Tag Info

Hot answers tagged

30

A few years ago (2003), there was this worm called "Blaster" (or MSBlast, Lovesan etc. - read more on https://en.wikipedia.org/wiki/Blaster_(computer_worm)). It spread by using a vulnerability in an RPC service, running on Windows XP and 2000. At the time where it was "worst", you could get infected within minutes, if you didn't have a firewall set up. I ...


16

There is no method to make WEP uncrackable, or at least secure. So I suggest buying a new router that suports WPA2.


8

Subdomain enumeration techniques are passive methods used during a pre-attack phase or during information gathering phase of a pentest assignment. Enumerating subdomains is crucial as they may point to different parts of a web application or may lead to another website hosted on another server with a different IP address. This allows you to come up with ...


8

There are two possible solutions here, the first might work, the second definitely works. What might work: Change your password Set up MAC address filtering: If your router supports it, you can define a MAC address filter to either whitelist or blacklist devices accessing the accesspoint. To do this, you will have to log into the administration panel of ...


6

What's the purpose of that in terms of security / hacking? It might show you other vhosts on the same domain. Think about blog.example.com which can be an old WordPress installation full with bugs and allows you to access a shared MySQL database or FTP user. Another example is for example admin.example.com. This can be relevant for your hacking ...


5

Before the attacker can send any data to the SSH server, he has to complete a TCP handshake. This means the attacker has to guess a 32 bit sequence number. (If SYN cookies are used, the attacker's chances may improve.) Assuming your server is generating good sequence numbers, this will significantly reduce an attackers ability to attack your SSH server ...


5

In short no. Because SSH runs on TCP (although there is a UDP version, this is unusual) a TCP handshake is required to commence the SSH protocol's own authentication and its following communication. A private address will not cross your perimeter router to and from the public internet so any spoofing of an internal address as it comes inbound (assuming no ...


5

It might be possible to be infected if your computer is directly accessible from the Internet (without NAT, router, etc.). But the attacker will need to find a vulnerablity in TCP stack of your operating system that would allow him to execute arbitrary code on the machine (e.g. by sending a malformed packet), and those are very uncommon nowadays. There can ...


5

Zero-Knowledge is an expression with a very precise meaning in cryptography, which does not match yours. Not using that expression would be a good communication move, even though you would not be the first person to abuse the terminology. The property that you want to talk about would be better called "mistrust". The point of it is to indeed increase ...


4

In the UK, law is a strong factor. The Human Rights Act 1998 states: Everyone has the right to respect for his private and family life, his home and his correspondence. So if any users that are caught up in the penetration test have an "expectation of privacy", then you are required by law to inform them prior to any testing. Note that just because ...


4

I assume you are talking about the Mask Attack and not Brute-force Attack which is outdated and replaced by Mask Attack. I had to add --pwd-min=8 to the list of parameters to force it to start at 8 digits from the get-go. Source: http://hashcat.net/forum/thread-1538.html


4

I say put up an IDS and/or enable firewall logging capable of detecting port scans. Wait for one to happen naturally, and then show the client the evidence that they're already being port-scanned. Alternately, you can simply schedule some downtime, unplug the WAN interface from the Internet, plug it into a standalone local router that pretends to be the ...


4

What's the purpose of that in terms of security / hacking? The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about available machines and resources. The underlying space of network (IP) addresses is sparsely populated (and IP:port combinations even more so), so narrowing down ...


3

The same exact rules apply to webcams as in the thread you referenced. If you put your webcam on an obscure port (not just 8080 or a common variant) then Shodan will not find it while crawling. If you keep your webcam protected from anonymous access (set unique user/pass settings for all accounts on the cam) then outsiders will not be able to see it even ...


3

When the credentials are wrong, the server sends you back a page containing the filled username and perhaps also the password. That should be done with https, and caching headers asking not to store it, but there's the possibility that the error page that was sent with the provided password in the source is stored somewhere (browser cache, an intermediate ...


3

What you describe isn't technically an attack. Nothing is exposed, nothing is exploited, and the parties involved are not affected. What you are describing is a phase of an attack called "Information gathering". Any targeted attack will involve Info Gathering at some point so that the attacker knows what to do to gain what is desired (DoS, access, data, ...


3

No. You cannot make WEP uncrackable, but there are some things you may be able to do to help the problem until you get a new router. Modify the signal strength. Take off one (or more) antennas from your router (if you have a small apartment). Move your router to the center of your home. These steps may make it more difficult for a neighbor to get a decent ...


3

WEP has fundamental design flaws preventing it from ever being secure. This means that in order to get a secure network you either have to replace WEP with something secure (WPA2) or enforce security at a higher level in the protocol stack. Security at a higher level in the protocol stack means you don't allow your AP to get access to the internet. Instead ...


2

Once C's browser has established that S is a known HSTS host (either via its preload list or by having previously received a valid Strict-Transport-Security header), self-signed certificates and similar security problems produce errors that the user can't simply click through. https://tools.ietf.org/html/rfc6797#section-12.1 So the answer to your question ...


2

First of all I would recommend you to create a test network and isolate it from the production network. Creating a test network: It depends upon your budget. If you have a big budget then buy couple of systems running Windows and linux, buy some switches and connect them with network cables. If the budget is not that big then try using virtualization ...


2

The default value of $GATEWAY_PROBE_HOST is 8.8.8.8, which the module initially contacts with a TTL value of 1. This is done to discover the current default gateway (since TTL will expire at the default gateway and it will send an ICMP time exceeded message). It seems like you have an invalid IP address in the GATEWAY_PROBE_HOST datastore option. Run the ...


2

For me the answer to this question largely revolves around the type of testing being undertaken. If you have a "proper" penetration test where the testers are simulating an attack, a decent quantity of the benefit of the test is seeing how/whether the attack is noticed and how the internal users/IT react (e.g. do they report it to the helpdesk if something ...


2

Those are default Linux "consoles" or virtual terminals (VTs), Alt+F1-F6. I don't remember seeing a system that didn't have them installed by default. You'd disable them by removing them from your init/systemd/upstart/whatever scripts. Documentation for your Linux distribution probably mentions that.


2

To be honest, as far as information security is concerned, any device connected to the Internet is vulnerable. Microsoft is correct in saying so. Imagine a scenario where you have multiple internal network nodes that communicate only internally. You decide to open up just one port on one node in the network to freely communicate with the external internet. ...


2

It all comes down to properly inform your client. You got hired for a reason, it's your job to explain your client this will not attract hackers. What's your scope? Isn't this stated in your statement of work (SOW)? Explain to them that if they want their public facing assets to be secure, an nmap scan is one step of the many ways to determine the level of ...


2

First of all, nothing is uncrackable. You can certainly make your passwords more difficult to crack, use better algorithms, but nothing would be uncrackable. In your case, you can try setting a longer password, so that it becomes more difficult to crack. Or else, you can upgrade your router which supports WPA/WPA2. If your router firmware supports, you can ...


2

Provided, you want to stick with the router you have, you can: Since it takes time to actually crack WEP since one has to collect enough IV packets, it makes sense to change the password on a regular basis. You can also automate the process. Go for MAC filtering. This will make things a little bit more complicated for the attacker. Go for the longest WEP ...


1

With your disconnected computer, you are describing an Air Gap. A quote at a recent security conference: "An air gap just means higher latency in the network" You are right that it is very difficult to be perfectly secure. Instead of trying to be perfect, try to improve. Do a self-assessment and calculate what your biggest risks are and then use ...


1

Edit: If you are connected to the Internet, then yes it is possible. When you say connected to the Internet (doing nothing else) Do you browse websites? Receive email? Connect to any other computer from the Internet? If you do any of these things, you can still get infected. If you do none of these things, then it is still possible (although ...


1

If you are just connected to the Internet (so you are not downloading anything), your computer cannot be infected, but attacker can get to your computer through an open ports. Another problem will be if you already have virus in the computer (like malware), it can use the connection to send data (e.g. passwords) to the attacker. So there is no possibility ...



Only top voted, non community-wiki answers of a minimum length are eligible