Tag Info

New answers tagged

2

They may only have access to the Apache user account, but there may be another exploit or misconfiguration on your particular system that would enable an attacker to elevate their privileges to those of root. Local privilege escalation happens when one user acquires the system rights of another user. Network intruders have many techniques for increasing ...


4

You are right that you gain access to the UID of the process/script you exploited. In the case of the Apache identity with no mandatory access control and no proper separation of developer and apache roles, you can: destroy or deface the websites run by your Apache change websites' code to leak all the user database at a fixed URL that you can then consult ...


1

MySQL uses /* */ as a block comment and no code will be executed within this block. What you are looking at is three injections, and only one will execute depending on the query that is augmented with this SQL injection attack. This is an efficiency hack to speed up the process of fuzzing a website for SQL Injection. If the injection point doesn't use ...


2

Even though noSQL databases are on the rise, the vast majority of web applications still use some kind of SQL database. The basic SQL features are standardized, so many simple SQL queries work on any SQL database. I doubt there is any database which calls itself SQL and doesn't understand password = '' OR '1'='1'. So in many cases it isn't even required to ...


1

Not trivially. What you're talking about is Public Key Infrastructure (PKI). The current implementation of it for SSL/TLS works in a hierarchical trust model. Your browser (and your OS) has a set of Certificate Authority (CA) certificates baked into it, which it trusts. Each certificate contains a CA's public key. When an SSL certificate is created for a ...


20

The fragment AND 1=0 always evaluates to false and therefore the query always returns an empty set, e.g. if the SQL fragment in the application is SELECT * FROM users WHERE username = '<placeholder>' then I can turn this query to SELECT * FROM users WHERE username = 'admin' AND 1=0 --' when using admin' AND 1=0 -- as value for the placeholder. ...


6

1=0 is always false, so a clause containing AND 1=0 will also always be false. This, like the always-true OR 1=1, can be used to bypass the conditions in a WHERE clause. The OR 1=1 variant is more generally useful (eg. SELECT username WHERE userid=173 to get your username becomes SELECT username WHERE userid=173 OR 1=1 to get every username on the system), ...


0

well it depends on so many things i will be "including some" . 1 web application most web attack are based on scanning lets take the Wordpress as an example you are trying to inject the database of an Wordpress based website .. & wordpress is not sql-I vulnerable but perhaps the plug-ins are vulnerable . you make a scan for the plug-ins installed on the ...


5

There are three common ways to deal with the variety of databases out there: Many web applications are tied to a specific database backend, rather than being able to use a variety of backends. For example, if someone's using MediaWiki, you know they're using either MySQL or MariaDB. An attacker can attempt to generate an error condition, then look at the ...


3

The url encodes a Windows Codepage 1251 encoded string, containing (harmless) russian error messages. The transcoded url is: /767/browser-wars-side-show-how-natty-handles-the-load/+++++++++[+Активация+]+Result: использован никнейм "azazalolxd"; вошли; не нашлось формы для отправки; Google translator gives: [ activation ] Result: used the nickname ...


0

If you have coded your application to properly sanitize user input, encode special characters before they get to the back-end, and reject data that is unexpected, you should have nothing to worry about.


1

You seem a bit confused about the concept. An open redirect is just a redirect. You browse to http://google.net/redirect?http://stackexchange.com and it tells your browser: please go to http://stackexchange.com. That it is an open redirect means that I can make it send you to anywhere (like an attacker web page), usually by embedding in the link the page ...


0

There are already loads of great answers already on CSRF here so I thought I would extend on them by offering an alternative approach to protecting against such attacks. If you are using Apache I would recommend using mod_evasive as this will protect against brute force attacks and also DOS attacks. If you are running IIS you can use the Dynamic IP ...


7

An attacker can conduct a bruteforce attack using Burp Intruder, with an extender extension to handle the CSRF token. Adding a captcha to the login page doesn't solve the problem, it raises the bar by forcing the attacker to break the captcha cracking service at 1,000 solutions for $1. To answer your question, neither a captcha nor a CSRF token is ...


11

Simple. You read the anti-CSRF token from the newly requested login page and each time the token is attached to the server's response. In this case, before you submit a POST request, you first read the response to your GET request from the server and the new token will be attached to it. Then you use it to generate new brute-force POST request. There may be ...


2

CRSF attacks work by tricking a user (usually already logged in), into performing a request that servers the end of the attacker (either by getting him to click on a hyperlink, through a method such as XSS). An anti-CSRF token protects sensitive requests, by requiring an unpredictable value (provided to the user on an earlier page) to be sent as part of ...


2

Similarities Both a dictionary and brute force attack are guessing attacks; they are not directly looking for a flaw or bypass. Either can be an offline attack or an online attack. An online attack tries automated routines providing input to a legitimate system. They are not looking to create an exploit in functionality, but to abuse expected ...


1

Dictionary Attack: The attacker tries a list of known or commonly used passwords. Thus, s/he tries a list (dictionary) of passwords. Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short and easy to remember like superman, harrypotter, etc. Brute Force Attack: Does not use a list of passwords; instead, ...


4

A brute force attack means probing the complete keyspace on the algorithm. A dictionary attack means that you probe only passwords/keys from a dictionary (which does not contain the complete keyspace). A brute force attack is primarily used against the encryption algorithm itself (you can also use this against passwords but there you use dictionary attacks ...


1

I think this journal paper answers your question -> http://iosrjournals.org/iosr-jce/papers/Vol16-issue2/Version-5/C016251116.pdf However, if an attacker(A) has unrestrained physical access to the PC, he can cause a lot of damage. If A is masquerading as a computer help person, A could easily break into computers, wipe the BIOS password and then boot off ...


3

Null byte injection in filenames was fixed in Java 7 update 40 (released around Sept. 2013). So, its FINALLY fixed.


0

The only thing that makes me wary in this situation is that Revolution is closed source. Especially since it can access your NAND flash storage with no restrictions, and in light of this who really knows what it's doing. Now, you can also look at this through a different lens. ClockWork is a less popular version of Android. With a less popular version, ...


1

There is no good software way to do this. Monitoring outgoing traffic on computer with the camera is no good solution as your traffic stats may be faked. If someone gains such a good access to your webcam to disable the light, faking traffic stats is not a huge step away. You could measure the traffic on your router, but then you would need to read the ...


0

Perhaps the best and only way to determine if your webcam is transmitting images without your knowledge would be to use a network monitoring tool to actually inspect the traffic packets themselves. Just because your outgoing traffic is 1kB/s doesnt mean images are not still being sent -just slowly or broken up. You best bet would be to install something ...


2

BREACH and CRIME don't compromise sites, because they are attacks on clients, not on servers. The server is still involved in that, for instance, TLS compression won't be used unless the server agrees; so that, even if the CRIME attack targets the client, the server can refuse to use compression and this indirectly protects vulnerable clients. Both attacks ...


1

From the BREACH Wikipedia page: BREACH exploits the compression in the underlying HTTP protocol. Therefore, turning off TLS compression makes no difference to BREACH, which can still perform a chosen-plaintext attack against the HTTP payload. However CRIME can be mitigated by removing support for TLS compression. In TLS the compression algorithm is ...


0

Check out the name of the device through Device Manager in windows. When you have the name you can look it up with Process Explorer. Is any process running your device?


0

My gut is that you don't know how long ago you've been hacked. By patching the site and combing for known vulnerabilities, you're basically hoping the hacker doesn't know what he's doing. The first thing the hacker probably did was to delete the logs and install multiple backdoors. Even if you properly patch the system, even if you scrub every ...


0

Generally speaking you should take close to the following steps: Secure your site and regain access Lock down the site and prevent all external access. Try to avoid "contamination" in the process by modifying potentially compromised files If you need to retain an on-line presence then set up something like a separate landing page hosted on an isolated ...


2

I would do a few more things to clean up the site: Change every password Yes, before you do anything, change all admin passwords, ftp, ssh, MySQL and so. Move all website's files to an inaccessible folder Take the site offline and put a Under Maintenance sign to give you time to fix everything. This will disable any changed file from the attacker. Shells ...


-1

You can scan the site to find if the hacker had put some javascript using the admin account. If he did it he can keep stealing cookies from site users! You should also change all passwords including MySQL password and FTP password.


0

I made a tool called PassGen that will do what you are talking about. You can take a look at it here. The idea is that you can pass in a target word and generate a password list using common substitutions. If you feel like getting a little more advanced you can also use the tool to fire HTTP requests to see if any of the passwords work. For your ...


1

Dictionary attacks aren't product-specific. People use the same passwords for everything. Just Google "wordlist" for links to hundreds or even thousands. It has to be compatible with the tool you're using, but most tools will accept a word-per-line text file.



Top 50 recent answers are included