An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

4
votes
2answers
295 views

How can I find out who owns a block of IPs?

I'm currently going through the logs on my apache install for potential intrustions, and I'm finding a lot of hits for SQL injections and exploit testing, from 173.212.195.* . I'm now trying to find ...
5
votes
2answers
343 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
1
vote
5answers
695 views

Site backdoor & eval()

I'm running a Joomla 1.7 site which was hacked today. Below script did the hack. ...
0
votes
1answer
197 views

What type of attack should be used in order to pass this authentication

I am practicing the Astalavista Wargames and i came across this challenge. The question is: Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to log ...
3
votes
2answers
471 views

An attack from my Employer

I am working in an ISP company as a junior support specialist. Recently, I have a serious suspicions that one of our "head" stuff member is compromising me by being able to control(see) my traffic.. ...
4
votes
4answers
301 views

Security risk of adding a HTTP Header with server identifier

We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
1
vote
2answers
629 views

Secure against HTTP FLOOD ATTACK

What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
1
vote
1answer
320 views

Determining the target address in a heap overflow

For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step : hdr->next->next->prev = hdr->next->prev I understand that the address of ...
0
votes
1answer
145 views

What is the method used in the New York Times attack? [closed]

In the recent New York Times attacks, how did the attackers gain access to the server? Additionally, is there any evidence that these attacks were launched by China, aside from the proxy?
4
votes
4answers
391 views

Received a Kindle from a stranger, what are the risks?

While getting a coffee today, a man walked up to me and offered me a kindle. he said he no longer wanted it and that he was looking to give it away. An avid reader, I accepted. It has no accounts on ...
3
votes
2answers
800 views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
8
votes
2answers
3k views

How should one prepare himself for a job interview for penetration testing?

So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this. Should it revolve around the ability to verbally explain ...
4
votes
5answers
241 views

Can SSL requests be proxied by issuing a second certificate?

Alice wants to login to her account at https://www.bobsbank.com/. However she clicks on a malicious link in an email and instead gets sent to the malicious site https://www.charliesbank.com/. The ...
2
votes
3answers
1k views

Disadvantages of HTTP GET/POST Flooding Attack?

I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work. Now I want to find out what are the disadvantages of them.
109
votes
8answers
11k views

Are “man in the middle” attacks extremely rare?

In http://cdixon.org/2012/02/12/the-iphone-contact-list-controversy-and-app-security/ Chris Dixon makes a statement about web security Many commentators have suggested that a primary security ...
12
votes
8answers
1k views

Randomizing MAC addresses on bootup

Since it is possible to set custom MAC addresses, wouldn't it make sense to have a new one as often as possible/convenient (i.e. on bootup)? It would seem that is useful to both attacker and victim ...
1
vote
2answers
700 views

How is iptables useful to prevent attacks against a LAN?

I need some advice securing a LAN using iptables. I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
2answers
3k views

Snort false positive?

I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off: GPL SHELLCODE x86 inc ebx NOOP The payload is as ...
2
votes
2answers
2k views

Difference between masquerading and replay attacks?

I know that masquerading is to impersonate a false identity and replaying is the same wherein unauthorized person uses the credentials of the authorized one to have the privileges.Then what is the ...
8
votes
2answers
2k views

Is it possible to do HTTP header injection if CR/LF are stripped?

In HTTP response there is the following header with attacker controlled content: Content-Disposition:attachment; filename="attacker_controlled.html" The only characters that can't appear in ...
7
votes
1answer
964 views

ASP.NET HTTP Response Splitting Attack

By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect: ...
-1
votes
1answer
332 views

Why is it hard to catch cybercriminals? [duplicate]

Possible Duplicate: Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)? I really want to know why the attackers behind the major attacks like Diginotar hack ...
5
votes
6answers
2k views

What does it actually mean when someone says their website is hacked?

I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means. To me the only way to get control of website is get the FTP ...
0
votes
3answers
158 views

How to retrieve a site whose server is running Linux

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system. Actually, I'd like to be able to test the following command: nmap -O ...
2
votes
2answers
302 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
1
vote
1answer
116 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
2
votes
1answer
261 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
6
votes
1answer
737 views

What is the difference between Simple Power Analysis and Differential Power Analysis?

What is the difference between Simple Power Analysis (SPA) and Differential Power Analysis (DPA) and why is it not possible to do an SPA attack on FPGAs? My basic understanding is they are ...
57
votes
18answers
3k views

What security resources should a white-hat *developer* follow these days?

What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days? Do Include: Late breaking information on new security issues (RSS, Twitter, etc) A website that ...
2
votes
1answer
243 views

White-Box Cryptography Questions and References

I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on. As far as I can tell, WBC has ...
5
votes
5answers
4k views

What kind of attacks against home router's NAT do exist?

I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
2
votes
1answer
267 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
1
vote
1answer
434 views

Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?

I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable. I tried to test the ICMP rule by ...
4
votes
3answers
999 views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
1
vote
1answer
201 views

uninstall and reinstall after hacking [closed]

My computer has been hacked. If I uninstall and reinstall do I loose my files? The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
3
votes
3answers
363 views

Is this a web attack I should be concerned about - trying to enter code for form vars

I have a created a simple CGI script running on a web server where a user can login using a username and password. The username and password are entered via a html form and the form POST's the data ...
18
votes
2answers
2k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
7
votes
3answers
1k views

Can you extract memory contents from a hibernated Windows machine?

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk. When ...
5
votes
1answer
292 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
11
votes
1answer
5k views

Are SSL encrypted requests vulnerable to Replay Attacks?

Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?
2
votes
2answers
303 views

Attacks surrounding /etc/hosts/

Although /etc/hosts/ is a file that comes up a lot in security, I am surprised to find there is no discussion here on this forum that describes how this can be used for an attack. Thinking about it, ...
1
vote
1answer
620 views

Different Security Issues Depending on OS? [closed]

I'm interested in learning more about OS specific security issues if there are any. I'm very new to this topic but I want to learn more about if there are specific security vulnerabilities associated ...
8
votes
3answers
2k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
7
votes
4answers
969 views

Keyboard sniffing through audio recorded typing patterns

I've been thinking about this for a while; I know people are aware of wireless wiretapping of keyboards. However, has there been research on how to wiretap keyboards based on typing patterns? I'm ...
10
votes
2answers
692 views

In the recent DKIM vulnerability, how did someone determine key length by looking at headers?

Having read this recent article : Wired-DKIM vulnerability, I have a couple of questions. How can one determine the key length that is being used simply by looking at the headers ? And I'm assuming ...
2
votes
1answer
189 views

amd64 safer than 686-pae?

Apart from stronger ALSR entropy... Is a system using amd64 any safer than 686-pae? What are the advantages, if any?
11
votes
5answers
3k views

What is a DoS Attack and how does it differ from a DDoS attack?

Can some one explain to me the concept of Dos Attacks for web applications ? Also what is the distinction between Dos and Distributed Dos ( ie DDos) attacks ? Wikipedia says : In computing, a ...
16
votes
4answers
1k views

Security risks of scanning an unknown QR code

What are the security risks of scanning a QR code from an untrusted source? If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
18
votes
2answers
10k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
2
votes
2answers
273 views

Can an attacker slow down my server without compromising it?

We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now. Yesterday, the server became unresponsive (it was definitely there though) for around an hour. ...