Questions tagged [attack-vector]

Attack vectors are methods and channels used by attackers during a hacking attempt.

Filter by
Sorted by
Tagged with
0
votes
0answers
78 views

Are there any documented cases of attackers using 'Free Trials' as an attack vector?

We live in an age where a lot of services are hosted in various cloud-based infrastructures. And a lot of these infrastructures are based around a "pay as you go model". I.e. The more servers you spin ...
1
vote
2answers
160 views

If a vulnerability has no relevant attack vectors, is monitoring still legitimate for a company?

Today while reviewing vulnerability scan results with a colleague, we had a debate about what vulnerabilities can be considered "true or legitimate" and hence worthwhile to spend resources in ...
0
votes
0answers
33 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
0
votes
1answer
181 views

Client HTTPS request redirection attack

Assume a Mam in the Middle that wants to redirect a client's HTTPS (Secure HTTPS) request from a.com to b.com. The MitM can not impersonate neither a.com nor b.com. The MitM does not have to use a TLS ...
0
votes
2answers
181 views

How to conduct this MITM attack [duplicate]

For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is: 1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The ...
0
votes
0answers
85 views

Server Side Template Injection for EJS template in NodeJS

I'd like to create a Web-App with Server-Side Template Injection vulnerability in NodeJS. The template used in the Application is EJS with Express-Framework. Below are the code bits: index.js (...
0
votes
1answer
98 views

How to implement an active Man-In-The-Middle attack that changes the request URL address

For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack. The attack scenario that I want to do is a toy example (which has countermeasures ...
65
votes
4answers
9k views

Is an up-to-date browser secure on an out-of-date OS?

Windows 7 support will end on January 14, 2020. Assuming that after that day I still use an updated browser, is it true that I'm still safe? Can it "patch" the OS-based security holes? Minor question:...
1
vote
1answer
94 views

What attack vector is prevented by using the 'coupling code'?

In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app. This requires the ...
1
vote
2answers
63 views

File upload attack vectors when file is not saved to disk

I'm curious to know if there are any significant threats presented by files which are uploaded and read but are never saved to disk? I've read countless articles about file uploads regarding storage ...
1
vote
2answers
147 views

Why are top-level wildcard bindings unsafe?

Microsoft has the following to say about configuring asp.net core with http.sys: Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create ...
2
votes
2answers
83 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
0
votes
0answers
59 views

What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2. I have gone ...
1
vote
2answers
496 views

Is it poor practice to use the last 4 digits of a social security number as an identifier?

Is it poor practice to use the last 4 digits of a social security number as an identifier? The last 4 digits of a person's social are commonly used as a means of personal identification/...
2
votes
1answer
74 views

Am I someone else's vector?

I have a site that is open to the public, that exposes no resources that need authorization. I have a use case that should support return URLs. In some cases, the site will redirect the session to a ...
1
vote
1answer
695 views

What is the effect of the arguments in the following: conhost.exe 0xffffffff -ForceV1

I'm fairly well acquainted with the role of conhost in Windows. I am aware of conhostV1.dll and conhostV2.dll so I assume force V1 would force the legacy mode of conhost (as in Pre Win 7 mode when it ...
2
votes
1answer
242 views

Are nearby attackers dangerous?

It is a general consensus that physical access can be dangerous. However, I would like to know attack vectors if attackers only get nearby access to the system. I’m assuming that the word access ...
6
votes
3answers
257 views

What is the (literally) lightest way to run a second secure system?

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with ...
0
votes
1answer
320 views

Port forwarding to ip address in LAN that is not available

Consider the following situation: In a LAN the router is configured to forward one incoming port from the WAN to a specific local ip-address/port. My question is, how is the security in this ...
0
votes
1answer
79 views

What attacks does the disclosure of VPN user credentials allow?

Many popular VPN services (that provide encrypted tunnels between the users' devices and distant VPN servers) authenticate users using a pair of email address and password. What attacks would the ...
1
vote
1answer
115 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
2
votes
4answers
405 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
2
votes
3answers
127 views

How secure is using Saving Session Feature on WinSCP?

I ssh to my AWS instances via WinSCP and it has public-private key authentication, password authentication is disabled. All the sessions are saved on WinSCP, so I click on the IP of the machine and I ...
0
votes
1answer
67 views

What can an attacker do with an OpenID token

Say an attacker had access to a list of OpenID tokens, what could the attacker leverage with that to access a system? Would they need to have another piece of information, MITM? Or can they just use ...
1
vote
1answer
2k views

“Flow” between computers (Logitech mouse)

Logitech (and possibly other) mice offer a feature called "flow": mouse can pair with uop to 3 devices (PC, handheld, ...), and can mark, copy & paste content (even files) between these 3 devices (...
2
votes
2answers
575 views

How to kill a process with multiple threads?

I'm dealing with a malware which has multiple threads monitoring each other, I'm unable to kill all of them at once so I can't get rid of it, how do I go about this? I was thinking about using a ...
0
votes
2answers
588 views

How effective are timestamps as a countermeasure for Replay attacks?

I was reading the Wiki entry for Replay attacks. It mentions that timestamps can be used as a countermeasure against such attacks: Timestamping is another way of preventing a replay attack. ...
1
vote
0answers
100 views

Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?

It's sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don't necessarily conform perfectly [...
1
vote
2answers
96 views

About security of web application - user attached files [closed]

I have a web application (forum software) where I am working on a feature about user attaching files to the forum posts. The application is written in assembly language and the database is SQLite. ...
2
votes
1answer
226 views

Bypass this / XSS

I am trying to do a bypass on a page for an XSS but I can not, I would appreciate it. The scenario is as follows: The page displays the following: http://www.webpage.com/jm/web.faq.Faqs....
4
votes
1answer
251 views

How could this attack work?

I was browsing my apache logs, and I found the following request (which resulted in a 404): 106.75.130.216 - - [DD/MMM/YYYY:hh:mm:ss] "GET /shell?%63%64%20%2F%74%6D%70%3B%77%67%65%74%20%68%74%74%70%...
8
votes
5answers
519 views

What is the intended attack vector of this email?

I received this email in my inbox: It seems innocuous enough and the source of the message tends to confirm this: Return-Path: <info@retinaljessicandis.info> X-Original-To: admin@...
7
votes
3answers
668 views

How dangerous is an unsecured printer to a network?

I have booted up a brand new printer and me being curious I checked out it's web-interface by typing its IP address in the URL. Poking around, I notice a few things. There is no password set for ...
1
vote
1answer
389 views

How to exploit a <p> output that filters brackets but nothing else

(Explaining broadly as to not disclose any website information accidentally) I've found a website that has an area to input text, and that text is sent through a PUT request and output into <p> ...
0
votes
0answers
469 views

Any way to exploit a URL section echoing into another URL?

I found a possible vulnerability vector in a website with a bug bounty program, and I don't want to pass it up, but I can't figure out a way to exploit it. The possible vector is that, when you go to ...
6
votes
1answer
892 views

DNS Tunneling - Mitigation

I believe the root cause for DNS tunneling is because the internal hosts are allowed to do recursive queries of external domains. For DNS tunneling to work, an internal host should be able to send ...
2
votes
1answer
193 views

Multicast Security

Is there a way to protect devices that listen to multicast? If someone manages to get on a network where devices are listening on multicast, what prevents someone from sending packets and the devices ...
2
votes
0answers
334 views

Attacking Bitcoin's blockchain?

The blockchain is a shared public ledger on which the entire Bitcoin network relies. All confirmed transactions are included in the block chain. Because the integrity and the chronological order of ...
23
votes
7answers
4k views

How can I publish data from a private network without adding a bidirectional link to another network

I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: ...
6
votes
1answer
343 views

Are OBD-II “Connected Car” products (Automatic Pro, Hum) secure?

There is an emerging class of vehicle data devices known as "Connected Car" products. Two examples are Automatic Pro and Hum, which both plug into your car's OBD-II port and are able to log info such ...
6
votes
1answer
217 views

Attack tree file format?

Wikipedia lists five software packages for creating/editing/analysing attack trees. These software packages do not seem to have settled, between them, upon an agreed file format for attack trees. ...
30
votes
4answers
6k views

Barcodes as an attack vector?

I was watching a defcon video a couple of weeks ago where a guy was demonstrating how barcode readers were generally quite easy to hack. He went on to say things such as with most systems the input ...
6
votes
1answer
364 views

Can this self-XSS be extended?

I have a textbox which makes a call to an API everytime the text has changed. The API returns JSON but executes any Javascript within the JSON returned (tested with Alert()). This textbox value is not ...
3
votes
3answers
262 views

Should inactive administrator accounts be DELETED/expunged?

Given: A web application Some active administrator accounts. Some inactive administrator accounts. No existing "audit" mechanism to keep old accounts for. Inactive administrators cannot log in. Is ...
0
votes
2answers
2k views

can a power bank be used to plant malware?

A power bank has some sort of circuitry, but I am not sure if there is any software on a power bank or if they are only pure batteries, but people are connecting their mobile phones and laptops to ...
4
votes
5answers
2k views

SHA1 vulnerabilities

We are currently integrating with a third party component in our web application. Part of this integration requires sending data over http. This is done via POST parameters. An additional parameter ...
1
vote
1answer
190 views

Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)

I was reading this question about Session ID Hijacking and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session ...
1
vote
2answers
99 views

What sort of attacks could be performed by an attacker who can set environment variables? [closed]

If an attacker can set environment variables at will, what attacks can be performed using this advantage, and what degree of control can the attacker take?
51
votes
5answers
33k views

How does an attacker get access to hashed passwords?

The way that we hash passwords and the strength of password is important because if someone gets access to the hashed passwords, it's possible to try lots and lots of passwords in a surprisingly short ...
7
votes
4answers
439 views

Simple defense against power analysis?

I would like to hear your opinions and how effective would my proposed defense is against power analysis. It is one of the nastiest side channel attacks because it's undetectable and passive, but ...