New answers tagged intrusion
I don't have a copy of vBulletin myself to inspect, but multiple sources claim that their hashing scheme is: md5(md5(password)+salt) This is unfortunate seeing as md5 has some documented weaknesses, and is also a "fast" hash. Hashing processes used for passwords should be slow to make brute force attacks slow (and hopefully practically impossible). ...
The attacks you refer to are for example CSRF or DNS Rebinding, but there are also others. With some of these attacks one can only send a request (write-only) and with some the attacker can also read the response. The only full protection is probably to configure a browser to use a proxy for all requests (even local or internal ones) and then configure the ...
I think I figured it out. This potential attack is addressed with Same-origin-policy. A browser will only allow scripts to access resources from the same origin. https://en.wikipedia.org/wiki/Same-origin_policy
Top 50 recent answers are included