Skip to main content

Questions tagged [reflection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer

Dyanamic class load for server side application

Is there a problem to use reflection (specifically class.forName) in server side application? My main thread about this is someone to inject a code dumping memory in JVM and adding commands in ...
NotInCheck's user avatar
6 votes
1 answer

How do FIDO keys prevent MITM reflection attacks?

FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism. Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they ...
Bharel's user avatar
  • 163
1 vote
0 answers

Attack using Java reflection API java.lang.reflect.get* method [closed]

Is java code using java.lang.reflect.get* methods vulnerable to privilege escalation, if yes then how? Also is the below code vulnerable to privilege escalation attack? A a = new A(); Field[] field =...
niraj's user avatar
  • 31
3 votes
3 answers

NTLMv2 Reflection Attack

I am trying to figure out if NTLMv2 is vulnerable to a reflection attack. I cannot find a citation that clearly states NTLMv2 as being vulnerable. NTLMv1 is horribly insecure so there really is not ...
squarewav's user avatar
  • 189
1 vote
2 answers

Execute reflected XSS in URL

I am new to InfoSec and am trying to learn and try things for myself. I am exploring vulnerabilities in phpBB version 2.0.15. I have used OWASP ZAP to scan the site, and I have discovered I can work ...
Phauk's user avatar
  • 11
2 votes
2 answers

Is this DNS reflection attack a DOS or DDOS attack?

I was asked this as a test question and I was wondering if I answered correctly. I was thinking this was a DOS attack because it came from one server not multiple. So can anyone tell me if this is ...
Mike's user avatar
  • 21
4 votes
1 answer

Where you can run shellcode inside an ordinary process, what is a stealthy way to leverage that to get offensive Powershell code running from it?

Right now, offensive use of Powershell is one the hottest topics in infosec. Powershell scripts are most often pitched as being appropriate for the "post-exploitation" phase of a penetration. This ...
mostlyinformed's user avatar
2 votes
0 answers

What attack-methods for HTTP/L7-Attacks (Reflection and Co.) are you aware of [closed]

I know the following and would like to collect some more methods on how to attack websites and services via misused 3rd-party-applications: Wordpress PingBack/xmlrpc (seen a lot and wildly used) ...
that guy from over there's user avatar
3 votes
2 answers

DoS Reflection attack using CharGen protocol

I'm researching DoS Reflection attacks w/ amplification, and Wikipedia says that one of the "worst" amplification services is the Character Generator Protocol. Frankly, I have never heard of this ...
player's user avatar
  • 33
2 votes
2 answers

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
Celeritas's user avatar
  • 10.2k
1 vote
1 answer

Is it feasible to use DNS query packets as a reflection tool in public WiFi environments?

It's common sense that DNS query packet can be used to establish convert channels. But in my experiment of DNS query reflection, where I send out DNS queries with spoofed source IP and MAC address to ...
chenglong fu's user avatar
1 vote
0 answers

How to use reflection attack in this simple protocol?

The following mutual authentication protocol has been designed to be resilient against reflection attacks. This is done by ensuring that the challenge from the initiator looks different from the ...
user3000770's user avatar
9 votes
2 answers

Is it more secure to overwrite the value char[] in a String

I am talking about the Java implementation. Is it more secure to use reflection in order to access the internal Field value of type char[] inside a java.lang.String instance and overwrite the ...
Serverfrog's user avatar
2 votes
1 answer

Why don't servers vulnerable to NTP and DNS reflection attacks get blacklisted immediately?

With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore ...
chacham15's user avatar
  • 123
0 votes
1 answer

NetFlow IP Spoofing/Reflection Attack Detection

Is it possible to detect IP spoofing/reflection attack via NetFlow?
Bruce's user avatar
  • 1
2 votes
2 answers

How to mitigate SIP Reflection Attacks?

SIP has a practical need to be widely available, but its services are prone to being spoofed as reflectors used in DDoS attacks. A freeswitch server I manage has seen heaps of registration requests ...
mgjk's user avatar
  • 7,525