Questions tagged [attacks]

An attempt to exploit a weakness in a system, either for nefarious or research reasons. Questions with this tag should be about designing, carrying out, or defending against the attack itself, rather than about the underlying weakness.

Filter by
Sorted by
Tagged with
0
votes
1answer
110 views

Preventing Basic Directory Traversal Attack in Linux application

I have a Raspberry Pi connected to my network and keep getting this vulnerability warning from my security software. I turned off the apache2 web server on the Pi, which fixed my port 80 issue but ...
0
votes
1answer
109 views

My router is getting port scan attacks

My internet suddenly cut out yesterday, i checked the router and it looked like nothing is wrong. I looked at the logs and i see this 2019-08-18 12:50:39 Security Warning Detect UDP port scan ...
3
votes
2answers
236 views

How does a security countermeasure failure impact a system?

In the context of safety-critical systems, such as transportation systems, it is important to verify if such systems meet/do not meet safety requirements. ISO26262 expresses these requirements as a ...
0
votes
1answer
35 views

Is it possible to dc someones internet without WLAN running [closed]

I'm using a FRITZ!Box Router (with updated OS) and behind the NAT there are only devices via wired LAN connected. Actually there is only one device connected! It's my notebook with a renewed HDD and ...
4
votes
1answer
129 views

How can I challenge an attacker to reliably identify their hardware? [closed]

I distribute a client application where I would like to identify a user's hardware specifications when they begin interacting with my server. I am specifically interested in identifying the user's GPU ...
2
votes
1answer
95 views

Unix/Linux shells which use effective UID instead of real UID

My question is build on top of the answer of the question about SUID exploitation: SUID not used after exploit The person (official answer) is stating that: Many popular implementations of sh ...
1
vote
1answer
105 views

Detecting a Pixie Dust attack? How much of a trace does it leave behind?

I've recently been delving more into Wifi security and am starting with Pixie Dust, I've learned about it, mostly how it works (with the pins, being able to crack two halves of the pins and whatnot, ...
1
vote
0answers
44 views

mitmproxy request URL redirection does not work

I need to redirect the user's request in such a way when a user enters: https://a.com the mitmproxy redirect it to: https://www.newsite.com/?somepage From a previous post, I found this script in the ...
1
vote
2answers
60 views

adaptive vs. non-adaptive adversaries; Is there a precise, unique and general definition?

In this Ethereum github page (Link to the page: https://github.com/ethereum/wiki/wiki/Sharding-FAQ#what-are-the-security-models-that-we-are-operating-under) there is a very brief definition of the ...
1
vote
2answers
143 views

Why do evil twin attacks against WiFi use a captive portal?

I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to ...
-1
votes
1answer
216 views

I have been attacked with a ransomeware, with all my files converted into .besub extension [closed]

I have been attacked with a ransom malware, with all my files converted into .besub extension. And the hacker left a note and asking for ransom. Obviously the data is important and I want it back. ...
2
votes
0answers
61 views

Are XSS attacks, or any other where a third party script is used as the attack vector, Living Off the Land (LOtL) Attacks?

I'm an intern at a big company and my education is in Security Risk Analysis but I somehow got put on a software development team and am basically relegated to research. I'm surrounded by software dev'...
0
votes
0answers
74 views

Keylogger, Published by Microsoft

Is it possible for a malicious Keylogger to appear as "Published by Microsoft" in the task manager? (I do not mean if windows have a build-in keylogger)
0
votes
0answers
107 views

Unkown attack on linux server wordpress website

I have a WordPress site. Recently under a serious DDoS attack. For this WordPress site I use nginx, varnish and apache in the backend. A part of access log shows this: 24.41.213.36 - - [23/Jun/...
64
votes
1answer
11k views

Unusual mail headers show evidence of MTA attack. Have I been pwned?

Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind. ...
0
votes
0answers
26 views

“GET //libs/js/iframe.js HTTP/1.1” 200 2305 “-” "python-requests/2.6.0 is it a try to hack into my server [duplicate]

Just Received a request in my nginx log 77.247.110.141 - - [16/Jun/2019:14:03:58 +0000] "GET //libs/js/iframe.js HTTP/1.1" 200 2305 "-" "python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-957.12.2.el7....
1
vote
1answer
90 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
0
votes
2answers
115 views

Identifying a script used for vulnerability scan

The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path ...
0
votes
1answer
37 views

TCP Hijacking and conflicting data handling on the OS level

Assuming I perform a TCP hijacking attack, by having access to the wire on which packets are being transmitted. In practice, the party to which I'm sending the hijack packet is going to receive the ...
0
votes
2answers
189 views

Billion Laughs Attack (XXE) - how does it work

Hi all Im trying to understand how the billion laughs attack works(https://en.wikipedia.org/wiki/Billion_laughs_attack) So far I get its obviously sending this payload: <?xml version="1.0"?> &...
1
vote
1answer
77 views

Is there any methods available other than brute force and dictionary attacks?

I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
0
votes
1answer
257 views

Client HTTPS request redirection attack

Assume a Mam in the Middle that wants to redirect a client's HTTPS (Secure HTTPS) request from a.com to b.com. The MitM can not impersonate neither a.com nor b.com. The MitM does not have to use a TLS ...
1
vote
1answer
73 views

Self-signed certificates and ephemeral Diffie–Hellman key exchange protocol

If we use a self-signed certificate, is ephemeral Diffie–Hellman key exchange protocol vulnerable to a man in the middle attack?
0
votes
2answers
232 views

XSS in HTML class tag with only double quotes escaped

I am currently testing XSS filter and I wonder, whether it is possible to demonstrate XSS attack on class tag attribute in HTML, when only double quotes are escaped. Other characters (<, >, ') are ...
0
votes
2answers
214 views

How to conduct this MITM attack [duplicate]

For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is: 1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The ...
0
votes
0answers
116 views

Server Side Template Injection for EJS template in NodeJS

I'd like to create a Web-App with Server-Side Template Injection vulnerability in NodeJS. The template used in the Application is EJS with Express-Framework. Below are the code bits: index.js (...
0
votes
1answer
103 views

How to implement an active Man-In-The-Middle attack that changes the request URL address

For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack. The attack scenario that I want to do is a toy example (which has countermeasures ...
0
votes
1answer
87 views

Decrypt hash using dicionary attack

Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack. My question is: Will I be able to find out by ...
0
votes
1answer
74 views

XSS: Character showing in DOM [closed]

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
5
votes
1answer
89 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
0
votes
0answers
64 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
-1
votes
1answer
56 views

Is this method of storing a data-field secure?

I'm trying to convert a data field to something tokenized(that's to something not-sensitive). The current scenario is, I've got a data field (assume user-id) which is unique for each user, I don't ...
59
votes
9answers
12k views

How hard should I try to prevent a user from XSSing themselves?

Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if ...
2
votes
1answer
315 views

Should I be worried by an email which said my account was under attack? [duplicate]

So, today I received an email in my Gmail account which landed automatically in the spam folder. This was the email content: Hi! As you may have noticed, I sent you an email from your account. ...
2
votes
0answers
148 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
-1
votes
1answer
89 views

How to determine where an attack came from? [duplicate]

I've noticed sometimes that I'd receive very random requests coming to a live server that I'd be hosting in realtime through my log. It would usually look something like: [14/Mar/2019 02:05:36] "GET /...
-2
votes
3answers
237 views

How can I stay anonymous in a LAN without Internet access?

I need to perform attacks (SQL injection) on a server. I thought of using a proxy to be anonymous, but the topology is a LAN without Internet access. I have no idea of the protocols used in the ...
0
votes
1answer
62 views

Does a cyber-attack influence the occurrence of faults?

I am looking for opinions and point of view of experienced people on this question, as I am not able to find a lot of resources. Let me define the terms first, so that we all talk about the same ...
1
vote
0answers
44 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
5
votes
1answer
218 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
1
vote
1answer
69 views

Is a padding oracle attack possible with randomly generated keys?

In a project we collect data from devices in the field using a hybrid encryption scheme. When a device wants to send data it generates a random AES key (session key) and encrypts the payload with that....
80
votes
13answers
25k views

Is divide-by-zero a security vulnerability?

Even though sometimes software bugs and vulnerabilities are deemed as the same concept, there must be at least one distinct aspect between them, and I think the most prominent one is exploitability (...
0
votes
2answers
170 views

What are some examples of known scenarios of network attacks?

For example, it is possible that someone could spread malware with insecure wifi access point, but I don't realize how sending a bunch of network packets can result into a compromised computer if the ...
2
votes
1answer
130 views

Best ways to keep a website safe without web security and cybersecurity knowledge? [closed]

What are the best ways to keep a website safe without web security and cybersecurity knowledge? Will a top WAF service (commercial) be sufficient for handling most (of course not for all, more ...
0
votes
1answer
62 views

Virtual machines vs separate physical machines for testing potential malware

If you have to run potentially insecure executables, would using a separate laptop have any security benefit compared to a virtual machine, or would it be worse in the sense that the machine's ...
1
vote
1answer
231 views

is SSRF attack or vulnerability?

I'm reading now about SSRF attacks, and many articles "SSRF is an attack" and others said "it's a vulnerability." Which is correct?
0
votes
0answers
96 views

server logs invalid HTTP_HOST header, Bad request, 400 [duplicate]

I created a Digital Ocean droplet recently, to learn how to make Django app. Eventually they say I should use Gunicorn to serve and Nginx to face the world, however, in very early stage of learning ...
1
vote
2answers
91 views

Replicate HTTP GET request [closed]

I'm trying to verify an attack called Dahua Vulnerability. In the PCAP I've got: GET /current_config/passwd HTTP/1.1 Host: xxx.xxx.xxx.xxx How can I replicate this attack to show if an attacker got ...
57
votes
7answers
12k views

Does it make sense to consider a triggerable server software crash a DOS attack?

I've found a little vulnerability in a web application running on Node.js server. It works by sending some crafted payload to the application server, which makes the application server code to throw ...
0
votes
1answer
237 views

What are the common features to identify Brute-Force attack from Apache log file?

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...