Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

6
votes
2answers
453 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
4
votes
1answer
96 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
0
votes
1answer
70 views

Is pull inherently more secure than push?

Users of a service are waiting for something to happen - a money transfer for example. An attacker might forge an email notification, that executes an XSRF attack. Alternatively, I could leave it up ...
3
votes
0answers
73 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
2
votes
0answers
125 views

Installing a cocoapod and 'github' asks for login credentials?

I just added a cocoapod and got this >ls Podfile superApp Podfile.lock superApp.xcodeproj Pods superApp.xcworkspace >pod install Updating local specs ...
1
vote
0answers
45 views

How often does a user type in the “last 4 digits of SSN” in the “last 4 digits of Phone”?

This may sound dumb to a Security pro, but this is about end-users and worst case interaction with a challenge-response. Background Many 2 factor authentication sites request verification of the ...
1
vote
0answers
324 views

WifiPhisher not creating a fake access point

I recently came to know about WifiPhisher. To test it, I set up an access point using my Windows laptop and tried to obtain its password using this tool in my Ubuntu machine. So, when I run the ...
1
vote
0answers
194 views

Open redirection unique token bypass

I am currently analyzing one job portal web application in which there is an open redirect vulnerability. Vulnerability description is as follows: Request type: GET Vulnerable Parameter: dest ...
1
vote
0answers
418 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
0
votes
0answers
124 views

deliver a malicious payload via a cloned website

I've been tasked with conducting an internal pentest, I'm relatively new to this so please bare with me. Some time ago, I used setoolkit and I would have the option to clone a website and attach a ...
0
votes
0answers
30 views

Security Flaw in all “logging by” system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...