Tag Info

SQL injection most commonly happens when a programmer builds an SQL command by appending together (or interpolating) strings, using user-supplied input. e.g. Imagine this extract from a vulnerable piece of user authentication (login) pseudocode from a fictional web application. username = getPostData( "username" ); password = getPostData( "password" ); ...

The exploit is what delivers the payload. Take a missile as an analogy. You have the rocket and fuel and everything else in the rocket, and then you have the warhead that does the actual damage. Without the warhead, the missile doesn't do very much when it hits. Additionally, a warhead isn't much use if it goes off in your bunker without a rocket delivering ...

Edit 2: Since this has been migrated to Security.SE, I should probably preface this with with: I'm not a professional cryptographer, and there are many, many reasons why you should never roll your own security. Having said that: It's a form of challenge-response authentication (with different challenges being sent each time). The algorithm to find the ...

War-dialing is to telephone networks what network-scanning is to computer networks. A computer dials every number in a given number set to map out what's there. In olden days it was looking for unannounced modem gateways into interesting systems, and sometimes fax machines for fax-spam. The robust systems could tell the difference between fax machines, ...

This is commonly called "Security by Obscurity". I think you're aiming for some form of Challenge-Response protocol, but this is so trivially weak it's ridiculous. Don't even call it security... The "Obscurity" aspect here is that the total security of the entire mechanism rests on the fact that the attacker has no idea what this mechanism is. The moment ...

Like the others have said, it is the technique of using a computer to dial down a list of phone numbers in search for other modems or fax machines. According to Wikipedia, the term was coined due to the technique's usage in the movie WarGames. https://secure.wikimedia.org/wikipedia/en/wiki/Wardialing It is also the root of the now more well-known term, ...

Polymorphic code: The (same) code takes many forms (like encryptions) Oligomorphic code: The (same) code takes one of a few predefined forms (and thus can be possibly matched against signatures that can cover all cases) Metamorphic code: The code mutates, so the code itself is different in each execution (but the functionality the same)

It really depends on your point of view. From the outside, the "script kiddie" is, nominally, the wannabe attacker who uses tools written by other people (the "scripts"), without really understanding what is going on. Everybody uses tools written by other people (if only operating systems, C compilers, libraries...), but some people have a certain ...

Other posts have answered the basics of what war dialing is, but here is the reason you do it. A device in your network with a modem attached and reachable from the POTS, is outside the protection of your firewall. War dialing is part of our security program we do every six months as sometimes a physical modem is necessary for support from an outside ...

MITRE has a few systems for this. CVE for things that need patching; CWE for bugs that need to be avoided/fixed, CAPEC describing attacks to your infrastructure; CCE for configuration needs; CPE for a proper naming scheme; and CEE for event exchange information. http://makingsecuritymeasurable.mitre.org You'll find links to other resources that work along ...

The terms come from a basic concept of grouping domains of related systems and people into individual fields where best practices can be established. A good breakdown of the terms and practices can be found here http://www.uscert.gov/ITSecurityEBK/EBK2008.pdf. Each domain presents unique aspects and vulnerabilities. If they are addressed individually the ...

Two points to consider: these are all relatively loose terms, and practitioners often have to be able to function in the roles of regular admins or programmers to be functional. That does not mean they have to be as efficient -- AppSec folks probably aren't as used to writing sorting algorithms, for example. Information Security Umbrella covering ...

I read somewhere, I forget where, they divided hackers into three levels of expertise. The lowest level was Script kiddie. Script kiddies have very limited knowledge and almost no knowledge beyond the attack they are attempting. They may not completely understand the attack they are attempting. An example of this would be a person ARP poisoning a network ...

In general I'd suggest avoiding use of the word, because it's meaning in general English is completely opposite to the meaning of the original jargon word, which means that sooner or later you're going to confuse or irritate someone. See the New Hackers Dictionary, for example, specifically sense 8. (Warning: that's the kind of document you'll get sucked ...

To my knowledge, there is no generally accepted definition. Some papers in trusted computing define "trustworthy software" as software that works according to the expectations of the user. Rather subjective and volatile. Maybe you should try a different approach and use the generally more accepted term security engineering as a start. Ross Anderson's book ...

You already know what a vulnerability is. An exploit is a piece of code written to take advantage of a particular vulnerability. A payload is a piece of code to be executed through said exploit. Have a look at the Metasploit Framework. It is simply a collection of exploits and payloads. Each exploit can be attached with various payloads like reverse or ...

SQL Injection is a technique of using valid SQL commands to tamper with, delete or inject data into a back end database directly through weaknesses in the validation of code input to a web application which calls that database. It is one of the OWASP Top Ten most commonly used attack routes as it is very simple to exploit. It can be used to compromise ...

As far as I'm aware there is no universal naming convention, only vendor-specific conventions. For instance: McAfee: http://home.mcafee.com/VirusInfo/Glossary.aspx Symantec: http://www.symantec.com/security_response/virusnaming.jsp Sophos: http://www.facebook.com/note.php?note_id=13314014671 Each vendor has their own particular convention, but a lot ...

It might have a more specific name, but it's a trivial form of handshaking: In information technology, telecommunications, and related fields, handshaking is an automated process of negotiation, that dynamically sets parameters of a communications channel established between two entities before normal communication over the channel begins. It follows ...

Have a read of this paper from the University of Missouri-Kansas City for a bit of info on this - it doesn't go into depth on the problem of colluded truncation attacks, but has some mitigation theory. The idea is that where mobile agents are collecting data, an attacker may try to truncate data in order to alter results, hide information etc. This is ...

Roughly, according to me: a virus got onto your system because it was 'carried' by something else; a worm got onto your system because it found a vulnerability in a network service on your system; a trojan got onto your system because you were duped into thinking it was a legitimate program and installed it So this axis of classification is about how ...

I don't think it's important to know whether these are "models". (I know nothing about CISSP, but if that's the kind of thing CISSP wants you to memorize, CISSP is inane.) That said, yes I'd say that Bell-Lapadula and Biba might well be called theoretical security models. Non-interference is in the same territory. Information flow too. But the more ...

Largely, these terms have no meaningful distinctions, with the exception of "web app security", and people use them interchangeably. Which term a person uses often reflects their background, such as government, or military, or financial. Or, what their first job was, maintaining servers, network equipment, etc. The reason is that these things heavily ...

The term has two meanings. In it's original meaning in the book, it is a malware program that an attacker uses to replace a legitimate program - like a cuckoo laying it's eggs in another bird's nest . More specifically, it was a replacement for atrun, which is executed every 5 minutes - meaning the attacker had to wait at most 5 minutes before his malicious ...

First if we ask what is security and what are we protecting, then we can realize that what vulnerability is. All vulnerabilities are security related, including all technical and non technical aspects. If something is threatening confidentiality, integrity and availability in any aspect then it will be considered as a vulnerability. A vulnerability cannot ...

This is one of those "it depends" situations. Systems are vulnerable to data loss due to power failure or disk drive failure or fire or water damage, for example, and so those could be considered "vulnerabilities" that are not "security related" because they do not result in unauthorized access to data or services or equipment and are not triggered on ...

An alternative response to the above is that if you're worried about security then focusing on algorithms is largely irrelevant, because where you'll get 0wned is through an implementation bug in your SSH server, not through anyone attacking the crypto. In particular if you're doing something like VPN'ing home from DEFCON then you need to defend against ...

You're talking about classifications that humans make, not some objective measurement of skill. When does someone become old? When is someone tall? Ask 50 people and you'll get a different answer for all of them. Script kiddies are simply beginners in "hacking". Hackers are simply those with more experience. There is no single universally agreeable point ...

I prepared an easier to read version of the diagram (I believe). It's following same basic principles the @D3C4FF's excelent answer does. I was tempted to go with his analogy first, but I thought it wouldn't be appropriate due to recent events and for the current global political climate. The target (self-portrait of a crested black macaque) is just cute, ...