An attempt by a threat to exploit a weakness in a system.

learn more… | top users | synonyms

0
votes
1answer
59 views

Oversized XML attack in axis 1.4

How can we prevent oversized XML attack in webservice implemented with Apache Axis 1.4?
25
votes
4answers
4k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
0
votes
1answer
72 views

What type of attack can bring a website down by serving a redirect loop?

My website has been up for a year and all of a sudden is down with a too many redirect message. www.jdmxchange.com (classifieds for modified cars/parts) I tried to use fiddler to see if it was ...
26
votes
4answers
4k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
4
votes
1answer
433 views

Is my server being used as a proxy or being attacked?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am unfamiliar with the security and server side of my project. Recently, my site was down because of "too many users" so when I ...
1
vote
1answer
49 views

Response on targeted attacks against an individual

I'm now an aim for a targeted attack. Someone tries to gather information about me and tries to get access to my accounts. Some time before he/they've managed to succeed (got all the info from my ...
-1
votes
0answers
15 views

Yahalome protocol is (not) secure. Why? [closed]

Let's consider Yahalom protocol. The wikipedia says that it is less secure than Needham-Schroeder and I know how to attack on Needham-Scroeder with MitM attack. But I can't see how to attack (in any ...
1
vote
1answer
71 views

What is an Origin Error Attack?

Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one. From The Forrester Wave™: DDoS Services Providers, Q3 2015 ...
2
votes
0answers
13 views

Find the source of a recurrent mass SQL edit on a server [migrated]

I'll try to explain my problem as clear as possible. The server of a company I support runs many websites. This server runs Windows Server 2012 with Microsoft SQL Server 2014. Almost all of the ...
3
votes
3answers
4k views

FIN Attack- What is this type of attack really?

I just wanted to know what exactly is the FIN attack. I know about the FIN flag that is used to indicated the closing of a connection via TCP. But what exactly is FIN attack?
3
votes
1answer
38 views

MDK3 deauthentication attack problem: Every station gets disconnected

Having echo >'ed the BSSID of the AP into a file called blacklist, I run the following command to start a deauthentication attack: mdk3 wlan0mon d -w blacklist -c 11 The problem is however, ...
0
votes
0answers
41 views

chrome red lock icon this page includes other resources which are not secure these resources can be viewd by others while in transit [duplicate]

In the accounts section showing my credit card details in chrome I click on the shield and click load unsafe scripts. The https is then crossed out in red. When i click on that I get this message. ...
1
vote
2answers
70 views

is the evil twin attack considered sniffing?

Is the evil twin attack included in the sniffing category ? I am really confused and i can't tell if it is.
3
votes
1answer
36 views

Reason behind HeapSpray format

I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs ...
1
vote
3answers
6k views

What is a salami attack?

Can someone give a clear definition of a Salami Attack? In the book Security in Computing (4th Edition) by Charles P. Pfleeger. It is stated as a attack to data integrity and I quote the passage: ...
0
votes
0answers
26 views

Is there a way for someone to block an email from reaching its recipient?

I don't know if this can be done with people who can email spoof your contacts but I've been noticing that my emails just aren't getting to where it needs to go. In the same vein, I also don't get ...
3
votes
1answer
67 views

How can I mitigate against chosen plaintext attacks for AES ECB?

I am developing on a platform where my only encryption option uses AES ECB. The encryption is used to protect parameters that the user can set, and so it susceptible to a chosen plaintext attack. ...
54
votes
8answers
12k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
3
votes
1answer
69 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET ...
0
votes
0answers
13 views

Unable to get buffer overflow working [migrated]

I am trying to learn about buffer overflow attacks and wanted to see a working demo of the same. I have been following many online resources to understand the same. For example, this has proven really ...
30
votes
3answers
27k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
3
votes
2answers
4k views

Break in attempts from secureserver.net

Over the last few weeks I have seen dozens if not hundreds of break-in attempts from ip addresses which map back to secureserver.net. I know these are GoDaddy machines from the who is look up. ...
1
vote
0answers
29 views

How to find which domain in my VPS triggered a DDoS attack with WP xmlrpc

Today, my data center suspended my VPS for DDoS attack reasons. They say one of my clients, that has WordPress website, started a DDOS attack to another websites using xmlrpc. But I don't know which ...
11
votes
2answers
148 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS ...
2
votes
1answer
41 views

Security implications of the contents of /proc/self/environ in LFI attacks

During penetration testing on a website, the tests have found a local file inclusion vulnerability in an old wordpress plugin that was installed. An attacker can exploit the LFI vulnerability to ...
4
votes
1answer
71 views

Antivirus constantly detecting tmp files as threats

Recently my antivirus has been constantly detecting threats and it's always tmp files. I delete maybe 50 of these files each day. A few days ago it detected a trojan. Last week it detected many ...
0
votes
0answers
32 views

Tools or scripts to automatically block IP's from threat feeds via IPTables?

Are there any tools or scripts that can automatically take IP addresses from STIX, TAXII, CybOX, MAEC, or other threat feeds and automatically reconfigure IPTables to block addresses found in those ...
1
vote
4answers
135 views

How to find public IP, if it replaced by NAT IP?

I designed a network architecture in cloud. I placed first IPS and then firewall (with Nat). I want to know if some attacks gone to internal networks which are not blocked by IPS. But I think these ...
-4
votes
1answer
88 views

I've been hacked what do I do? [closed]

I believe I may have been hacked, However I am not certain of this. I fear they are able to access my computer remotely. I have done several checks with advice from people online and it to some extent ...
8
votes
3answers
20k views

How to prevent my website from getting malware injection attacks?

My website was banned as a malware website by Google. When I checked the code, I found out that some code injected many files on my server. I cleaned everything manually, edited all files on my server ...
8
votes
1answer
106 views

Got a spam mail with an htm attachment, is the script harmful?

Today I got an email with an htm attachment, the mth contains the below code: <html> <head> <script> var url = "" window.location.href= url; ...
1
vote
1answer
80 views

What was the purpose of this attack if one took place?

Background Windows 7 Home Edition HP desktop (no av/no firewall/ remote assistance enabled) two external drives attached/no documents on internal drive connected to fios wifi (wep ...
1
vote
2answers
103 views

Router or Switch can defend against ARP spoofing attack?

I'm learning about ARP spoofing attacks. Can a router or switch defend against ARP attacks?
2
votes
1answer
39 views

Is a 'remote' cookie replay attack possible?

Once a cookie is stolen from the session of a legitimate user, can I perform a 'remote' cookie replay attack on that user? I am successfully able to perform a cookie replay attack on the same system, ...
4
votes
5answers
153 views

What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?

In attacks on programs, such as stack buffer overflows, what is the objective of the attacker? I’m having trouble learning the technical details of the attack (such as overwriting the function’s ...
0
votes
1answer
72 views

Mobile phone tracking, identification of the attacker [closed]

Once I was told that you can identify if your mobile phone is being tracked by someone (e.g. police), by calling placing a specific prefix to the number. This prefix in my country is normally reserved ...
3
votes
1answer
939 views

LogJam hardening OpenSSH and testing it [duplicate]

I would like to harden my OpenSSH (clientsite) after the LogJam attack. I read this article https://weakdh.org/sysadmin.html and there is one paragraph, which says how to do that. Is this enough and ...
1
vote
1answer
95 views

Must an attacker using a Smurf attack be on the same network as the victim?

I'm learning about Smurf Attacks. Since they need to use a broadcast address, doesn't that mean they can't work over the internet? For example if an attacker sends a router the packet with the ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
0
votes
1answer
45 views

Why is a DNS Amplification attack considered a DDoS attack?

My understanding is that a DNS Amplification attack involves sending a DNS resolver a bunch of requests with a spoofed sender address, which is the victims. The DNS responds to this IP address with a ...
5
votes
1answer
351 views

DNSspoof not working

My aim is to DNSspoof. My network is using a wireless router with the address 192.168.1.1 and primary DNS is the same as the router address. I have enabled Kernel IP forward in Linux. DNS host file ...
6
votes
4answers
43k views

How safe is the 256-bit encryption used in bank transactions?

Most of the banks use a 128-bit or 256-bit encryption. What does this mean? Does it mean that the keys used in SSL are 128-bit long or what? If they are the SSL key lengths then 128 bit RSA keys are ...
11
votes
5answers
3k views

How can I help catch an email scammer who is contacting me?

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
6
votes
2answers
89 views

Is there a formal common Internet threat model?

I'm looking for a common Internet threat model that describes active attacks formally. By active attacks I mean attacks of an attacker with literally unlimited resources and full control over the ...
0
votes
1answer
57 views

Man in the middle attack on loopback

We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?
-1
votes
1answer
150 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
5
votes
1answer
100 views

Dragnet TEMPEST Surveillance?

Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being ...
1
vote
1answer
84 views

Does NDP (Neighbor Discovery Protocol) reduce ARP (Address Resolution Protocol) attacks?

I read the comparison of NDP with ARP but am uncertain if NDP does reduce any amounts of ARP attacks, given that with NDP, ARP is not used for address resolution. For the discussion to be specific, ...
2
votes
1answer
65 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...
12
votes
4answers
2k views

How was (is?) the ping of death attack possible with IPv4?

While reading about Internet Protocol, I found myself reading about ping of death attacks: the thing that attracted my curiosity was the fact that these attacks could ever work! I mean, why wasn't ...