Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [attack-vector]

Attack vectors are methods and channels used by attackers during a hacking attempt.

0
votes
1answer
52 views

How to implement an active Man-In-The-Middle attack that changes the request URL address

For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack. The attack scenario that I want to do is a toy example (which has countermeasures ...
64
votes
4answers
9k views

Is an up-to-date browser secure on an out-of-date OS?

Windows 7 support will end on January 14, 2020. Assuming that after that day I still use an updated browser, is it true that I'm still safe? Can it "patch" the OS-based security holes? Minor question:...
1
vote
1answer
90 views

What attack vector is prevented by using the 'coupling code'?

In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app. This requires the ...
1
vote
2answers
61 views

File upload attack vectors when file is not saved to disk

I'm curious to know if there are any significant threats presented by files which are uploaded and read but are never saved to disk? I've read countless articles about file uploads regarding storage ...
1
vote
2answers
128 views

Why are top-level wildcard bindings unsafe?

Microsoft has the following to say about configuring asp.net core with http.sys: Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create ...
2
votes
2answers
69 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
0
votes
0answers
55 views

What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2. I have gone ...
1
vote
2answers
292 views

Is it poor practice to use the last 4 digits of a social security number as an identifier?

Is it poor practice to use the last 4 digits of a social security number as an identifier? The last 4 digits of a person's social are commonly used as a means of personal identification/...
2
votes
1answer
71 views

Am I someone else's vector?

I have a site that is open to the public, that exposes no resources that need authorization. I have a use case that should support return URLs. In some cases, the site will redirect the session to a ...
1
vote
1answer
339 views

What is the effect of the arguments in the following: conhost.exe 0xffffffff -ForceV1

I'm fairly well acquainted with the role of conhost in Windows. I am aware of conhostV1.dll and conhostV2.dll so I assume force V1 would force the legacy mode of conhost (as in Pre Win 7 mode when it ...
2
votes
1answer
224 views

Are nearby attackers dangerous?

It is a general consensus that physical access can be dangerous. However, I would like to know attack vectors if attackers only get nearby access to the system. I’m assuming that the word access ...
6
votes
3answers
251 views

What is the (literally) lightest way to run a second secure system?

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with ...
0
votes
1answer
241 views

Port forwarding to ip address in LAN that is not available

Consider the following situation: In a LAN the router is configured to forward one incoming port from the WAN to a specific local ip-address/port. My question is, how is the security in this ...
0
votes
1answer
73 views

What attacks does the disclosure of VPN user credentials allow?

Many popular VPN services (that provide encrypted tunnels between the users' devices and distant VPN servers) authenticate users using a pair of email address and password. What attacks would the ...
1
vote
1answer
86 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
2
votes
4answers
353 views

Does a two-factor authentication dongle (OTP) which is always inserted in MacBook add a security benefit?

I think to get a Yubikey and read that Keepass with OTP makes no sense No. Security remains the same + extra cognitive overhead. I try to store all data local and use seldom cloud based services. If ...
2
votes
3answers
121 views

How secure is using Saving Session Feature on WinSCP?

I ssh to my AWS instances via WinSCP and it has public-private key authentication, password authentication is disabled. All the sessions are saved on WinSCP, so I click on the IP of the machine and I ...
0
votes
1answer
50 views

What can an attacker do with an OpenID token

Say an attacker had access to a list of OpenID tokens, what could the attacker leverage with that to access a system? Would they need to have another piece of information, MITM? Or can they just use ...
1
vote
1answer
1k views

“Flow” between computers (Logitech mouse)

Logitech (and possibly other) mice offer a feature called "flow": mouse can pair with uop to 3 devices (PC, handheld, ...), and can mark, copy & paste content (even files) between these 3 devices (...
2
votes
2answers
491 views

How to kill a process with multiple threads?

I'm dealing with a malware which has multiple threads monitoring each other, I'm unable to kill all of them at once so I can't get rid of it, how do I go about this? I was thinking about using a ...
0
votes
2answers
407 views

How effective are timestamps as a countermeasure for Replay attacks?

I was reading the Wiki entry for Replay attacks. It mentions that timestamps can be used as a countermeasure against such attacks: Timestamping is another way of preventing a replay attack. ...
1
vote
0answers
97 views

Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?

It's sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don't necessarily conform perfectly [...
1
vote
2answers
94 views

About security of web application - user attached files [closed]

I have a web application (forum software) where I am working on a feature about user attaching files to the forum posts. The application is written in assembly language and the database is SQLite. ...
2
votes
1answer
220 views

Bypass this / XSS

I am trying to do a bypass on a page for an XSS but I can not, I would appreciate it. The scenario is as follows: The page displays the following: http://www.webpage.com/jm/web.faq.Faqs....
4
votes
1answer
249 views

How could this attack work?

I was browsing my apache logs, and I found the following request (which resulted in a 404): 106.75.130.216 - - [DD/MMM/YYYY:hh:mm:ss] "GET /shell?%63%64%20%2F%74%6D%70%3B%77%67%65%74%20%68%74%74%70%...
8
votes
5answers
506 views

What is the intended attack vector of this email?

I received this email in my inbox: It seems innocuous enough and the source of the message tends to confirm this: Return-Path: <info@retinaljessicandis.info> X-Original-To: admin@...
7
votes
3answers
605 views

How dangerous is an unsecured printer to a network?

I have booted up a brand new printer and me being curious I checked out it's web-interface by typing its IP address in the URL. Poking around, I notice a few things. There is no password set for ...
1
vote
1answer
346 views

How to exploit a <p> output that filters brackets but nothing else

(Explaining broadly as to not disclose any website information accidentally) I've found a website that has an area to input text, and that text is sent through a PUT request and output into <p> ...
0
votes
0answers
429 views

Any way to exploit a URL section echoing into another URL?

I found a possible vulnerability vector in a website with a bug bounty program, and I don't want to pass it up, but I can't figure out a way to exploit it. The possible vector is that, when you go to ...
5
votes
1answer
744 views

DNS Tunneling - Mitigation

I believe the root cause for DNS tunneling is because the internal hosts are allowed to do recursive queries of external domains. For DNS tunneling to work, an internal host should be able to send ...
1
vote
1answer
167 views

Multicast Security

Is there a way to protect devices that listen to multicast? If someone manages to get on a network where devices are listening on multicast, what prevents someone from sending packets and the devices ...
2
votes
0answers
333 views

Attacking Bitcoin's blockchain?

The blockchain is a shared public ledger on which the entire Bitcoin network relies. All confirmed transactions are included in the block chain. Because the integrity and the chronological order of ...
23
votes
7answers
3k views

How can I publish data from a private network without adding a bidirectional link to another network

I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: ...
6
votes
1answer
327 views

Are OBD-II “Connected Car” products (Automatic Pro, Hum) secure?

There is an emerging class of vehicle data devices known as "Connected Car" products. Two examples are Automatic Pro and Hum, which both plug into your car's OBD-II port and are able to log info such ...
6
votes
1answer
196 views

Attack tree file format?

Wikipedia lists five software packages for creating/editing/analysing attack trees. These software packages do not seem to have settled, between them, upon an agreed file format for attack trees. ...
30
votes
4answers
6k views

Barcodes as an attack vector?

I was watching a defcon video a couple of weeks ago where a guy was demonstrating how barcode readers were generally quite easy to hack. He went on to say things such as with most systems the input ...
6
votes
1answer
337 views

Can this self-XSS be extended?

I have a textbox which makes a call to an API everytime the text has changed. The API returns JSON but executes any Javascript within the JSON returned (tested with Alert()). This textbox value is not ...
4
votes
3answers
255 views

Should inactive administrator accounts be DELETED/expunged?

Given: A web application Some active administrator accounts. Some inactive administrator accounts. No existing "audit" mechanism to keep old accounts for. Inactive administrators cannot log in. Is ...
0
votes
2answers
2k views

can a power bank be used to plant malware?

A power bank has some sort of circuitry, but I am not sure if there is any software on a power bank or if they are only pure batteries, but people are connecting their mobile phones and laptops to ...
4
votes
5answers
2k views

SHA1 vulnerabilities

We are currently integrating with a third party component in our web application. Part of this integration requires sending data over http. This is done via POST parameters. An additional parameter ...
1
vote
1answer
185 views

Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)

I was reading this question about Session ID Hijacking and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session ...
1
vote
2answers
92 views

What sort of attacks could be performed by an attacker who can set environment variables? [closed]

If an attacker can set environment variables at will, what attacks can be performed using this advantage, and what degree of control can the attacker take?
51
votes
5answers
29k views

How does an attacker get access to hashed passwords?

The way that we hash passwords and the strength of password is important because if someone gets access to the hashed passwords, it's possible to try lots and lots of passwords in a surprisingly short ...
7
votes
4answers
426 views

Simple defense against power analysis?

I would like to hear your opinions and how effective would my proposed defense is against power analysis. It is one of the nastiest side channel attacks because it's undetectable and passive, but ...
6
votes
1answer
133 views

Is there a database with XSS vectors, possible reference and test information?

I recently had the idea to develop a public database in which unique cross-site scripting (XSS) vectors will be registered and get a reference assigned similar to the CVE system. I made a local PoC ...
0
votes
1answer
86 views

Is there a way to calculate the complexity of an XSS-vector?

Is there a way to calculate/estimate the complexity of an XSS vector? I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
0
votes
2answers
626 views

Attack vectors and payloads [closed]

I have a question about malware. Malware attacks a machine through an attack vector. When it infiltrates the machine, it "unleashes" the payload. Now, let's say that I am infected by a virus, which ...
1
vote
1answer
39 views

Is KBA trustworthy?

I read on a different post about KBA, which is an identity verification concept that claims to verify a person by asking it about stuff just this person knows of, collected from "public information". ...
1
vote
1answer
150 views

Can an attacker extrapolate future codes based on past codes and their timestamps from a TOTP device?

I recently started using a TOTP fob to secure some of my cloud hosting accounts, and I'd likely to familiarize myself with possible attack vectors I should watch out for while I use this system (my ...
1
vote
1answer
2k views

Difference between local and physical attack vector in CVSS version 3?

In CVSS version 3, there are four different attack vectors. I am not able to differentiate between local and physical. Say, if I want to report "absence of logout button" I will use physical as ...