Tag Info

Hot answers tagged

17

Yes, it can be done as (theoretically) every "computing device" is computationally equivalent to every other computing device. Look up the Church-Turing thesis if you are interested. However your question is grounded in practice and in this case the answer is "yes, but it would cost too much". Effort in virtualisation today aims at speeding up the virtual ...


8

Actually lorenzo's answer does not quite cut it. The Church-Turing thesis only provides us with a model of computing, it can't tell us anything about virtualization because it is not concerned with other aspects of a machine. But there is theoretical analysis for the ability of a machine to be virtualized by Popek et al: ...


4

This is a Parameter Tampering attack. Emphasis mine: The Web Parameter Tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form ...


4

I think you are confusing a couple of different ideas. Metasploit helps you leverage vulnerabilities in order to craft exploits. Those exploits are used to deliver payloads. The resulting code can be something the user needs to install, or Metasploit can allow you to deliver the exploit directly without the user being involved (depending on the ...


3

Put an actual computer in a physical sandbox environment. The computer itself isn't a sandbox and don't virtualize anything. Need active directory? Put active directory in the sandbox environment. Do your tests, verify what has changed, review computer and network logs. This is more practical than building a sandboxed OS which limits normal hardware ...


3

Turn off your own computer. Then, from a different computer, in this order: Change the router admin default password Change the wi-fi password Download a live distro that will clean the operating system of your own computer (you did not specify if you're running Windows, Linux or OSX) Then without connecting your own computer to the wi-fi: Boot up with ...


3

It may be that you need to narrow the scope a little in order to get started. Which aspect of security are you interested in. From the list of standards, you seem more interested in application security & especially in authentication and authorisation? That would be a much easier set of targets to learn at least to begin with. Also, you may need to be ...


3

I don't believe there is an official term. I might coin the phrase: "Constructive Shoulder Surfing" or "Iterative Shoulder Surfing"


2

I don't think someone hacked your PC through WiFi. I think your PC is infected with a Trojan (possibly Remote Administration Tool) so changing password is not a solution at all. I suggest you to clean the PC with good anti virus software in safe mode or reinstall the whole system if necessary.


2

While it is possible that your WiFi has been hacked it's not likely your computer was taken over using a compromised network device. You could have been attacked when on a public wifi, which would not require a compromise of the network device. What is more likely is that your computer was cracked using malware that was sent to you as an email attachment, ...


2

I suppose this fall backs to active RFID type of communication issues and, maybe 1-2 years ago, I read an article on the subject (sadly I do not remember the reference now). Researchers tried to authenticate under the following condition: The victim bearing the genuine RFID token was in some crowded public place (subway, ...), Attacker A goes near the ...


2

This attack is a variant of Shellshock, denoted by the bash code found at the beginning of the payload: () { :;} ;. The way you prevent your application from being scanning by bots is by disconnecting your server from the internet. Scans for remote code execution vulnerabilities like Shellshock are extremely common and are not going away any time soon. A ...


2

Usually referred to as payment bypass. A checksum based approach is often used where request details are hashed alongside a secret value on the merchant side and then validated on the payment processor side. Unfortunately a large number of these systems that I have observed in production do this incorrectly. I did a presentation on this at BH Asia last year ...


2

This is an attack on the integrity of your information, depending on how it's orchestrated it might be considered a man-in-the-middle attack or request tampering. Some common techniques to ensure integrity: Server side validation For example, if it's an online checkout then pass the list of products and calculate the total server side rather than sending ...


1

...practical, to build a sandbox that's identical to an actual computer... test every file and program in a sandbox before it is used... I think this is the wrong question to ask. The real challenge is not to build a sandbox which behaves like a real computer, but one which behaves like a real computer used by the targeted user. Malware actually uses ...


1

This is indeed a known attack on proximity based keyless entry systems. See http://eprint.iacr.org/2010/332.pdf for a paper by researchers who used a simple device to extend the range to 8m. Doesn't sound like a lot, but if you park your car outside your house at night then the fob is probably that close. It's from 2010, and so more modern cars may well ...


1

Yes, essentially it is. It is not what it is, but how it was achieved, which is what the hype is about. It is a JavaScript injection attack on a global scale - both in terms of impact and in terms of the technological challenge to make it happen.


1

What the report shows is not the uniqueness of the attack vector, but the systemization of the attack vector as a part of a national defence strategy. GC is an in-path system, capable of not only injecting traffic but also directly suppressing traffic, acting as a full “man-in-the-middle” for targeted flows. ... In addition, in contrast to ...


1

This sounds like a component of a broader targeted attack involving spear phishing. You might send a link to the victim for Banking.Example.com and begin your DNS reply spam for that domain. That way, you know which domain they are trying to resolve with DNS.


1

You could (should ?) also : disable ssh root login (You can still use sudo to do system administration) Disable password authentication and enable key authentication


1

They are not necessarily exclusive. They take advantage of different weaknesses. If you have the ability to do a "traditional" XSS through a reflected attack, then you likely wouldn't need to attempt a dom-based attack because you can inject any code you want before the page loads. In your examples, its not quite clear if you are differentiating the root ...


1

I observed that certain attacks could be both DOM-based and Reflected XSS No. What you list are the same payloads for both DOM based and reflected XSS (both attacks are often exploited in similar ways). But what happens underneath that is still either DOM based XSS or reflected XSS (well, or stored XSS). It's never both. The names for the different ...


1

Exactly as you are doing. The idea of open redirect vulnerabilities is to use the trust a user has in a specific website (the vulnerable site), and exploit it to get them to visit your website. So you would send this link to a user: example.com/?url=evil.com/sploitCode.php. Because the website they see is example.com, and they trust them, they will click on ...



Only top voted, non community-wiki answers of a minimum length are eligible