An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

1
vote
1answer
320 views

Determining the target address in a heap overflow

For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step : hdr->next->next->prev = hdr->next->prev I understand that the address of ...
2
votes
1answer
305 views

Can JavaScript defeat source port randomization?

Can malicious JavaScript defeat source-port randomization in browsers? I am reading a research paper which seems to claim that the answer is yes: many browsers seem to always assign a random ...
3
votes
1answer
140 views

Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?

Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
2
votes
1answer
220 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
4
votes
1answer
156 views

Computational Feasibility of finding 'Good Links' of the following format

I recently stumbled upon this and am checking here to see if what I am proposing is indeed feasible and can be considered a breach of privacy. For obvious reasons I am not revealing the website ...
2
votes
5answers
4k views

Efficient way for finding XSS vulnerabilities?

Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
4
votes
2answers
843 views

Memory Dumping - Cause for concern in Virtualization?

Recently, I started exploring threats to Virtual machines in general. The first question that popped into my head was whether a host machine can dump its entire memory onto a file, and inspect the ...
8
votes
2answers
235 views

How to mitigate the risk of a continuous integration service security breach?

We are using a Continuous Integration service to automatically run our product test suite. Every time we push code to our central Git repository production branch, the CI services is notified and ...
11
votes
1answer
5k views

Are SSL encrypted requests vulnerable to Replay Attacks?

Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?
6
votes
1answer
1k views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
2
votes
2answers
341 views

Is it a weakness to be able to see server side scripting?

Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. CLARIFICATION: ...
4
votes
1answer
420 views

How secure is NFC on mobile devices?

Near field communication is becoming more commonly available in modern mobile devices, such as smartphones and tablets. This functionality can be used to communicate between such devices, or with ...
4
votes
2answers
185 views

Most secure response for a server to return to a user scanning for exploits

I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc. Currently these requests all return 404 because ...
3
votes
2answers
922 views

I'm currently receiving a targeted attack

Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites: http ...
4
votes
4answers
651 views

VGA/HDMI Based Attack

Can I attack a PC via the VGA port? Is VGA one way or does it accept data from the other side? How about HDMI or DVI? And if so, are there known malware or PoCs to do that? or is it theoretically ...
9
votes
1answer
868 views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
3
votes
4answers
527 views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
10
votes
2answers
884 views

Security of Log Files - Injecting malicious code in Log files

As part of my course project I'm trying to understand various security frameworks and best practices. One of the very popular approach is to maintain Logs. My question is about the security of the ...
3
votes
2answers
175 views

Ftp constantly asked for a .exe file, what can i do?

I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
1
vote
1answer
443 views

Are there Bluetooth attacks on Smartphones that will not notify the user of the attack?

Are there Bluetooth attacks on Smartphones that will not notify the user of the attack? Specifically forcing a reset or opening an application.
-4
votes
4answers
320 views

Should companies use Crowd Source Audit Platform for Manual Penetration Test?

As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues? LE: So most of you guys downgrade, and said it's wrong to have ...
-1
votes
1answer
80 views

What are the supported versions of RHEL 5 by the NSA?

I have read through the document found at, NSA RHEL5 Security Requirements In reading through the document, it seems that you can use any version of RHEL 5 as long as it supports the requirements in ...
1
vote
2answers
700 views

How is iptables useful to prevent attacks against a LAN?

I need some advice securing a LAN using iptables. I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
1answer
1k views

HTTPS and cache injection

I understand the downside of this attack and what wrong can be done. But I dont understand how is it done ? Well, I need to educate myself, any pointers would be useful.
1
vote
1answer
296 views

What are security risks of serving user uploaded files without Content-Disposition?

Imagine a server that serves untrusted user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without ...
1
vote
2answers
2k views

SUN Remote Procedure Call Port 111 [closed]

I have found on my machine port 111 is open. This is listed as RPC. I understand there are possible attacks on this port. How can my machine be attacked if port 111 is open? How can I secure this ...
5
votes
2answers
3k views

Need help identifying the OSX process that's generating strange network traffic

Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like: Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
8
votes
2answers
2k views

Is it possible to do HTTP header injection if CR/LF are stripped?

In HTTP response there is the following header with attacker controlled content: Content-Disposition:attachment; filename="attacker_controlled.html" The only characters that can't appear in ...
1
vote
1answer
557 views

How to fix the audit failure in our web server

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network. Can anybody help me how to isolate and prevent this from happening? An ...
0
votes
2answers
610 views

How to encode letters in multipart/form-data to include CR/LF characters?

Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like: ------WebKitFormBoundaryQ7KGYev31biaJTW8 Content-Disposition: form-data; name="subject" ...
0
votes
1answer
541 views

Is this Ubuntu server configuration secure?

I'm new to Linux and security matters. I have a vps with Ubuntu 12.04 server and I wonder how secure this server is. I set up ssh passwordless login and disabled ssh login for root. I update security ...
13
votes
3answers
587 views

What prevents people getting charged over NFC in crowded places?

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
2
votes
3answers
2k views

MITM: tools for intercepting and modifying traffic?

I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request. For example: When I receive a request on port 25, I want to be able to intercept all the ...
-1
votes
1answer
207 views

Impact of attack occured in Radius, DHCP and HTTP servers on VOIP?

Assume we can crash the RADIUS server in a VOIP system. What would be the impact on the confidentiality, integrity, and availability of VOIP service. What would be the impact if the same question if ...
2
votes
2answers
82 views

Does the CVSS impact score correpond to probability?

From http://nvd.nist.gov/cvsseq2.htm , I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact , 0.275 for partial ...
0
votes
2answers
95 views

Looking for information about CVE-2006-6876 vulnerability

In order to study vulnerabilities of a SIP server and the impacts of DOS attacks on the QoS of VoIP service, I have found this vulnerability which can be exploited to cause DoS on SIP server. But I ...
4
votes
4answers
11k views

How to prevent my website from getting malware injection attacks?

My website was banned as a malware website by Google. When I checked the code, I found out that some code injected many files on my server. I cleaned everything manually, edited all files on my server ...
0
votes
0answers
35 views

more justification for the impact scores used by the national vulnerability database [duplicate]

Possible Duplicate: why CVSS give a score of 0.66 for a full impact on CIA? Good day ; the CVSS attributes the following impact values ​​for confidentiality, integrity and availability: ...
0
votes
1answer
112 views

How can I remotely detect versions? [closed]

I want to know how to remotely detect a software version. Once attacker knows the version installed, he can exploit published vulnerabilities. So it will be useful to know it when doing penetration ...
1
vote
1answer
829 views

syn flood size per second

Given the size of a TCP packet is 60 bytes, there is a SYN Flood attack on a computer made ​​by a 100 Mb bandwidth, the question is how many syn packets are sent in a second? Is there any formula for ...
0
votes
1answer
935 views

More information about CVE-2012-0883 vulnerability

I need to have more details about CVE-2012-0883 vulnerability published on : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883 Second, I need to know , what mean DSos mentioned on the ...
0
votes
1answer
133 views

why CVSS give a score of 0.66 for a full impact on CIA?

By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values ​​for confidentiality, integrity and availability: none : 0.0 partial impact : ...
2
votes
3answers
3k views

How should I defend against TightVNC brute-force attacks?

How should I defend against this type of attack? This is a tightvnc logfile excerpt from a linode cloud server running Ubuntu 12.04 (Precise) with the ubuntu-desktop package added to the bare server. ...
1
vote
1answer
179 views

Limiting database security

A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
1
vote
1answer
221 views

SNMP trap by legitimate program?

Is there any way to tell if this SNMP trap is something created by a legitimate program? Update: Hex Dump 0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
2
votes
1answer
654 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
1
vote
1answer
5k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
18
votes
7answers
813 views

Are common passwords at particular risk?

The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
7
votes
5answers
9k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
2
votes
1answer
606 views

Classification of attacks in network specially in Snort IDS

What are the main classification of attacks in network and specially in Snort IDS?! Is it possible to power up the Snort by classifying the attack into for 5 main groups, for example; R2L, U2R etc. ...