New answers tagged

5

Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean droplets that are online. Let me give you a very rough coding example. Let's assume your IP address is 104.16.25.4, which is www.digitalocean.com. Scanning is incredibly easy from a programming standpoint Let's assume we ...


0

Look here at the OWASP article regarding redirects. Check your PHP code.


43

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. For example, your web server should have open port 80, 443, and maybe 22; everything else should be SSH-tunneled or otherwise VPN'ed if you need to connect to ...


1

After I see someone scanning I usually do a little recon on who they are, if they are on known blocklists I usually ignore and let the firewall drop it (ASAs). If they are an unknown entity I'll add a rule to drop connections with our IPS from that IP. I have used suricata in the past and will give that a +1 as it could help in a situation like this as the ...


18

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up spot instances, scans blocks of IPs from a list, and turns them off once the results are shipped to the master server. If I was scanning your range daily you ...


3

I use Snort or Suricata on pfSense to automatically block IPs for a time period. Sophos UTM appears to have similar functionality.


0

Format your hard-drive, reinstall your OS of choice and then reset all your passwords online.


2

You can add the mac adresses you want to attack in a blacklist file, and run mdk3 with the -b flag. Since you used the -w flag, it disconnected everyone except the target.


2

The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc. It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.


0

Attackers who set up Evil Twins (An Evil Twin is a rogue wireless access point set up to mimic legitimate company wireless access points; many times the SSID is duplicated to make it look like it's the official SSID of the company) usually use some sort of sniffer/protocol analyzer, but the Evil Twin in and of itself is hardware; a rogue AP. To answer your ...


4

The point of a spray is that you don't always know exactly which block your object was allocated to. I believe it's because how volatile the heap can be. At any given time a block of memory could be allocated, and your NOP sled/shellcode could be interrupted. You see examples with predictable addresses because it makes it easier to learn the concept, but ...


2

The simplest way of dealing with this I can think of is to more or less implement CBC mode yourself. All it requires is for you to be sure of the block size used: Build a random (and unique) IV of the same size as the AES block size (128 bits). Encrypt that block and store the result (let's call it A) Build a chain of 128-bits blocks containing your actual ...


1

Since most everybody talks mostly of disadvantages (which are real), I'd like to share several advantages here: you really want to avoid automated attacks. Unless your are a high-profile user, vast majority of attacks will not be targeted to you, but automated best effort attacks which would just try default ports. Avoiding them helps in several ways: ...


2

Nothing to worry about. This is regular internet noise, there are a lot of robots on the internet scanning the internet, even doing full IP traversals from 1.1.1.1 to 255.255.255.255 so even if your domain name is known only by you, someone will eventually scan your IP address. Since the logs are calling javascript files there's nothing to worry about. ...


1

Using the PUT method, you can upload any file on the server. This can be used to perform Cross Site Scripting (XSS). Today, I have performed this attack, so replying here with my experience. How you do this is explained below. PUT /XSS.html HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT) Host: www.myblog.com Accept-Language: en-us ...



Top 50 recent answers are included