New answers tagged attacks
3
A simple way to do this is by using an input of the following form
'a'*BUFF_SIZE + 'qwertyuiopasdfghjklzxcvbnm'. The return address will be overwritten by 4(Assuming 32 bit system) consecutive characters from this string. Run your program with this input and it will naturally give a segmentation fault. Use dmesg | tail to find the address where it jumped. ...
0
This boils down to how the expected flow of interaction is supposed to work. If the end user detracts from the flow, for example, is redirected off site and suddenly returns, then this can be seen from the log, only if you can reconstruct the user journey. If you suddenly have a mass of users that don't seem to follow how you've constructed the user ...
3
I don't see how. When creating an iframe, a GET request is sent to the iframes src, but not to the server hosting the iframe.
So deskofhelp[.]com will likely have tupperware.com in its logs as referer header, but not the other way around.
Cross-origin frames can be logged by using a frame-src CSP directive combined with report-uri (or the newer report-to), ...
0
According to some passive info I've gathered on your attacker's IP it seems to point to vanyang.com.cn which looks like a legit manufacture company based on Wenzhou, Zhejiang. They don't belong to any security blacklist nor there are security intelligence pointing towards them.
They are running an automatic basic recon tool to scan your website for ...
0
After an initial access to your server, a malicious software can use the ping protocol as a way of communication to its command and control server. As an example, a reverse shell using ping protocol:
https://github.com/inquisb/icmpsh
-3
In "Requirement for internet hosts", a respected authority responsible for the standarization of the ICMP, TCP, IP and other protocols, the IETF, specifies that hosts should respond to ICMP Queries.
So not only is the practice safe, but it's considered mandatory for compliancy with their standards:
Every host MUST implement an ICMP Echo server function ...
Top 50 recent answers are included
