Tag Info

New answers tagged

0

Your question is somewhat unclear. Does the site already have Open Redirect vulnerability (https://www.owasp.org/index.php/Open_redirect)? If it does you proceed as tim already have said. If it doesn't and you are interested in general methods of getting your malicious code into its pages, then either you hack into the site ("getting shell"), or find some ...


1

Exactly as you are doing. The idea of open redirect vulnerabilities is to use the trust a user has in a specific website (the vulnerable site), and exploit it to get them to visit your website. So you would send this link to a user: example.com/?url=evil.com/sploitCode.php. Because the website they see is example.com, and they trust them, they will click on ...


2

The victim does not need to use the attackers name server, although this can make things easier. The main idea is, that the original DNS record is under the attackers control and thus also the TTL (time to live) of this record: Victim tries to access web site. To get the address it asks the companies DNS server. Because the record is not cached yet the DNS ...


0

Sometimes you get lucky and the app is built in a way that it will hold input state server side and reflect it back if it sees errors. This behavior may not be obvious by default because javascript validation may prevent you from ever seeing that postback (but it's added to make non-js browsers function). Try seeing if the input has a name parameter and ...


0

If u cant send the link, that would be a case of self-xss which involves the victim injecting malicious javascript snippets himself, which is a non-vulnerability in the bug bounties i have come across or even for professional assessments. However, social engineering attacks have been reported in the past wherein an attacker convinces someone to paste ...


1

"I can't find any documentation on how key derivation works. There are some mentions of PBKDF2, but that's about it. " DiskCryptor is very visibly derivated from Truecrypt and shares some of its old style constants. It uses SHA-512 with 1000 iterations as key derivation algorithm according to ...


0

Only the original 40-bit EXPORT ciphers are affected by the attack anyway. It is unfortunate that OpenSSL disabled the 56-bit EXPORT1024 ciphers back in 2006. And yes these are the only two categories of EXPORT ciphers in SSl/TLS.


1

Yes, it's the same for native apps. On Windows, you can simply assume that the application is using SChannel and be right 99% of the time; the same for MacOSX/iOS and Secure Transport. On Linux, you can run ldd /path/to/program/binary and inspect the output for either libgnutls (GnuTLS) or libssl (OpenSSL/LibreSSL). I don't know how you'd figure it out ...


3

The RSA "export" cipher suites can work a bit like ephemeral Diffie-Hellman: if the server's "permanent" key is longer than 512 bits, then the server is supposed to generate a new one (dynamically) of length 512 bits, and send it over the wire as a ServerKeyExchange message, signed with its permanent private key. See section 7.4.3 of RFC 2246. The private ...


0

1) Cool names count. Don't discount the value of public relations. 2) Heartbleed, BEAST, CRIME, and POODLE all impacted (or could be be reached through) web servers. Web servers tend to be publicly available, widespread, and directly identified (in the minds of the press and non-technical public) as "THE INTERNET." Therefore, these issues had a wider ...


1

The process for assigning a CVE's CVSS score to a vulnerability is very prescriptive. There is little room for interpretation, or to account for impacts which the are not accounted for by the scoring formula. So, in the end some relatively major issues will end up with oddly low scores, and some relatively trivial issues will end up with excessively high ...


4

Some implementations of TLS 1.0 did not properly validate the padding as required by the TLS specification. This led to a situation in which the POODLE bug could be leveraged against TLS 1.0, despite the fact that it should be secure against the attack. Later versions of TLS (i.e. 1.1 and 1.2) are inherently secure against POODLE and other padding oracle ...



Top 50 recent answers are included