173
votes
Accepted
What is 'tabnabbing'?
Tabnabbing is a phishing technique where a malicious web site changes its looks while the tab is inactive in order to trick the user into entering credentials.
This page is simultaneously a ...
- 29.6k
154
votes
Accepted
Exploiting the delay when a festival ticket is scanned
The vulnerability you're describing is a race condition.
There are several ways to deal with it, but I would go with a SELECT ... FOR UPDATE SQL query, which puts a lock on the selected rows to ...
- 14.7k
119
votes
How to explain to traditional people why they should upgrade their old Windows XP device?
(updated, at the bottom - "The 1950 car")
Forget talking about security.
Don't take the "SECURITY" road. Because if you talk about "security" alone, then chances are good ...
- 22.8k
106
votes
Accepted
Is divide-by-zero a security vulnerability?
At issue is that an exception handler will be invoked to handle the division by zero. In general, attackers know that exception handlers are not as well-tested as regular code flows. Your main logic ...
- 34.1k
105
votes
Accepted
I was tricked on Facebook into downloading an obfuscated script
This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (...
- 8,834
100
votes
Accepted
Can malicious code fit in 14 bytes?
Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute.
The malicious part can be pretty small, and the payload could be ...
- 53.6k
86
votes
Exploiting the delay when a festival ticket is scanned
The other solution here is absolutely right and makes sense for larger systems where it's not as easy.
With the data you have, that is relatively simple, you could go for a non-blocking option:
...
- 1,092
83
votes
How to explain to traditional people why they should upgrade their old Windows XP device?
Most people (this isn't simply "old timers") think computers get broken into by a hacker sitting in a dark room personally trying to attack them by typing really fast. That's why you get responses ...
- 21.6k
81
votes
Accepted
Why does this attack check the location of the server?
Certain governments tend to ignore hacking/cybercrime carried out by their own citizens, as long as they only target people from other countries. Brian Krebs talks about this in an article earlier ...
- 9,287
62
votes
Accepted
What vulnerability is a math operation in an HTTP request trying to exploit?
The request was checking if the server has a RCE (Remote Code Execution) vulnerability, by testing if the server could print the result of a mathematical operation.
As the result is never found in the ...
- 14.7k
61
votes
Accepted
What exploit are these user agents trying to use?
It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you ...
- 3,322
59
votes
Accepted
Exploiting MD5 vulnerability in this PHP form?
Try sending a HEAD request.
I'm assuming that with ascii.txt included, the output of the script is just over a nice number like 4096 bytes, a common output_buffering value. Once the script has ...
- 665
59
votes
Accepted
Are web servers that support HTTP any more vulnerable to client-run exploits than those that use HTTPS?
You are correct; TLS provides no protection at all against malicious clients. You can think of TLS as providing a tunnel between the client and server. What's going through the tunnel is protected ...
- 2,611
55
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
It can't be exploited remotely without another vulnerability. You need to be able to execute commands on the system already.
A classic example would be a web shell. Say the server is running a web ...
- 1,253
50
votes
Is divide-by-zero a security vulnerability?
To add another contrived but based on real example:
Many (many) moons ago, my high school was running Novell Netware and had it configured so that students couldn't directly run an dos prompt (which ...
- 601
45
votes
Accepted
Is this invalid HTTP_HOST header part of an exploit?
To expand on the answer provided by @Swashbuckler, CVE-2017-8295 specifically relates to WordPress password resets with the HOST HTTP header set.
When WordPress sends out password reset emails, they ...
- 565
35
votes
Accepted
Is it possible to transfer a virus through browser video?
but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer.
No it is not. The implication is that there need to be ...
- 198k
35
votes
Accepted
Why does curl/wget in the ebay search box give me an access denied error?
I assume that ebay.com installed a Web Application Firewall, which recognizes your request as a possible attack. Therefore, your request is cancelled and you receive a HTTP 403 - Access Denied. The ...
- 806
34
votes
Accepted
What does EIP stand for?
EIP is a register in x86 architectures (32bit). It holds the "Extended Instruction Pointer" for the stack. In other words, it tells the computer where to go next to execute the next command and ...
- 5,175
34
votes
Can malicious code fit in 14 bytes?
It really depends on the programming language and the context into which the code is being injected.
For examples of what can be done in a very small amount of code space, check out the Code Golf ...
- 58.8k
29
votes
Accepted
Could you write custom data to a file of a specific extension and use it to hack a program once it opens the file?
File extensions
The file extension actually has absolutely nothing to do with the data in the file or how that data is structured. Windows likes to make you think the extension is somehow magical - ...
- 58.8k
29
votes
I was tricked on Facebook into downloading an obfuscated script
I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, ...
- 12.8k
28
votes
What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?
The dirty cow vulnerability, is a a privilege escalation vulnerability in Linux kernel versions 2.6.22 and higher; it has existed since 2007 and was fixed on Oct 18, 2016.
What is the possible impact ...
- 2,231
27
votes
Exploiting MD5 vulnerability in this PHP form?
The security flaw isn't in MD5 in this case. And the idea isn't to get if (!isset($_POST['pass']) || md5($_POST['pass'])!='castle') to evaluate in favor of the hacker. The vulnerability appears when ...
- 3,362
23
votes
Can malicious code fit in 14 bytes?
It can absolutely fit. For example, this CTF challenge solution attacks a binary that executes ~12 bytes. The payload sent is:
0: 54 push rsp
1: 5e pop ...
- 330
22
votes
What exploit are these user agents trying to use?
It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to ...
- 2,691
22
votes
What exploit are these user agents trying to use?
The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and ...
- 1,736
21
votes
Accepted
Can .ova file contain an exploit?
Whether or not it contains an exploit, specifically, is irrelevant in the broader question of whether an OVA file can be malicious. The answer to the broader question is yes, absolutely.
The Open ...
- 135k
21
votes
How to explain to traditional people why they should upgrade their old Windows XP device?
One possible response could be: "Because I can't support helping you fix it anymore. If you want help from me, in the future, you'll need to upgrade."
Yes, this is effectively holding your expertise ...
- 577
Only top scored, non community-wiki answers of a minimum length are eligible