An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

2
votes
4answers
164 views

Is it possible to communicate securely entirely over the internet given a global, resourceful man in the middle?

Assuming a global, resourceful man in the middle, is it possible to Securely communicate (I don't mean storing encrypted data off site) completely establishing and sending messages over the internet ...
2
votes
2answers
602 views

How to get URL behind REST-style

I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only ...
2
votes
3answers
3k views

MITM: tools for intercepting and modifying traffic?

I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request. For example: When I receive a request on port 25, I want to be able to intercept all the ...
2
votes
1answer
6k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
2
votes
2answers
612 views

Sun ILOM / Out of band management security concerns

I would like to get some outside opinion on this if possible, although I do not know what to ask. Sun ILOM is an Out-of-band management system. I understand it is a separate OS on the box that is ...
2
votes
2answers
254 views

TCP- or UDP-based Port Scans, IP Fragmented Packet

Is this normal or is someone trying to hack/attack me? How can I stop this? My router is a Cg3000v2 netgear provided to me by Optus. [TCP- or UDP-based Port Scan]411 Wed Aug 26 00:28:08 2015 ...
2
votes
1answer
149 views

Enterprise Security : Where to Start? [closed]

I am trying to start self studying of Enterprise Security Context, but always feeling kind of lost among all the specs and standards etc. Unlike software development, this really is a challenge as far ...
2
votes
2answers
3k views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
2
votes
1answer
64 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
2
votes
1answer
153 views

Prevent cold boot attack on running laptop by overwriting ram [closed]

I'd like to use my laptop as a recording device when I leave home, but there would still be the possibility for a cold boot attack or with DDR3 RAM even warm boot attack is possible as I have read. ...
2
votes
2answers
224 views

How can an attacker access a system with a private IP address? [closed]

I am confused about this concept if a public IP is assigned to my router and my system has private IP address, how an attacker can access my system or can use my system as a BOT. Its a common scenario ...
2
votes
3answers
128 views

Security coding training best approach

To train the development team, there are various options one can take: inhouse presentation with code samples, CBTs so developers do it at their best time, instructor-led courses onsite or inhouse ...
2
votes
1answer
140 views

Are there theoretical attacks against ECC Digital Signatures?

I was asked to do a research about attacks on various digital signature schemes. There is one thing that bothers me for which I could not find a direct answer. For digital signatures that are based ...
2
votes
2answers
3k views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
2
votes
2answers
586 views

Someone logged on my Centos VM; Can they attack the host OS?

I'm using Windows 7 and decided to learn Linux Administration (Centos 6.4) using Oracle VirtualBox to host the Linux system. In my network configuration I choose "Bridged Adapter". I set the VM's IP ...
2
votes
1answer
635 views

How to jam wireless AP?

The first comment under this question states: There are "smart jammer" techniques that are designed to mess with the protocol operations, not overwhelm the receiver with noise (e.g., for 802.11, ...
2
votes
1answer
169 views

What other place (besides libc) attacker redirect control flow to after an attack such as buffer-overflow succeeded

I am not sure this is a right place to ask this question or not. I want to know in previous or modern type of buffer overflow attack, when the attacker succeeded to overwrite return address, where ...
2
votes
1answer
396 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
2
votes
1answer
256 views

amd64 safer than 686-pae?

Apart from stronger ALSR entropy... Is a system using amd64 any safer than 686-pae? What are the advantages, if any?
2
votes
1answer
925 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
2
votes
3answers
134 views

I want to implement a new type of security feature over several platforms

I want to make a security feature that will go farther in discouraging people from looking through a secure system or server than what I have seen being implemented. Specifically, is there a way (or ...
2
votes
2answers
2k views

Microsoft ASMX Web Services Test form available on remote machines

I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized ...
2
votes
1answer
3k views

How to Prevent This `Intrusion.Win.MSSQL.worm.Helkern`?

Sometimes my kaspersky Internet Security blocks this attack. What is this and how can I prevent/solve it for ever?
2
votes
1answer
49 views

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates Never deploy a site into production with DEBUG turned on. Did you catch that? ...
2
votes
2answers
62 views

Violation of security principles?

It's clear that keyless entry fobs, smart entry cards, NFC, etc. are vulnerable to relay attacks. Suppose they were improved by limiting the period of activity, eg let them be active only when they ...
2
votes
2answers
576 views

nmap detects opened port but can't connect with telnet

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere. sudo nmap -p 65000-65535 -sV x.x.x.x Starting ...
2
votes
2answers
276 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
2
votes
1answer
128 views

While logged in to Google etc., can a malicious site discover my ID?

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit ...
2
votes
1answer
227 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
2
votes
1answer
746 views

When SSL detect a replay attack?

Suppose an attacker records all messages of a SSL handshake (RSA one-way), and starts a replay attack. When (after which message) can the server possibly detect the attack? Now suppose the attacker ...
2
votes
2answers
454 views

I've found security vulnerability in current linux distribution. What next?

I've installed ubuntu server 12.04 on VM two weeks ago. I've created regular snapshots. XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server. One of ...
2
votes
1answer
925 views

How does Ram Scraper work?

I heard that during Christmas a lot of customer data was stolen using malware attack called Ram Scrapers. What exactly is a Ram Scraper?How would one infect a machine with it?What information can you ...
2
votes
1answer
349 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
2
votes
1answer
320 views

White-Box Cryptography Questions and References

I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on. As far as I can tell, WBC has ...
2
votes
1answer
8k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
2
votes
1answer
3k views

What is an active attack?

Browsing through the site I encountered this Is there a way to negotiate a secret between 2 parties with no prior knowledge? What is an active attack then?
2
votes
1answer
41 views

Security implications of the contents of /proc/self/environ in LFI attacks

During penetration testing on a website, the tests have found a local file inclusion vulnerability in an old wordpress plugin that was installed. An attacker can exploit the LFI vulnerability to ...
2
votes
1answer
65 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...
2
votes
1answer
26 views

Revoking AIK Key

How can I prevent attacks via compromised Attestation Identity Key (AIK) keys, such as having an attacker forging the cryptographic signature of an AIK key on TPM?
2
votes
3answers
157 views

What prevents a coder from brute forcing a wifi?

I know that a coder is able to connect to a wifi through code so my question is: Is there anything that will make it difficult to brute force a wifi password?
2
votes
3answers
119 views

Canvas fingerprinting identifies the OS?

I recently read this article, about how a journalist was hacked. She describes how they used a 'fingerprinting' technique to identify her OS. The way they use a one pixel image, it sounds like the ...
2
votes
1answer
179 views

Rootkits, Bootkits detection and protection and Firmware alteration

I was hacked in an extremely intrusive manner in late 2013. Ever since then, not a day has passed where I don't think about this. A lot. My question has to do with the likelihood of the attackers ...
2
votes
2answers
108 views

How would an attacker know the Gateway IP's of 2 VPN endpoints?

My office has two Sonicwall Routers each at a different physical location and with two different ISPs. There is an SSL-VPN tunnel between the two. Today I noticed that the same Chinese IP address ...
2
votes
1answer
287 views

Can windows passwords be recovered from the windows pagefile?

I was reading reasons for clearing page files on workstations with one reason listed is that passwords can be stored in the pagefile and therefore should be cleared upon reboot in the case of somebody ...
2
votes
1answer
1k views

How to find the pharmacy hack in a Joomla website?

We've discovered today that our Joomla website has been hacked by a pharmacy trojan. It was difficult to discover because most users don't see it when visiting our website. One user reported about 2 ...
2
votes
1answer
711 views

Clear the DNS server's cache?

Is there anyway for the attacker to clear the cache of a DNS server in order to poison it? For example, if someone attacked my DNS server in an attempt to spoof Google.com, they will receive the ...
2
votes
3answers
597 views

How good is validating source with request.referer than checksum?

I have 2 portals(both are under my control & domain names are different) In 1st portal, there is a link on click of which User can directly get logged into 2nd portal. Link which will be hit in ...
2
votes
2answers
459 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
2
votes
1answer
450 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
2
votes
2answers
134 views

Does the CVSS impact score correspond to probability?

From http://nvd.nist.gov/cvsseq2.htm, I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact, 0.275 for ...