An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

learn more… | top users | synonyms

2
votes
2answers
208 views

How secure are the GPG/PGP keyservers?

Importing a GPG key with a KeyID or fingerprint seems to rely on keyservers. Doesn't this invite man-in-the-middle attacks, in which someone would alter the keys to allow them to decrypt the data? ...
2
votes
2answers
515 views

Can an attacker slow down my server without compromising it?

We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now. Yesterday, the server became unresponsive (it was definitely there though) for around an hour. ...
2
votes
2answers
199 views

What are stolen passwords used for?

Say there is a line of business application which has username/password datatable in the DB. Personal email address is not stored, and usernames are assigned by an administrator. Someone gains access ...
2
votes
1answer
549 views

Need assistance diagnosing hacked website

Despite all my work to harden my website, someone has managed to hack it. When loading the homepage in IE8, the page appears to load normally. Then, the status bar briefly displays a request to a ...
2
votes
2answers
1k views

Some questions about penetration testing distribution Backtrack 5

I know just the basics of backtrack and I want to ask some questions about it: Can you attack an ftp server using backtrack? an email server? I have a Centos virtual private server and backtrack is ...
2
votes
2answers
84 views

Are documented networks easier to attack? Are undocumented networks easier to protect?

I am learning about network documentation for the first time and have come across the following statement: Undocumented networks might not be protected and can be used to support insider attacks. ...
2
votes
2answers
7k views

Break in attempts from secureserver.net

Over the last few weeks I have seen dozens if not hundreds of break-in attempts from ip addresses which map back to secureserver.net. I know these are GoDaddy machines from the who is look up. ...
2
votes
1answer
274 views

Is my ISP hacking me? [closed]

Today I was trying to enter my routers admin page. I put the default IP address starting with 192.168. I couldn't login so ran ipconfig, and I discovered that I was assigned a Class A address. I was ...
2
votes
3answers
731 views

Insert string to memory with null character

I'm trying to implement return-to-libc, here's the code void func(const char *str) { char buf[4]; strcpy(buf,str); printf("you entered [%s]\n",buf); } int main(int argc, char *argv[]) { ...
2
votes
1answer
530 views

Can malicious phone software mount a MITM attack on a phone call?

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root. If I'm on ...
2
votes
1answer
1k views

How does Binding Images with Malicious Patches happen?

Well I don't know if this technique is still used, but about 5-7 years ago it was a popular way to deliver a malicious patch (Sub-7 , bifrost etc ..) to a victim. There used to be a program that ...
2
votes
2answers
856 views

Attacks surrounding /etc/hosts/

Although /etc/hosts/ is a file that comes up a lot in security, I am surprised to find there is no discussion here on this forum that describes how this can be used for an attack. Thinking about it, ...
2
votes
2answers
56 views

What can a user do in order to protect against CSRF attacks?

If I'm browsing while I'm logged in into my hosting panel or router or any other application, there is a chance of being hacked by a CSRF exploit. So, the question here is about user or client-side ...
2
votes
3answers
73 views

Should it considered a risk if an organization's server OS and version information is leaked? [duplicate]

I am assuming that it should be considered a risk because there may be several security issues of various OSes known to hackers. If a hacker gets access into the victim's network, the extra knowledge ...
2
votes
1answer
54 views

Is a 'remote' cookie replay attack possible?

Once a cookie is stolen from the session of a legitimate user, can I perform a 'remote' cookie replay attack on that user? I am successfully able to perform a cookie replay attack on the same system, ...
2
votes
1answer
151 views

Can TLS fallback work with server side support only?

I have patched my server with OpenSSL 1.0.1j for the Poodle vulnerability. Been reading the spec on TLS_FALLBACK_SCSV. From what I can tell in order for TLS fallback prevention to work properly it ...
2
votes
2answers
2k views

How effective have statistical methods been at breaking encryption?

If we look at how statistical engines run on-line translators, and how they are built, we see that they look at a new language and run a statistical model over it searching for what's probably the ...
2
votes
1answer
384 views

The impact of the Sony attacks on the security industry [closed]

First of all there was the PSN hack, which was compromised due to a vulnerable version of Apache and no Firewall and using a developer console. Then Sony Greece fell due to an SQL Injection attack. ...
2
votes
2answers
328 views

What steps can I take to identify what type of compromise of my computer has occured

I got involved in a strange scenario today :-) . Some 'UDPAgent.exe' file/worm/virus was trying to access my collegue's system and the antivirum program was showing that this particular thing is ...
2
votes
1answer
73 views

Defeating code injection attacks in x86

In x86 systems, there are three requirements for a code injection attack to work: write attack payload to memory attack payload to be executable divert control-flow to payload How can we prevent ...
2
votes
3answers
182 views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
2
votes
1answer
86 views

Who first introduced the notion of attack graphs?

I've been searching the literature and haven't been able to pin it down. The concept probably existed long before the name was coined, but who is the invention/introduction of attack graphs attributed ...
2
votes
2answers
5k views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
2
votes
4answers
172 views

Is it possible to communicate securely entirely over the internet given a global, resourceful man in the middle?

Assuming a global, resourceful man in the middle, is it possible to Securely communicate (I don't mean storing encrypted data off site) completely establishing and sending messages over the internet ...
2
votes
2answers
653 views

How to get URL behind REST-style

I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only ...
2
votes
3answers
3k views

MITM: tools for intercepting and modifying traffic?

I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request. For example: When I receive a request on port 25, I want to be able to intercept all the ...
2
votes
1answer
6k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
2
votes
2answers
619 views

Sun ILOM / Out of band management security concerns

I would like to get some outside opinion on this if possible, although I do not know what to ask. Sun ILOM is an Out-of-band management system. I understand it is a separate OS on the box that is ...
2
votes
2answers
822 views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...
2
votes
1answer
71 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
2
votes
1answer
166 views

Prevent cold boot attack on running laptop by overwriting ram [closed]

I'd like to use my laptop as a recording device when I leave home, but there would still be the possibility for a cold boot attack or with DDR3 RAM even warm boot attack is possible as I have read. ...
2
votes
2answers
264 views

How can an attacker access a system with a private IP address? [closed]

I am confused about this concept if a public IP is assigned to my router and my system has private IP address, how an attacker can access my system or can use my system as a BOT. Its a common scenario ...
2
votes
3answers
153 views

Security coding training best approach

To train the development team, there are various options one can take: inhouse presentation with code samples, CBTs so developers do it at their best time, instructor-led courses onsite or inhouse ...
2
votes
1answer
176 views

Are there theoretical attacks against ECC Digital Signatures?

I was asked to do a research about attacks on various digital signature schemes. There is one thing that bothers me for which I could not find a direct answer. For digital signatures that are based ...
2
votes
2answers
3k views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
2
votes
2answers
637 views

Someone logged on my Centos VM; Can they attack the host OS?

I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system. In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
2
votes
1answer
727 views

How to jam wireless AP?

The first comment under this question states: There are "smart jammer" techniques that are designed to mess with the protocol operations, not overwhelm the receiver with noise (e.g., for 802.11, ...
2
votes
1answer
174 views

What other place (besides libc) attacker redirect control flow to after an attack such as buffer-overflow succeeded

I am not sure this is a right place to ask this question or not. I want to know in previous or modern type of buffer overflow attack, when the attacker succeeded to overwrite return address, where ...
2
votes
1answer
370 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
2
votes
1answer
433 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
2
votes
1answer
267 views

amd64 safer than 686-pae?

Apart from stronger ALSR entropy... Is a system using amd64 any safer than 686-pae? What are the advantages, if any?
2
votes
1answer
955 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
2
votes
3answers
135 views

I want to implement a new type of security feature over several platforms

I want to make a security feature that will go farther in discouraging people from looking through a secure system or server than what I have seen being implemented. Specifically, is there a way (or ...
2
votes
2answers
2k views

Microsoft ASMX Web Services Test form available on remote machines

I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized ...
2
votes
1answer
3k views

How to Prevent This `Intrusion.Win.MSSQL.worm.Helkern`?

Sometimes my kaspersky Internet Security blocks this attack. What is this and how can I prevent/solve it for ever?
2
votes
2answers
72 views

Violation of security principles?

It's clear that keyless entry fobs, smart entry cards, NFC, etc. are vulnerable to relay attacks. Suppose they were improved by limiting the period of activity, eg let them be active only when they ...
2
votes
2answers
296 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
2
votes
1answer
132 views

While logged in to Google etc., can a malicious site discover my ID?

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit ...
2
votes
1answer
278 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
2
votes
1answer
257 views

How to detect if a user is logged in to a specific website?

I just learn about tabnabbing. Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular websites by impersonating ...