Tag Info

New answers tagged

0

If it's not anything registered it might very well be a UPnP vulnerability. In this case, a device on a LAN is infected (e.g. a "smart" TV), opens port 17275 on the home router via UPnP (see this answer) and waits for a connection. I'd suggest setting up a honeypot on that port and listen for what comes in for a starter. The nice folks at SANS' ISC might ...


7

So, perhaps a different way to phrase it: if I, as an end user, type in https://someorotherdomain.tld into a browser's address bar (and there's no certificate problem), how likely am I to be talking to someone else due to someorotherdomain's private key having been heartbled? You rightfully ask how likely, which does not demand a clear answer ...


20

Here is an example: My dad started getting browser certificate warnings when he went to Gmail. I looked in his hosts (C:\Windows\System32\drivers\etc\hosts ) file and some malware had edited it to redirect requests to gmail and a bunch of other sites to bad IP addresses that I assume the attacker controlled. His browser warned him because those bad IP ...


2

Within a cooperate environment the attacker could have been sniffing from a network switch however that network may employ anti-arp spoofing prevent the attacker from using tools such as SSL strip.. However now the attacker holds the encryption keys he would be able to decrypt all the traffic he had gathered previously.


0

Blocking all originating traffic with source port 53 will not solve your issue. DNS Amplification attack is sort of a volumatric DDOS attack, no matter how good your firewall can block/handle the bad traffic, your pipeline will still be bursted. You want to block the DNS spoof traffics as close to the internet edge as possible. Try contact the ISP for ...


0

You are looking for the IEEE public OUI database: https://standards.ieee.org/develop/regauth/oui/public.html With the vendor identified you can then zero in on the actual product.


1

Edit: itscooper's answer is the correct interpretation of the vulnerability in the THN article that the question linked to, in my opinion. The answer below is for the general question of how to hide js and have it be executed inside an image object. Historically, you could XSS some browsers by inserting "javascript:" URLs as image sources, because they ...


1

In the article you linked to, the Javascript code is not being included inside the image file itself per se, it's manifesting within the HTML page that references the image. Untrusted input is being returned inside the image tag without sufficient validation or sanitisation. This is persistent cross-site scripting since the malicious input is being returned ...


1

There are 2 ways you can do this, the first is simply writing a script in a text file and saving it as a jpg. This is obviously not an image, but it will work. If you want a real image, you can take your image and use a hexeditor to add your script to the image metadata. This works because the browsers interpret the code as they try to render the image into ...


3

Due to the use of the Diffie-Hellman key exchange, knowing the server's private key does not help a passive-only attacker. If the attacker wants to learn the data, then he must go active. If the attacker knows the server private key, then he can impersonate the server, i.e. run a fake server and let users connect to it. For a full Man-in-the-Middle attack, ...


1

If the client initially starts a connection with the correct server, then no, the attacker can't do anything against that connection, but if the attacker can get the user to attach to them instead, then they can play the middle man and make a connection with the client and a separate connection with the server as long as client certificates are not being ...


0

My guess would be that the worst an attacker could perform is impersonating the server, leading users to log into his system instead of the legit one. This actually means that attacker can read traffic, acting as proxy. Question is: will key-based authentication have some positive effect for client Answers of that question covering that in some ...


0

I recommend checking out a penetration testing specific Linux Distorts like Kali Linux / BackTrack . They have necessary tools to exploit pth attacks for vulnerable versions of Remote Desktop and other services. Read more from @ http://www.kali.org/tag/pass-the-hash-toolkit/


0

These kind of scans are more or less normal nowadays. I sometimes get dozens of them a day. Just make sure your server is hardened, especially the php installation. If you want to be on the safe side you may want to use a web application firewall like http://www.modsecurity.org/


2

Since I use php as an Apache module instead of CGI, and the http code was 404, I think nothing bad happened, right? right What was the attacker trying to do (or, if he was successful, what did he do) to my system? it was probably the first stage in a multi-stage-attacke(script); this is just the first scan, if you system is vulnerable or not.


2

very simple: the request-method is not GET, but XGET which is not known, thus you server reports error 501 do you run tomcat/jboss or a similar app-serever? i guess, not. this looks like a simple scan from some random skiddo who tries to find vulnerable app-servers but fails with the simple task of generating valid requests; the XGET looks interesting ...


0

Check out the OWASP website. The number two in the top ten is broken authentication and session management. Under this heading you will find examples that will answer this question.


9

This is a timing attack and the idea (including defenses against it) has been the subject of several academic papers. The short answer to your question of "will this work and has it been used?" is "yes". Some anonymity tools / networks (not sure if TOR does this) introduce their own latency and fake packets to make it harder (see "dependent link padding"). ...


2

fuzzdb contains a collection of web backdoor programs which if they were present on a live server would be a good indication that it had been compromised. This is likely why the A-V tool is reacting to those files. It is a common issue with penetration testing tools that A-V software regards them as malicious. However just downloading them is not going to ...


1

As @Philipp noted, it's not exactly clear, but if you are talking about a windows authentication null session, there are a lot of resources out there. Basically, it means you get access to some system resources shared on the network without needing real credentials to authenticate (log on). This existing definition is pretty good: A remote session is ...


0

Put the SSH behind the a firewall and require a VPN to access the box -- that cuts off one major attack vector and probably makes it trickier to exploit any application level penetration.


4

Your best bet is to install a web application firewall like mod_security and apply rules to nip this in the butt. Apply Duo Security, to disallow unvalidated sudo commands from a compromised account. fr00yl00p says: Configure the system to alert you upon logins (e.g. per mail in sshrc and bashrc) This becomes too cumbersome and complex if ...


2

Make sure you have all available patches installed Configure the system to alert you upon logins (e.g. per mail in sshrc and bashrc) Let your firewall drop connections with obvious attack patterns. (e.g. http://spamcleaner.org/en/misc/w00tw00t.html) Limit the maximum request size if possible (http://httpd.apache.org/docs/2.2/mod/core.html#limitrequestline, ...


0

I would at least talk with your hosting company. They may have some ways to help, such as by blocking IP address ranges before they can reach you, perhaps they can also set you up with other defense layers.



Top 50 recent answers are included