Tag Info

New answers tagged


Try making a site delay. When anyone attempts to access the site, make it so there is a 5 second delay. Real users won't be bothered by this, but it will reduce denial-of-service attacks significantly.


I don't know what he is trying to do but returning 400 is fine. It stands for "Bad Request" so you server did not process the request further. You don't need to do anything as this request did just nothing.


This is a great question, because it highlights the importance of one of the three fundamental requirements of any secure protocol, i.e. integrity. (For the record, the other two fundamental requirements are secrecy and authenticity). The goal of integrity is to prevent a man in the middle from altering the content of a message en route from the sender ...


"Would it be possible for the attacker to change this packet before reaching its destination and modify it telling instead that I´ve got 0 health and then send to the server with modified values" They could intercept and alter the packet easily, but forwarding the altered packet to the server without the server knowing it's come from another user is the ...


Yes, it's perfectly possible. The answer is to use encrypted connections, since encryption protocols such as TLS/SSL and SSH will stop the attacker from seeing what's in the packets, and also allow the server to detect and reject any changes from what was sent by the client.


I got the same case, to check is your server are vulnerable to ShellShock: #!/bin/bash EXITCODE=0 # CVE-2014-6271 CVE20146271=$(env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test" 2>&1 | grep 'vulnerable' | wc -l) echo -n "CVE-2014-6271 (original shellshock): " if [ $CVE20146271 -gt 0 ]; then echo -e ...


Supported options will depend on your service provider. Any encryption of drives etc only protects the data when it is not being accessed / used. There is no practical encrypted processing at the moment; so if you are ever accessing / processing the decrypted files at the service provider, any intelligence agency with access to the data center, or the ...

Top 50 recent answers are included