1

I would definitely call this a DOS attack. More precisely it is an application layer DOS attack in that it doesn't malformed packets and other network layer denial of service tricks like small window sizes to be effective. These are hardest to defend against because many DDOS protection products are looking for the network layer attacks. I think in the DOS ...


1

Is it possible to make use of these vulnerabilities? Theoretically yes, As you mentioned the exploit doesn't exist in Metasploit framework, check if exploits exist on exploit-db site or POC for the CVE on GitHub. If the exploit/POC does not exist, study the CVE by figuring out what exactly leads to that weakness mention in CVE and try to reproduce the ...


1

Your suspiscion that an attacker would remain logged in is correct. Therefore, it is common practice to invalidate all active sessions for a user when the password is reset. With your setup, that would mean removing all UUIDs connected to a user when she changes her password. Two other somewhat unrelated issues with your setup: 39798721218 is not an UUID. (...


1

Minecraft servers have a feature called "online mode" which verifies the username and UUID of all players that connect to the server against the Minecraft authentication servers. This feature is enabled by default, and it's necessary to make sure players who connect are who they say they are. However, some servers disable this feature so that ...


1

It's a pretty old threat but the following might help you. Just take the .exe in question and move it to a user writable directory. If you then notice that it tries to load a DLL from the application directory you have a prove that the DLL is loaded not specifying absolute paths, because if that’s the case, the Windows OS has a pre-defined search order for ...


Only top voted, non community-wiki answers of a minimum length are eligible