An attempt by a threat to exploit a weakness in a system.
43
votes
2answers
5k views
What are rainbow tables and how are they used?
Where can I find one? Is there a pot of gold at the end?
How do I protect against them?
From the Area51 proposal
This question was IT Security Question of the Week.
Read the Sep 09, 2011 blog ...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
48
votes
18answers
3k views
What security resources should a white-hat *developer* follow these days?
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that ...
15
votes
4answers
1k views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
30
votes
7answers
21k views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
13
votes
6answers
1k views
What security risks does IP spoofing bring?
By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
27
votes
19answers
2k views
How can I prevent my kids from bypassing my computer restrictions?
My son has a downloaded copy of Ubuntu that he uses to "break" into my computer, bypassing Vista. I have two questions:
Can this damage my computer or corrupt my files? (I have lots of pictures)
Is ...
96
votes
8answers
8k views
Are “man in the middle” attacks extremely rare?
In
http://cdixon.org/2012/02/12/the-iphone-contact-list-controversy-and-app-security/
Chris Dixon makes a statement about web security
Many commentators have suggested that a primary security ...
30
votes
4answers
2k views
New XSS cheatsheet?
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
18
votes
1answer
1k views
Collision rate for different hash algorithms
Is there any collision rate measure for popular hashing algorithms (md5, crc32, sha-*)?
If that depends only from output size, it's quite trivial to measure, but I suppose that depends also of ...
7
votes
3answers
505 views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other or ...
19
votes
3answers
2k views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
8
votes
5answers
1k views
Access to a router's GUI
During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router.
I realise that someone could log on and be annoying to ...
10
votes
4answers
301 views
Resources for data on security incidents
What resources exist to research data on actual security incidents?
I would prefer an online resource but offline resources are acceptable. The cost of access should be less than $100 (US) for ...
2
votes
3answers
3k views
Does X-Content-Type-Options really prevent content sniffing attacks?
In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
5
votes
2answers
2k views
How can someone hack my PC if I am connecting to the internet through NAT?
If I own a private IP address, 192.168.2.1 for the sake of it, and I am physically connected to my router, which it's internal interface is 192.168.2.254 and it's external interface is some public IP ...
48
votes
7answers
35k views
Can webcams be turned on without the indicator light?
I want to know how secure I am.
I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone.
Recording an end-user's microphone seems to be a ...
12
votes
5answers
5k views
Security risk of PING?
I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
11
votes
5answers
2k views
Index page has been compromised, suspicious files are showing up
My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
10
votes
5answers
464 views
How to best defend against Targeted Attacks?
We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
4
votes
8answers
5k views
How to simulate DDoS attacks from the Internet?
The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
4
votes
1answer
1k views
Are SSL encrypted requests vulnerable to Replay Attacks?
Are SSL encrypted requests vulnerable to Replay Attacks? If so, what are good options to prevent this?
10
votes
3answers
435 views
Are there valid reasons for spoofing an address?
This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.
Are there valid reasons to spoof an address?
8
votes
4answers
362 views
CAM table attack in 2011?
Today's switches are vulnerable to CAM Table attack?
https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
5
votes
5answers
2k views
What kind of attacks against home router's NAT do exist?
I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
2
votes
1answer
161 views
How does Binding Images with Malicious Patches happen?
Well I don't know if this technique is still used, but about 5-7 years ago it was a popular way to deliver a malicious patch (Sub-7 , bifrost etc ..) to a victim.
There used to be a program that ...
1
vote
1answer
126 views
What are security risks of serving user uploaded files without Content-Disposition?
Imagine a server that serves untrusted user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without ...
0
votes
1answer
116 views
why CVSS give a score of 0.66 for a full impact on CIA?
By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values for confidentiality, integrity and availability:
none : 0.0
partial impact : ...
31
votes
8answers
2k views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
12
votes
6answers
2k views
Can I detect a MITM attack?
Based on this question here:
Are "man in the middle" attacks extremely rare?
Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it?
In addition, what if ...
14
votes
2answers
1k views
How can vending machines be hacked? And how can I prevent it?
I am developing a vending machine and want to make it secure.
In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
7
votes
2answers
546 views
How should one prepare himself for a job interview for penetration testing?
So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this.
Should it revolve around the ability to verbally explain ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
10
votes
5answers
826 views
SQL Injection in a Non-Web Application
Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
10
votes
2answers
812 views
4
votes
3answers
336 views
Create a page to experiment with SQL injection [closed]
This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
13
votes
2answers
259 views
Concrete figures on password cracking in the wild
While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs.
It's easy enough to test online password guessing ...
8
votes
6answers
213 views
Getting credentials using proxy server
Is it possible to get the username and password we enter into sites like facebook using proxy server?
The scenario is like this :
1.My laptop is connected to a network.
2.It is configured to use a ...
6
votes
1answer
590 views
ASP.NET HTTP Response Splitting Attack
By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect:
...
4
votes
2answers
496 views
How effective is an IDS at catching targeted attacks
I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies.
I was ...
13
votes
4answers
254 views
What should I look at in the event of a major vendor suffering compromise with unspecified impact?
The specific example I have in mind here is the breach of RSA in March 2011 where attackers got away with critical information which could be the seed information which is used to generate the ...
7
votes
10answers
385 views
Contract requires me to work with sensitive IP, severe penalties for loss of data to 3rd parties. Some protection pointers please
Background:
The company I will be working for as a consultant has developed IP which could potentially be worth billions. The confidentiality clause in the contract has penalties for breaching the ...
7
votes
2answers
586 views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
5
votes
3answers
650 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
4
votes
2answers
337 views
Memory Dumping - Cause for concern in Virtualization?
Recently, I started exploring threats to Virtual machines in general. The first question that popped into my head was whether a host machine can dump its entire memory onto a file, and inspect the ...
4
votes
1answer
446 views
How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?
What is CSRF?
I need a basic definition that is not just lifted from Wikipedia.
I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this.
I am using a ...
2
votes
1answer
220 views
secure website against the ping of death attacks
Any programmer is interested in securing his website. So I found this
http://www.youtube.com/watch?v=DB4eMFrQYiY&feature=youtube_gdata_player
which talks about crashing a website using cmd only. ...
8
votes
4answers
599 views
Automated encryption detection
Is there any program that, given a cipher text, it would tell me what the encryption algorithm is?
What if I have the plain text? Is there something that can be done in that case?
4
votes
1answer
233 views
How secure is NFC on mobile devices?
Near field communication is becoming more commonly available in modern mobile devices, such as smartphones and tablets. This functionality can be used to communicate between such devices, or with ...
4
votes
2answers
269 views
Are there volatile memory chips which dont retain data after power off?
It was demonstrated that dram modules can retain information up to 10 min after power off in certain conditions. My question - are there memory types which will retain data 10 sec at max even if being ...
