23 votes
Accepted

Why can't cookie hijacking be prevented by associating cookies with IPs?

If the cookie gets stolen inside a public Wifi Hotspot all users of the Hotspot have usually the same public IP address. This means binding to an IP would not help against an attacker in the same ...
user avatar
14 votes
Accepted

Session Hijacking through sessionId brute-forcing possible?

Session Hijacking through sessionId brute-forcing possible? Probably not. owasp says that a session identifier should be at least 128 bit long to prevent session bruteforcing. They give these ...
user avatar
  • 29k
11 votes
Accepted

Can browser cookies be "physically" stolen?

Yes, but the exact implications depend on the authentication techniques used by the website which set the cookies. For example, some websites may have particularly short expiry times for their cookies,...
user avatar
  • 64.2k
8 votes
Accepted

How does BeEF work and how can it be persistent?

BeEF is best run from the MITMf tool -- both are available in most versions (especially recent) of Kali Linux. MITMf has an extension to BeEF not found in other places called BeEFAutorun. Both ...
user avatar
  • 18.9k
8 votes
Accepted

Why Sniff Session Cookies when UN/PW should also be available?

There are 2 main reasons why cookies are easier to steal than login credentials: Cookies are sent for every request, login credentials are only sent once for each "session" If you sniff a network, ...
user avatar
8 votes

Is the Google address being spoofed on my computer?

Most likely not. IPv6 support is still quite patchy in many parts of the world. The delay is most likely caused by bad routing or network packets having to go through too many hops. You can test out ...
user avatar
8 votes
Accepted

Browser exploits based purely on HTML + CSS

Yes, in the past there have been lots of exploits that only relied on malicious HTML and CSS code. You are right in that parsing a complex, turing-complete language is potentially more error-prone, ...
user avatar
  • 43.8k
5 votes

Website infected with unwanted "redirections", apparently via javascript code

You seem to be asking: Is it possible to reverse engineer Javascript malware Yes. And you don't need acces to the server to do that. However it is possible for the malware author to make it more ...
user avatar
  • 18.3k
5 votes

How does this website prevent directing away from it

I did visit the page (from a safe place!) and it's triggering the beforeunload event to change the URL, like this: var exit=true; var temp_url = document.location.href; var url_pieces = new Array(); ...
user avatar
  • 5,283
5 votes
Accepted

Can browser bypass hosts configuration file?

If the browser honours the hosts file, i.e. it either uses the system DNS resolver API or reads the hosts file when doing its own DNS lookup, and the browser itself (or a plugin) is not complicit in ...
user avatar
  • 132k
4 votes
Accepted

Preventing Browser from BeEF Exploitation

There are Yara rules submitted by SANS ISC to detect BeEF, and these could be repurposed by yarashop for the network layer as a early-warning detection system. The author shows how to utilize ...
user avatar
  • 18.9k
4 votes

Why do SSL enabled sites don't reply back according to "hosts" file record?

The error message indicates that the server expected a HTTP request but got a HTTPS request: \x16\x03\x01\ is the start of an TLS record. This probably means that your server configuration is wrong, i....
user avatar
4 votes

Malicious script compromising browser extensions

In Firefox or Chrome, is it possible for a web page script to compromise a user installed extension? Absolutely, extensions are getting their fair share of vulnerabilities. What bugs you need to look ...
user avatar
  • 43.8k
4 votes

Can browser bypass hosts configuration file?

DNS, in this context, is nothing else than a mapping of names to IP addresses. If you have a host entry saying ::1 example.com then it will contact ::1 whenever an application tries to resolve and ...
user avatar
  • 31.9k
3 votes

Why can't cookie hijacking be prevented by associating cookies with IPs?

Steffen Ullrich is right about the dubious security gain. The reason we don't implement it in practice is due to the former prevalence of multi-homed NAT boxes where X computers would be reduced to N ...
user avatar
  • 1,090
3 votes

Is the Google address being spoofed on my computer?

These days Google uses HTTPS even for their search, which makes it relatively easy for you to verify that your connection is secure. This does not absolutely grantee that your connection isn't being ...
user avatar
  • 8,444
3 votes

Why Sniff Session Cookies when UN/PW should also be available?

If the username and password were sent in plaintext, then yes, sniffing them is a better option. However, a common pattern is for the login process to be encrypted (for security), and then the ...
user avatar
  • 34.4k
3 votes
Accepted

XSS - Suspicious email from Itunes - GF opened accidently

It sounds like standard phishing page with the aim of stealing passwords and nothing more than that. XSS and CSRF attack will only work if these vulnerabilities exist in itune websites and not on any ...
user avatar
3 votes

XSS prevention by securing cookies locally

You cannot prevent XSS by using cookies, but you can prevent successful XSS attacks from stealing your cookies by setting the HTTP-only flag. HTTP-only cookies are not visible in the context of the ...
user avatar
3 votes

User accessed Phishing link but didn't provide the credential but got hacked?

I see that the site is now suspended by hostmonster. Assuming he did not provide credentials knowingly or unknowingly, here are a few possiblities, if the phishing email was linked to the account ...
user avatar
  • 739
3 votes
Accepted

Is it still possible to get a virus simply by visiting a website?

Absolutely, even legitimate web sites can be a source of infection due to the ads they display (for instance exploit kits or drive-by). Also, as soon as you navigate from a vulnerable browser (...
user avatar
  • 309
2 votes
Accepted

Can HTTPS be compromised by first contact?

To the best of my knowledge the problem you'll encounter in the described scenario is that certificates don't usually work by IP address This may vary from site to site, so test against your desired ...
user avatar
  • 1,168
2 votes

Protecting users with browser extension. Is it possible, if the machine is already infected?

If a process (or a user, for that matter) acquires administrative privilege on a machine, it is able to do anything. Included replacing a browser extension with a malware browser extension without the ...
user avatar
  • 5,060
2 votes

Security concerns about Web browser

It seems that its like a black point in my mind that I think about browser when I research information security. Its clear that its the browser applies security rules while we navigate websites. ...
user avatar
  • 324
2 votes

Session Hijacking through sessionId brute-forcing possible?

The answer by tim about entropy is perfect on the topic of brute forcing the sessionId. But note, there are easier ways to steal the session. For example, if you issue the session over HTTPS (...
user avatar
  • 895
2 votes
Accepted

Why browser hijacker changes the homepage to yahoo

Yahoo redirect virus can also be added to "browser hijacker" and a "potentially unwanted program" categories. Programs that belong to this group are spread using three different techniques: ...
user avatar
  • 2,211
2 votes

Is there a way to sniff a "mousejack" attack?

Definitively detecting these attacks will require a hardware radio receiver, like an rtl-sdr device. You can make some guesses based on how you think a remote mouse would have to act, but they're only ...
user avatar
  • 33.6k
2 votes

Is there a way to sniff a "mousejack" attack?

If I understand this issue correctly, mouse movements are sent unencrypted by design, and keystrokes are sent encrypted by design, however the receiver also accepts unencrypted (and unauthenticated) ...
user avatar
  • 64.2k
2 votes

Browser hijacked on Debian

When in Firefox I type web.whatsapp.com for whatsapp web, I get a browser re-direct. That is concerning and could be an indicator for malware (adware) or a man-in-the-middle attack. Anybody knows ...
user avatar
  • 43.8k

Only top scored, non community-wiki answers of a minimum length are eligible