database?

Of the public disclosures I've seen from recently compromised sites, it seems common for only the database to be leaked, rather than the application code, or rather than a complete takeover. Is this ...
5
votes
4answers
2k views

What are the chances of a database being hacked?

How often do websites (and their databases) get hacked? Hacked as in user accounts stolen, tables flushed, and all in all, damage done to the database. I'm talking about e-commerce websites, and ...
5
votes
3answers
1k views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
5
votes
3answers
545 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
5
votes
5answers
430 views

Can SSL requests be proxied by issuing a second certificate?

Alice wants to login to her account at https://www.bobsbank.com/. However she clicks on a malicious link in an email and instead gets sent to the malicious site https://www.charliesbank.com/. The ...
5
votes
1answer
156 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
5
votes
2answers
6k views

Escalating from Apache shell to root

I have one noob question.I tried to exploit shellshock on my Slackware linux server, but after I connect with reverse shell and User Agent I get that I am apache user and apache user don't have too ...
5
votes
1answer
163 views

Voice Call Safety

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep. I was wondering if this procedure is secure against a malicious agent who ...
5
votes
3answers
980 views

Is this a symptom of an attack (DoS/DDoS)?

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one. We have a search functionality in our website and the supposed attacker is ...
5
votes
2answers
2k views

Is that possible? A router with arpspoof from factory

Just bought a 3G router from China and then checked the log: [1970-01-01 00:00:00] The system will be restored the factory value. [1970-01-01 00:00:00] The system current version: 1.0.5.1. [1970-01-...
5
votes
3answers
715 views

Web server file sniffing

What is it called when a user tries several attempts to figure out the files and folder structure on a web server? For example, the attacker will run http://example.com/test.jpg to determine if test....