AK_
  • Member for 9 years, 7 months
  • Last seen more than a week ago
Is XSS through style attribute possible in modern browsers?
Accepted answer
4 votes

I have searched for it everywhere, but I think all modern browsers are safe from XSS into CSS. Although I had one particular test and it got executed into my Chrome (and probably other browsers) If ...

View answer
Where do browsers store HTTP Authentication details
3 votes

Interesting questions indeed, but the answer will vary depending on the design, implementation, and protocols the browser you're talking about was built in compliance with. Let's take some real ...

View answer
Way to decode an encoded payload
Accepted answer
3 votes

First: Base64 is NOT an encryption algorithm. It's an encoding mechanism i.e: Anybody can decode your encoded data. Secondly: If you're facing XSS in your ASP app that means you're not sanitizing a ...

View answer
How can a critical Adobe Acrobat security update, only available as an unsigned executable over plain HTTP, be verified?
3 votes

You're right. If you go to Adobe's website the update is transferred over HTTP and not HTTPS, which give any hacker in the network to hijack your update file with a simple Man In The Middle Attack and ...

View answer
LTE networks and MITM
2 votes

Yes, LTE uses bi-directional authentication. From LTE Quick Reference:

View answer
Can't successfully do an idle scan
Accepted answer
2 votes

For an idle (zombie) scan to work you don't actually care about the ports being opened or closed in your zombie machine that you want to relay on for your scan. You care about the IP sequence number: ...

View answer
Firewall hole punching
2 votes

Firewall hole punching is what we call security through obscurity, which is never a good idea because your whole security mechanism may relay on the hidden information, which is in this case the ...

View answer
How do exploits and payloads work together?
2 votes

You seems to be confusing between what is a payload and what is an exploit. Exploit: Think about an exploit as a way to make use of a certain vulnerability. In the case of a buffer overflow for ...

View answer
copy protection (or licensing) mechanism for an android app
2 votes

Each device has a unique hardware-ID - We will call it HID for readability. Create an algorithm that takes the HID and generates an unlock-serial-number Pseudo-code: Generate_Serial(input = HID) { ...

View answer
In return to libc how do you know the address of system() in a remote machine?
2 votes

According to this reddit post. The following ways can be followed to obtain system() address on a remote machine for later return 2 libc exploitation. No ASLR: Find out their version of libc/msvcrt. ...

View answer
Continuous SQL injection testing
1 votes

Interesting question! You will need to automate multiple processes for this to work. There is no magic product (which I know of) that does this, but here is an algorithm: Gather info about web ...

View answer
How can I detect whether a webshell exploit has been run?
1 votes

You can do a self pen-testing by: Executing that php file in your case the arbitrary jpeg file in your browser and see if it displays or execute a simple Linux command say ls. Example: say the jpeg ...

View answer
Questions about common exploits
Accepted answer
1 votes

What are the common vectors for installing rootkits? (And if I understand correctly, this would include MBR as well as BIOS? So same question for each.) Mainly by hooking the system calls. I suggest ...

View answer
Makecab.exe at boot. Is it malicious?
1 votes

We cannot help you if you don't post more info about the file. First you will need the md5 signature of that file. You can use a tiny tool called winmd5 for that. Secondly either search that md5 sig ...

View answer
Phone Applications having SSL/TLS enabled behind the scenes?
1 votes

I asked myself this question two years ago, and I decided to see by myself. I set a lab with a MITM attack scenario and tested a couple of applications including Twitter and Whatsapp. The answer to ...

View answer
VPN blocked ports problem
1 votes

There are four main types of VPN - PPTP, L2TP over IPSec, IPSec aka. Cisco IPSec and SSL. As you have stated your IT department appears to be blocking the first three types. However SSL VPN ...

View answer
Implementing password-reset in a web application by authtoken over email
1 votes

In 1 Is this trigger protected from XSRF? In 2 you're locking the user account for 4 hours? That's a DOS In 6 you're using weak random generator. If someone discovers this he/she can generates ...

View answer
Are there any tools/methods to probe a web app from diffferent IPs?
Accepted answer
1 votes

I have read the book, and I also have a good example of a web app blocking traffic from certain IPs .. You can spoof your source IP address the way you want but you won't get any response because ...

View answer
which antivirus is best for my laptop?
1 votes

Your brain! Anti viruses are known to be useless in most cases. Read this to know why. Other than your brain you may want to use basic Anti virus for your daily usage. I personally prefer Kaspersky ...

View answer
How can I allow only authorized browsers to access a website?
1 votes

You are looking for symteric key encryption here. Both keys must be kept secret. This can be done on the application level of your system. Here is a sample algorithm: Generate a key for each user to ...

View answer
How to block web-sites from viewing browsing history within firefox?
1 votes

Although technically website cannot read your history. There are ways you can protect your privacy if that what you intended by your questions: install DoNotTrackMe for FireFox Launch CCleaner auto ...

View answer
How does one know when a message is successfully decrypted?
1 votes

This reminds me of a challenge I had a week ago where I had to find an AES key of a ciphertext. One of the problems was when would I know that the key is correct when I hit it? What I did is I figure ...

View answer
iMac Keylogger and other hacks
Accepted answer
0 votes

It's really hard to answer your question without more details about what kind of keyloggers has infected your system, and I believe it will be hard for you to identify which program is the actual ...

View answer
Prevent a server side script from a direct URL access
0 votes

Scripts are processed by the interpreting script engine (such as ASP, PHP), hence the browsers gets the HTML output of the script and not the source code. However in the case where the scripting ...

View answer
WordPress Hacked. Deny access via admin - helpful or not?
0 votes

If you use a plug-in called All in One SEO it probably was the weakest point. Here is an article about its latest security flaw. General rules: Use a safe browser (With XSS protection) Protect your /...

View answer
Will my method for managing account data work?
Accepted answer
0 votes

Is this a good idea? Yes and No. I don't think there is any harm of storing hash($email) instead of $email You're gaining privacy over usability since you will not be able to send an email to all ...

View answer
What is the key to detecting all IoT devices in your organization?
-1 votes

This is something I'm currently working on. In fact I drafted a project from scratch, because the organizations are very immature facing iOT threats. Besides, the iOT threat is very recent with high ...

View answer