Tag Info

Hot answers tagged

31

The exploit is what delivers the payload. Take a missile as an analogy. You have the rocket and fuel and everything else in the rocket, and then you have the warhead that does the actual damage. Without the warhead, the missile doesn't do very much when it hits. Additionally, a warhead isn't much use if it goes off in your bunker without a rocket delivering ...


27

SQL injection most commonly happens when a programmer builds an SQL command by appending together (or interpolating) strings, using user-supplied input. e.g. Imagine this extract from a vulnerable piece of user authentication (login) pseudocode from a fictional web application. username = getPostData( "username" ); password = getPostData( "password" ); ...


18

I'm sure I posted an answer to this previously, but my google-fu must be weak this morning. From my blog post on Penetration Taxonomy, we have a list of testing types that is gaining acceptance. Also, working with the Penetration Testing Execution Standard we hope to further develop this. This list should help explain how to choose one over another. ...


16

Edit 2: Since this has been migrated to Security.SE, I should probably preface this with with: I'm not a professional cryptographer, and there are many, many reasons why you should never roll your own security. Having said that: It's a form of challenge-response authentication (with different challenges being sent each time). The algorithm to find the ...


15

It depends on whether you are talking about the concepts, the terminology, or the acronym. Concepts of confidentiality, integrity and availability of information have been used by war generals for quite some time; for instance, one can see Julius Caesar operating along these lines during the Gallic Wars and he was certainly not the first to grasp the ...


14

In computer security, they are used interchangeably. In the context of rights, permission implies consent given to any individual or group to perform an action. Privilege is a permission given to an individual or group. Privileges are used to distinguish between different granted permissions (including no permission.) A privilege is a permission ...


12

War-dialing is to telephone networks what network-scanning is to computer networks. A computer dials every number in a given number set to map out what's there. In olden days it was looking for unannounced modem gateways into interesting systems, and sometimes fax machines for fax-spam. The robust systems could tell the difference between fax machines, ...


11

This is commonly called "Security by Obscurity". I think you're aiming for some form of Challenge-Response protocol, but this is so trivially weak it's ridiculous. Don't even call it security... The "Obscurity" aspect here is that the total security of the entire mechanism rests on the fact that the attacker has no idea what this mechanism is. The moment ...


10

In addition to the answers already provided, I'll chip in on why you may choose one over the other. Vulnerability assessments are more useful if you're not sure of your current security posture and want to get an idea of where your issues may lie. It's worth noting though that like all security work vulnerability assessments are not all created equal. ...


10

It really depends on your point of view. From the outside, the "script kiddie" is, nominally, the wannabe attacker who uses tools written by other people (the "scripts"), without really understanding what is going on. Everybody uses tools written by other people (if only operating systems, C compilers, libraries...), but some people have a certain ...


10

Right now, there is no known weakness with MD5 or CBC encryption or 96-bit MAC as they are used in SSH. So there is, stricto sensu, no security benefit in enacting the configuration modifications that your are proposing. It could be argued that removing support for some algorithms might lead to security issues because it may prevent some clients from ...


9

Polymorphic code: The (same) code takes many forms (like encryptions) Oligomorphic code: The (same) code takes one of a few predefined forms (and thus can be possibly matched against signatures that can cover all cases) Metamorphic code: The code mutates, so the code itself is different in each execution (but the functionality the same)


9

Like the others have said, it is the technique of using a computer to dial down a list of phone numbers in search for other modems or fax machines. According to Wikipedia, the term was coined due to the technique's usage in the movie WarGames. https://secure.wikimedia.org/wikipedia/en/wiki/Wardialing It is also the root of the now more well-known term, ...


7

I read somewhere, I forget where, they divided hackers into three levels of expertise. The lowest level was Script kiddie. Script kiddies have very limited knowledge and almost no knowledge beyond the attack they are attempting. They may not completely understand the attack they are attempting. An example of this would be a person ARP poisoning a network ...


6

The terms come from a basic concept of grouping domains of related systems and people into individual fields where best practices can be established. A good breakdown of the terms and practices can be found here http://www.uscert.gov/ITSecurityEBK/EBK2008.pdf. Each domain presents unique aspects and vulnerabilities. If they are addressed individually the ...


6

Two points to consider: these are all relatively loose terms, and practitioners often have to be able to function in the roles of regular admins or programmers to be functional. That does not mean they have to be as efficient -- AppSec folks probably aren't as used to writing sorting algorithms, for example. Information Security Umbrella covering ...


6

Other posts have answered the basics of what war dialing is, but here is the reason you do it. A device in your network with a modem attached and reachable from the POTS, is outside the protection of your firewall. War dialing is part of our security program we do every six months as sometimes a physical modem is necessary for support from an outside ...


6

MITRE has a few systems for this. CVE for things that need patching; CWE for bugs that need to be avoided/fixed, CAPEC describing attacks to your infrastructure; CCE for configuration needs; CPE for a proper naming scheme; and CEE for event exchange information. http://makingsecuritymeasurable.mitre.org You'll find links to other resources that work along ...


6

You already know what a vulnerability is. An exploit is a piece of code written to take advantage of a particular vulnerability. A payload is a piece of code to be executed through said exploit. Have a look at the Metasploit Framework. It is simply a collection of exploits and payloads. Each exploit can be attached with various payloads like reverse or ...


6

XSS has a weird name. You don't need multiple websites for it. XSS essentially the html equivalent of SQL-injection. When a website outputs some attacker controlled text into a html document without encoding entities like <, > or " the attacker can inject hostile javascript into the html document which will run in the context of that document. If you ...


6

They are normally pretty interchangeable, though I've heard some systems where the permission is the thing that an action demands and the privilege is what the user has. So a user might be granted a privilege that corresponds to the permission being demanded, but that would really be semantics of some systems and isn't always the case. Either way, unless ...


6

Check out Intel's Threat Agent Chart: Page 8 -> https://communities.intel.com/servlet/JiveServlet/downloadBody/1151-102-1-1111/Threat%20Agent%20Library_07-2202w.pdf


5

To my knowledge, there is no generally accepted definition. Some papers in trusted computing define "trustworthy software" as software that works according to the expectations of the user. Rather subjective and volatile. Maybe you should try a different approach and use the generally more accepted term security engineering as a start. Ross Anderson's book ...


5

In general I'd suggest avoiding use of the word, because it's meaning in general English is completely opposite to the meaning of the original jargon word, which means that sooner or later you're going to confuse or irritate someone. See the New Hackers Dictionary, for example, specifically sense 8. (Warning: that's the kind of document you'll get sucked ...


5

I think this depends more on the implementation of the hashing algorithm than their ability to hash a null-terminated string including the null-terminator itself. A few of such occurances of hash function implementations were observed in TrouSerS (version 0.2 built on Trousers Software Stack 1.1, or earlier) used in Gentoo Linux as one of the crypto ...


5

I'll try put these terms in their respective context, which will make them a lot easier to understand. When a user wants to use your system, you authenticate them by making sure they're who they are, using passwords; certificates; cards; PINs; etc. Then check if they have the correct authorization, that is, you check if they have the permissions required to ...


4

I’m not game to write something long for this, but here’s a fun one that most pen-testers share: I have a client that has received passing PCI ASV scans for years (i.e. an external vulnerability assessment with no severe, high, or critical vulnerabilities found). A “clean” scan according to PCI. And for the last several years all of their internal ...


4

As far as I'm aware there is no universal naming convention, only vendor-specific conventions. For instance: McAfee: http://home.mcafee.com/VirusInfo/Glossary.aspx Symantec: http://www.symantec.com/security_response/virusnaming.jsp Sophos: http://www.facebook.com/note.php?note_id=13314014671 Each vendor has their own particular convention, but a lot ...


4

The trouble with this question is that there is not a strict/followed definition for what "penetration test" means in the industry. Some brilliant people from across the community got together to solve that problem, forming the "Penetration Testing Execution Standard." It attempts to define each stage of a penetration test in order to establish a reasonable ...


4

To most people -- they are the same. This is why efforts like PTES will fail. You cannot change people who do not want to change. The correct question is, "What is the difference between penetration testing and ethical hacking?". The answer to this question is that penetration-testing has a specific prize in mind, with no time limit and usually a long list ...



Only top voted, non community-wiki answers of a minimum length are eligible