Hot answers tagged attacks
7
Assuming that the password is randomly generated and not easily guessed, as you say the main way in which an attacker would compromise this system is to perform a MITM attack.
However any e-mail address based password reset system is vulnerable to the same kind of issue (e.g. one-time links) if the attacker can intercept traffic between the user and their ...
7
There are several risks when it comes to piracy, both legally and from a security point of view. I'll try to approach them as much as I can.
The downloaded files themselves:
Along with the .avi, .mp4, .mkv, etc. there might be some executable files, with some special icons that can trick the user into clicking them, thus executing malicious code.
The ...
4
I crafted an answer using Javascript, because it's what I am used to and no language is specified. I am confident that you can find/create an analog in whatever other language you please.
First off, I stole a function from This answer to create a cartesian product. The explanation of cartesian products is not really in the scope of this question, but ...
4
I don't think it's a vulnerability. When you think about it as a password sent in plaintext, then yes it's understandable to think there's a vulnerability here, but it's not a password.
Sending you a link like https://example.com/reset.php?code=97fy978y39fny39478fyn3 which is a one-time link that you click to be taken to a password reset form in which you ...
4
The Same-Origin Policy makes it impossible for JavaScript on A.com to read content from B.com. However, Same-Origin Policy does not prevent JavaScript or HTML on A.com from sending an arbitrary request to B.com. In order to prevent this, you need a method of CSRF Prevention, such as a secret token which would not work if the system wasn't blind.
The ...
3
It depends. Let me break each part down and answer more fully.
Can a home computer, not wireless, be hacked from the outside and have pictures copied?
Yes, if it has a network connection. No, not unless someone had physical access to it, or provided a network connection temporarily (such as connected a device like a cell phone via a usb drive to it). Can ...
3
Even without the threat of DoS, unrestricted authentication attempts is a problem in its own right. A common way of restricting authentication attempts at the protocol level is to force a given IP into waiting exponentially longer after each failed authentication attempt.
A cool feature of SSL/TLS is that it allows clients to resume already established ...
2
Check the username (or session identifier) first. If you don't have one in your handshake that is easily accessible, add one. Looking up an identifier is cheap. As long as you don't give away your identifiers, they won't have a large number of valid identifiers to throw at your login or hash function. If an identifier is being used repeatedly, lock it ...
2
There are are two possible explanations that are very likely:
It might just be a very simple botnet client that uses a hardcoded string as username. There is a number of press reports saying that botnets owner offer there services to third parties. So while creating a botnet requires a lot of knowledge, the person using the botnet might not have much ...
2
Yes, they are blind. The same-origin policy prevents pages hosted in one domain using one protocol [and sometimes also port] to making arbitrary requests to a different domain/protocol. So, one attacker would not be able to make a "CSRF Ajax request" unless your server supports CORS. What makes CSRF attacks possible at all are the exceptions for the ...
2
If the computer does not have a connection to the outside world (i.e: no internet) then the likelihood is no. There are very few methods that could be used to access a home computer without any sort of connection to the outside world. Physical access or possibly a blue tooth exploit would be practical in this instance.
If the computer does have a ...
1
First of all, CSRF attacks do not require any JavaScript at all. You can forge arbitrary requests with pure HTML to send arbitrary GET or POST requests via simple images or simple forms.
JavaScript would only be helpful to automatically send the latter forms as are not send automatically like a request for an image would. But you could also style the form’s ...
1
The first tool in my toolbox for generating permuted wordlists is RSMangler. So far, I wasn't able to find a better tool.
It's written in Ruby, it's open source, super easy to modify and extend, has a ton of options, and it's licenced under CC BY-SA UK.
You may easily extend the leet_swap array. For example
leet_swap = {
'a' => '@',
'C' => '(',
...
1
You're right that the referrer header can easily be spoofed or be completely missing. There are browser plugins that block the sending of the referrer, so if you add a check on the referrer, you would be stopping users with those plugins from using your site.
A better option would be for the first portal to generate a long random token for each user, and ...
1
You want to stop a possible DOS attack against the server, so why not put in an application layer aware firewall or a network IDS/IPS better still do both.
A Palo Alto firewall with the correct application layer rules would be able to identify the authentic traffic and forward it to the server while a Snort based IDS/IPS could be easily configured to drop ...
1
According to Martin Kleppmann:
the [default OpenSSH] private key protection has two weaknesses:
The digest algorithm is hard-coded to be MD5, which means that without changing the format, it's not possible to upgrade to another hash function (e.g. SHA-1). This could be a problem if MD5 turns out not to be good enough.
The hash function is only ...
Only top voted, non community-wiki answers of a minimum length are eligible
