Hot answers tagged

143

This sounds like the behaviour of an uptime service. These connect from multiple locations at a regular interval, and are designed to alert the server owner in the event of problems. In this case, it looks like the server owner had set up such a service, and then forgotten about it, since the server didn't have any problems - the alerting service wouldn't ...


34

These kinds of requests are commonly used for server fingerprinting. By sending a request that is likely to trigger an error other than a common 403, 404, 500, etc. they hope that the site operator did not set a custom error page, and that it will return a default error page with server type and version information. You'll often see really long URLs used to ...


2

It is the job of an Initialization Vector to cause the same message to have a different encrypted value when encrypted with the same key. An IV is essentially a nonce used to salt a message. As for why 1/256, that is the maximum possible values in a byte. A byte is a number that can range from 0 to 255. Including 0, that is 256 values. So a 1 in 256 chance ...


1

The ChaCha20 algorithm is simple enough that if you're curious about how it works you could just write your own implementation (but don't use it in production!). RFC 7539 is a simple reference that also comes with examples so you can easily check for correctness as you go along. But the way it works is that you XOR the message with a keystream that is ...


1

Yes, the principle and impact is the same. One of the specific properties of Rowhammer is that it is affecting nearby memory rows only (hence the name rowhammer). This makes establishing non-destructive attacks a challenge.


1

Yes, it is a problem, maybe even a big problem, but "XSS" probably isn't the right term. What could possibly go wrong? remote code execution using svg, especially older browsers off-site images leak your user's IP address (aka lat/lon), userAgent, and net performance malicious images themselves been vectors, lots of 0days in the past A special or even ...


1

No, in modern browsers no XSS is possible via the style or src attribute of an <img> tag. So neither of these would execute the JS code in any up-to-date browser: <img src="javascript:alert(1)"> <img src="x.jpg" style=background-image:url('javascript:alert(2)')"> Support for Javascript in CSS attributes has long been abandoned. You can ...



Only top voted, non community-wiki answers of a minimum length are eligible