Attack vectors are methods and channels used by attackers during a hacking attempt.

learn more… | top users | synonyms

2
votes
0answers
24 views

Is there a database with XSS vectors, possible reference and test information?

I recently had the idea to develop a public database in which unique cross-site scripting (XSS) vectors will be registered and get a reference assigned similar to the CVE system. I made a local PoC ...
0
votes
0answers
44 views

What is the Linux Kernel attack surface? [on hold]

What is the full Linux Kernel attack surface ? meaning what are the vectors through which untrusted or unprivileged access interacts with the Kernel. For instance, system calls are an attack vector, /...
0
votes
1answer
34 views

Is there a way to calculate the complexity of an XSS-vector?

Is there a way to calculate/estimate the complexity of an XSS vector? I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
0
votes
2answers
44 views

Attack vectors and payloads [closed]

I have a question about malware. Malware attacks a machine through an attack vector. When it infiltrates the machine, it "unleashes" the payload. Now, let's say that I am infected by a virus, which ...
1
vote
1answer
19 views

Is KBA trustworthy?

I read on a different post about KBA, which is an identity verification concept that claims to verify a person by asking it about stuff just this person knows of, collected from "public information". ...
0
votes
1answer
24 views

Can an attacker extrapolate future codes based on past codes and their timestamps from a TOTP device?

I recently started using a TOTP fob to secure some of my cloud hosting accounts, and I'd likely to familiarize myself with possible attack vectors I should watch out for while I use this system (my ...
1
vote
1answer
43 views

Difference between local and physical attack vector in CVSS version 3?

In CVSS version 3, there are four different attack vectors. I am not able to differentiate between local and physical. Say, if I want to report "absence of logout button" I will use physical as ...
0
votes
2answers
82 views

Is it Social Engineering when a keylogger is installed from a compromised account on the domain?

So… this is a matter of definitions. Social Engineering (SE) is referred to as being related to psychological manipulation. The relation to manipulation is also prominent in the description made on ...
11
votes
5answers
3k views

Why do hackers scan for open ports?

So, whenever you hear of the mean little hackers who hack websites you hear of "port scanning". I understand what it is (looking for all open ports / services on a remote machine), however that begs ...
2
votes
0answers
69 views

Are ZeroNet websites susceptible to 51% control attack?

I've been reading about ZeroNet and thought about putting a site together but have concerns that it may be vulnerable to the issue laid out in What can an attacker with 51% of hash power do?. From ...
2
votes
2answers
56 views

Javascript videoplayer attack vectors [closed]

My team is building a Javascript-based video player for our own platform, instead of relying on other already available options like video.js. I'm wondering which attack vectors should I take into ...
1
vote
1answer
62 views

Password manager: should key file be stored on a different device than password db file (even if master pw used)?

Does it defeat the purpose of a key file to store it in the same location as the password database? What if a master password is needed also? For example I save my .kdbx to dropbox as a means to ...
-1
votes
1answer
112 views

XSS Vector without < or > symbols or equal sign?

Just wondering if anyone could help me out with some XSS Vectors that work without having the < or > symbols. Basically the the input is stripped from < and > symbols and any equal signs such ...
8
votes
3answers
721 views

How to protect contact forms against being misused for mass-mailing?

A common function of contact forms is to send the contact message not only to the site owner but also to the person who sent the contact request. What are good measures to protect against the form ...
1
vote
1answer
32 views

Can letting anyone create Dockerfiles result in RCE?

I'm about to build a web service that can be notified by Git that a push to a particular branch happened. Once this is done, the branch is checked out and docker build -t somename . happens. Is it ...
2
votes
1answer
155 views

XSS via -confirm()-

I was reading this article here, in the middle I saw the author used -confirm()- as the payload. I'd like to know what is this payload? I mean what's the difference between -confirm()- and <script&...
1
vote
2answers
73 views

How do you call an attack vector that consists of filling the whole server ram using a single process?

I’m aware of several attack method names, such as fork bombs or csrf, but how do you define an attack that consists of making a single request to fill the whole server ram with a single process? That ...
2
votes
1answer
31 views

Opening window from secure site domainA.com, to partner site domainB.com - with short TTL encrypted query string

I am looking into a proposal and need to find reasons as to why we might not perform the suggested solution. Here is the problem: www.domain-a.com is a secure website dealing with customer ...
4
votes
1answer
311 views

Is my router/modem compromised?

So I recently ran a port scan (just TCP) on my home router/modem (AT&T U-Verse) and found two peculiar ports that are open. Here is the scan output/results for nmap 192.168.1.254 -P0: Starting ...
6
votes
2answers
195 views

Questions regarding Rakshasa

Regarding Jonathan Brossard's Hardware Backdooring is practical talk at Def Con 20 in 2012: What does the developer mean by "The payload is booted via Networkboot"? How does the bootkit (a ...
14
votes
4answers
4k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
10
votes
2answers
148 views

Is Maven a plausible vector of attack?

You have a computer system, for developing and running your Top Secret™ project on, and you don't allow it direct access to the internet. However, you want to use Maven, for all the advantages it ...
5
votes
2answers
305 views

Can a Windows 7 PC with folder sharing and remote desktop disabled, still be penetrated by a rogue computer on the same WiFi or LAN?

Assume the network is already penetrated, and the attacker already fully controls another PC. Other than setting up a proxy to intercept traffic from all other systems on the network and use that to ...
6
votes
2answers
2k views

Attack vector, attack surface, vulnerability, exploit: Where is the difference?

I have difficulties to pinpoint the difference between attack vector / attack surface / vulnerability and exploit. I think the difference between a vulnerability and an exploit is the following: A ...
-3
votes
1answer
92 views

Attack Vectors an ISP could use

Id like to protect myself as good as possible from my ISP. I am aware of the fact that they could forward my requests to possible fake Websites containing malicious scripts or plug-in content. ...
24
votes
2answers
6k views

Is email from my WordPress site a hack or just a normal comment?

I received an email for my WordPress site, where the comment section is disabled. This was the email: "Author: google (IP: 210.56.50.40, 210.56.50.40) Email: guest@gmail.com URL: http://spider....
2
votes
0answers
69 views

Information on the Elderwood Project/Platform [closed]

I've read Symantec's whitepaper on the Elderwood Project and the blog update on the Elderwood Platform. They both make for a very interesting read, especially in the zero-day exploit meta-analysis ...
2
votes
1answer
164 views

Potential attack vectors using Javascript to log in [closed]

I would like to allow users of a website to be able to log in at any page. In order to provide a seamless experience my first thought was to collect user credentials (username and password) in a ...
3
votes
1answer
129 views

What sort of attack can reset MySQL Privileges and unmount remote drives without root or shell?

ATTACK VECTOR Monthly hits via a globally DDoS attack. Resolved with Cloudflare. Attacker can now somehow unmount network drive links and reset MySQL user permissions for applications. Attack is ...
0
votes
2answers
384 views

Google Analytics: Hacked or Ghost Referers?

I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior. I've got a web application ...
2
votes
1answer
130 views

How to prevent browser from rendering malacious content if request or response is hacked

We are currently working on OWASP security fixes and we identified one attack scenario for which we are trying to figure out a possible solution: User hits a valid HTTPRequest to our application. ...
10
votes
1answer
1k views

How can I find my home network's vulnerabilities when opening it for VPN connections

I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about. What tools can I use ...
1
vote
2answers
94 views

CSRF Implementation

I am working on website,where I want include csrf checks by using referrer checks,will this be sufficient way to protect the form from csrf attack? if not what an attacker can do to bypass it?
0
votes
1answer
39 views

Does a constantly dynamic cluster of short-lived instances reduce attack surface?

The 4am Idea The general idea is that every instance that gets launched on my cluster is preloaded with a 'suicide script' that after a preset Time To Live (say, 27 minutes) launches a replacement ...
0
votes
3answers
169 views

Attack vector: Internet Service Provider [closed]

I'm suspicious. I wanted to forward a port (80) on my router and noticed that port forwarding didn't work properly, it didn't work at all. So I replaced the router and again, port forwarding was not ...
3
votes
4answers
305 views

Remove pdf malware by re-printing to new pdf or text extract?

Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either: (1) open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program "...
14
votes
2answers
1k views

Are in-store computers a security risk?

In many "big box" stores like Walmart, Home Depot, etc. I see many store computers just sitting empty. A black hat could install a payload on one of these computers, and potentially wreak havoc on the ...
3
votes
1answer
251 views

PHP max_input_vars security expectations

Considering a site that handles large POST data, would it be unreasonable and dangerous to set the php.ini max_input_vars to something like 100000? I know this is a vector for DOS attacks, but don't ...
3
votes
2answers
177 views

How does infection through web surfing work?

Often I read about compromise due to visit a malicious site which download some exploit to your computer. I've never seen a detailed process, all books/tutorials I read just say sentences like "once ...
2
votes
1answer
324 views

What is this attacker trying to accomplish?

My client is who is running a recent version of vBulletin is getting lots strange activity and I'm at a loss to explain what the attacker is trying to accomplish. The attacker registers a fake user ...
2
votes
2answers
303 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( /js/bundles/&this.buttons....
16
votes
4answers
5k views

Can the Windows Schannel vulnerability be exploited by visiting a website?

Microsoft has just patched a vulnerability in Schannel that could allow remote code execution (MS14-066). What I can't find are any reliable details on how this can be exploited. I've seen some people ...
4
votes
1answer
294 views

Use of JavaScript by LastPass to encrypt & decrypt the password database a secure approach?

LastPass is a top-rated password manager that comes as a browser extension and uses a master password to encrypt and decrypt the password database using the JavaScript. Is this a secure way of doing? ...
3
votes
2answers
232 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
2
votes
1answer
192 views

Malicious *URLs*?

Everyone says not to click on "malicious URLs". Are there any attacks where the URL itself, rather than the resource accessed by the URL, is the attack vector?
3
votes
0answers
1k views

Comprehensive list of shellshock attack vectors [closed]

Currently I know of three serious attack vectors: crafted cgi parameters from a web client dhclient getting crafted hostnames from a DHCP server restricted SSH users getting full shell access I ...
3
votes
1answer
189 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
0
votes
0answers
497 views

How are you able to inject bash script through the user agent

I was looking over the new Bash exploit and was looking at this post in particular. Attack scenarios of the new Bash vulnerability What I don't understand is how does including bash in the user-...
22
votes
1answer
9k views

Attack scenarios of the new Bash vulnerability [duplicate]

Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test". What yet I haven't understand is, what ...
1
vote
1answer
254 views

Worst-case scenario OPEN URL REDIRECTION and why google not covering it in bug bounty

OPEN URL REDIRECTION as per in my opinion can be proved very dangerous by crafting attacks such as phishing. But it seems like google thinks it as a very low level bug and does not provide any ...