Tag Info

New answers tagged

2

In the presence of a global passive adversary, the shared secret in the sequence number is vulnerable to replay attacks. Moreover, this is true in the case of a man in the middle as well.


2

The difference is that SPA has a separate authentication step taking place over a UDP port before the SSH port is opened. In TCP Stealth, authentication is performed inside the SYN packet that initiates a connection with the protected service. An advantage of TCP Stealth is that it does not need to keep track of which ports are "opened". It only needs to ...


1

Leveraging other specialty tools to help you verify reported or potential vulnerabilities can help a lot. For example, using tools like XSS Validator to actually confirm JS execution. For SQLi, I will often fire up multiple copies of SQLmap to test the different reported SQLi vectors while I work on other tasks. There is probably no way to avoid manual ...


1

I personally see a lot of false positives with Cross Site Request Forgery. This may not be the answer you're looking for, but you need to verify them to the best of your ability. If you find something is beyond your ability you have a couple options: learn how to do it - this of course takes time and experience, a luxury we don't always have lean on a ...


1

Short version : there is no central / unique command to check this by default on linux .. but you could rely on several tools, depending on the kind of scanning that you would like to find : Fail2ban to parse log file (ssh server, web server, ftp, vpn, etc.) in order to find any brute force / irregular login attempt (and trigger some firewall rules) On ...


4

All the links that were up there weren't necessarily security issues. That wget for example was highlighting bots crawling webservers and giving security researchers some fresh blood to start looking for a C&C ;) More details : The bot are crawling internet like us, here when you see a wget ( http://un1c0rn.net/host/195.154.5.171 ) after an HTTP ...


8

If / is rendered by a cgi script, that script would be called with the User-Agent in an environment variable called HTTP_USER_AGENT. bash would look at all environment variables starting with () { to find function definitions and execute the function definition. In your example the function definition would then be: HTTP_USER_AGENT() { :;} Due to the bug ...


3

The values are just URL encoded, you can decode the query string using this: http://meyerweb.com/eric/tools/dencoder/ The first one: In this case the actual path is encoded. %63%67%69%6E/%70%68%70 -> cgin/php The actual query string decodes to: -d aluon -d mod -d suhon=on -d uncts="" -d dne -d auto_prt -d cgi.force_redirect=0 -d t_=0 -d ut -n The ...


6

It's not scanning for the "shellshock" exploit. It's scanning for an older exploit where a poorly-configured server leaves a copy of the PHP interpreter in the CGI directory, permitting remote execution of arbitrary code.



Top 50 recent answers are included