Search Results

Search found 835 results on 34 pages for 'attack'.

Page 27/34 | < Previous Page | 23 24 25 26 27 28 29 30 31 32 33 34  | Next Page >

• IP address spoofing using Source Routing

  - by iamrohitbanga

  With IP options we can specify the route we want an IP packet to take while connecting to a server. If we know that a particular server provides some extra functionality based on the IP address can we not utilize this by spoofing an IP packet so that the source IP address is the privileged IP address and one of the hosts on the Source Routing is our own. So if the privileged IP address is x1 and server IP address is x2 and my own IP address is x3. I send a packet from x1 to x2 which is supposed to pass through x3. x1 does not actually send the packet. It is just that x2 thinks the packet came from x1 via x3. Now in response if x2 uses the same routing policy (as a matter of courtesy to x1) then all packets would be received by x3. Will the destination typically use the same IP address sequences as specified in the routing header so that packets coming from the server pass through my IP where I can get the required information? Can we not spoof a TCP connection in the above case? Is this attack used in practice?

  Read the article

• php security holes POCs

  - by Flavius

  Hi Please provide examples for all of these: XSS, CSRF, SQL injection with both the source code and the attack steps for each. Other attack vectors are welcome. The most complete answer gets a accepted. The configuration is a fairly standard one, as of PHP 5.3.2, core settings: allow_call_time_pass_reference => Off => Off allow_url_fopen => On => On allow_url_include => Off => Off always_populate_raw_post_data => Off => Off arg_separator.input => & => & arg_separator.output => & => & asp_tags => Off => Off auto_append_file => no value => no value auto_globals_jit => On => On auto_prepend_file => no value => no value browscap => no value => no value default_charset => no value => no value default_mimetype => text/html => text/html define_syslog_variables => Off => Off disable_classes => no value => no value disable_functions => no value => no value display_errors => STDOUT => STDOUT display_startup_errors => On => On doc_root => no value => no value docref_ext => no value => no value docref_root => no value => no value enable_dl => Off => Off error_append_string => no value => no value error_log => syslog => syslog error_prepend_string => no value => no value error_reporting => 32767 => 32767 exit_on_timeout => Off => Off expose_php => On => On extension_dir => /usr/lib/php/modules/ => /usr/lib/php/modules/ file_uploads => On => On highlight.bg => <font style="color: #FFFFFF">#FFFFFF</font> => <font style="color: #FFFFFF">#FFFFFF</font> highlight.comment => <font style="color: #FF8000">#FF8000</font> => <font style="color: #FF8000">#FF8000</font> highlight.default => <font style="color: #0000BB">#0000BB</font> => <font style="color: #0000BB">#0000BB</font> highlight.html => <font style="color: #000000">#000000</font> => <font style="color: #000000">#000000</font> highlight.keyword => <font style="color: #007700">#007700</font> => <font style="color: #007700">#007700</font> highlight.string => <font style="color: #DD0000">#DD0000</font> => <font style="color: #DD0000">#DD0000</font> html_errors => Off => Off ignore_repeated_errors => Off => Off ignore_repeated_source => Off => Off ignore_user_abort => Off => Off implicit_flush => On => On include_path => .:/usr/share/pear => .:/usr/share/pear log_errors => On => On log_errors_max_len => 1024 => 1024 magic_quotes_gpc => Off => Off magic_quotes_runtime => Off => Off magic_quotes_sybase => Off => Off mail.add_x_header => On => On mail.force_extra_parameters => no value => no value mail.log => no value => no value max_execution_time => 0 => 0 max_file_uploads => 20 => 20 max_input_nesting_level => 64 => 64 max_input_time => -1 => -1 memory_limit => 128M => 128M open_basedir => no value => no value output_buffering => 0 => 0 output_handler => no value => no value post_max_size => 8M => 8M precision => 14 => 14 realpath_cache_size => 16K => 16K realpath_cache_ttl => 120 => 120 register_argc_argv => On => On register_globals => Off => Off register_long_arrays => Off => Off report_memleaks => On => On report_zend_debug => Off => Off request_order => GP => GP safe_mode => Off => Off safe_mode_exec_dir => no value => no value safe_mode_gid => Off => Off safe_mode_include_dir => no value => no value sendmail_from => no value => no value sendmail_path => /usr/sbin/sendmail -t -i => /usr/sbin/sendmail -t -i serialize_precision => 100 => 100 short_open_tag => Off => Off SMTP => localhost => localhost smtp_port => 25 => 25 sql.safe_mode => Off => Off track_errors => Off => Off unserialize_callback_func => no value => no value upload_max_filesize => 2M => 2M upload_tmp_dir => no value => no value user_dir => no value => no value user_ini.cache_ttl => 300 => 300 user_ini.filename => .user.ini => .user.ini variables_order => GPCS => GPCS xmlrpc_error_number => 0 => 0 xmlrpc_errors => Off => Off y2k_compliance => On => On zend.enable_gc => On => On

  Read the article

• Can't find compiled resource bundles

  - by user351032

  I am using Adobe Flash Builder 4. I've run into this issue with my latest project, but I was able to re-create it with an almost empty project. Here is what I've done. Created a new Flex Project Created a locale/en_US folder within this project. Added a class that extends SparkDownloadProgressBar. All this class does is attempt to create a Label. When I try to debug this application, I get the following error. Error: Could not find compiled resource bundle 'components' for locale 'en_US'. at mx.resources::ResourceManagerImpl/installCompiledResourceBundle()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\resources\ResourceManagerImpl.as:340] at mx.resources::ResourceManagerImpl/installCompiledResourceBundles()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\resources\ResourceManagerImpl.as:269] at mx.resources::ResourceManagerImpl/processInfo()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\resources\ResourceManagerImpl.as:387] at mx.resources::ResourceManagerImpl()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\resources\ResourceManagerImpl.as:122] at mx.resources::ResourceManager$/getInstance()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\resources\ResourceManager.as:111] at mx.core::UIComponent()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\core\UIComponent.as:3728] at spark.components.supportClasses::TextBase()[E:\dev\4.0.0\frameworks\projects\spark\src\spark\components\supportClasses\TextBase.as:154] at spark.components::Label()[E:\dev\4.0.0\frameworks\projects\spark\src\spark\components\Label.as:384] at Preloader()[C:\SVN\Games\Social\Test\src\Preloader.as:21] at mx.preloaders::Preloader/initialize()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\preloaders\Preloader.as:253] at mx.managers::SystemManager/http://www.adobe.com/2006/flex/mx/internal::initialize()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\managers\SystemManager.as:1925] at mx.managers::SystemManager/initHandler()[E:\dev\4.0.0\frameworks\projects\framework\src\mx\managers\SystemManager.as:2419] The Flex Compiler/Additional Compiler Arguments section does contain "-locale en_US", but I do not want to just remove this as I am planning to have this load different property files based on the localization region at run-time and how I understand it, I will need to add each locale that I am planning to use on the compile argument line. I am at a loss as to how to attack this problem. If you need anymore information from me to help with this, I will be more than happy to provide it. Thanks ahead of time for the help!

  Read the article

• Collision Attacks, Message Digests and a Possible solution

  - by Dominar

  I've been doing some preliminary research in the area of message digests. Specifically collision attacks of cryptographic hash functions such as MD5 and SHA-1, such as the Postscript example and X.509 certificate duplicate. From what I can tell in the case of the postscript attack, specific data was generated and embedded within the header of the postscript (which is ignored during rendering) which brought about the internal state of the md5 to a state such that the modified wording of the document would lead to a final MD equivalent to the original. The X.509 took a similar approach where by data was injected within the comment/whitespace of the certificate. Ok so here is my question, and I can't seem to find anyone asking this question: Why isn't the length of ONLY the data being consumed added as a final block to the MD calculation? In the case of X.509 - Why is the whitespace and comments being taken into account as part of the MD? Wouldn't a simple processes such as one of the following be enough to resolve the proposed collision attacks: MD(M + |M|) = xyz MD(M + |M| + |M| * magicseed_0 +...+ |M| * magicseed_n) = xyz where : M : is the message |M| : size of the message MD : is the message digest function (eg: md5, sha, whirlpool etc) xyz : is the acutal message digest value for the message M magicseed_{i}: Is a set random values generated with seed based on the internal-state prior to the size being added. This technqiue should work, as to date all such collision attacks rely on adding more data to the original message. In short, the level of difficulty involved in generating a collision message such that: It not only generates the same MD But is also comprehensible/parsible/compliant and is also the same size as the original message, is immensely difficult if not near impossible. Has this approach ever been discussed? Any links to papers etc would be nice.

  Read the article

• function's return address is different from its supposed value, buffer overflow,

  - by ultrajohn

  Good day everyone! I’m trying to understand how buffer overflow works. I’m doing this for my project in a computer security course I’m taking. Right now, I’m in the process of determining the address of the function’s return address which I’m supposed to change to perform a buffer overflow attack. I’ve written a simple program based from an example I’ve read in the internet. What this program does is it creates an integer pointer that will be made to point to the address of the function return address in the stack. To do this, (granted I understand how a function/program variables get organized in the stack), I add 8 to the buffer variable’ address and set it as the value of ret. I’m not doing anything here that would change the address contained in the location of func’s return address. here's the program: Output of the program when gets excecuted: As you can see, I’m printing the address of the variables buffer and ret. I’ve added an additional statement printing the value of the ret variable (supposed location of func return address, so this should print the address of the next instruction which will get executed after func returns from execution). Here is the dump which shows the supposed address of the instruction to be executed after func returns. (Underlined in green) As you can see, that value is way different from the value printed contained in the variable ret. My question is, why are they different? (of course in the assumption that what I’ve done are all right). Else, what have I done wrong? Is my understanding of the program’s runtime stack wrong? Please, help me understand this. My project is due nextweek and I’ve barely touched it yet. I’m sorry if I’m being demanding, I badly need your help.

  Read the article

• How do I develop browser plugins with cross-platform and cross-browser compatibility in mind?

  - by Schnapple

  My company currently has a product which relies on a custom, in-house ActiveX control. The technology it employs (TWAIN) is itself cross-platform by design, but our solution is obviously limited to Internet Explorer on Windows. Long term we would like to become cross-browser and cross-platform (i.e., support other browsers on Windows, support the Macintosh or Linux). Obviously if we wanted to support Firefox on Windows I would need to write a plugin for it. But if we wanted to support the Macintosh, how do I attack that? Is it possible to compile a version of the Firefox plugin that runs on the Mac? Would I be remiss to not also support Safari on the Mac? Are there any plugins which are cross-browser on a platform? (i.e., can any browsers run plugins for other browsers) Since TWAIN is so low-level to the operating system, I do not think Java would be a solution in any capacity, but I could be wrong. What do people generally do when they want to support multiple platforms with a process that will need to be cross-platform and cross-browser compatible?

  Read the article

• Am I under risk of CSRF attacks in a POST form that doesn't require the user to be logged in?

  - by Monika Sulik

  I'm probably being a total noob here, but I'm still uncertain about what a CSRF (Cross-Site Request Forgery) attack is exactly. So lets look at three situations... 1) I have a POST form that I use to edit data on my site. I want this data to be edited only by users that are logged in. 2) I have a site, which can be used by both users who are logged in as well as guests. Parts of the site are for logged in users only, but there are also POST forms that can be used by all users - anonymous and not (for example a standard contact form). Should the contact form be safeguarded against CSRF attacks? 3) I have a site which doesn't have an authentication system at all (well, perhaps that's unrealistic, so lets say it has an admin site which is separate from the rest of it and the admin part is properly safeguarded). The main part of the site is only used by anonymous users. Do the POST forms on it need to be safeguarded? In the case of 1) the answer is clearly yes. But in the case of 2 and 3 I don't know (and is the difference between 2 and 3 even significant?).

  Read the article

• Zend file upload error

  - by jgnasser

  I am attempting to upload a file using Zend Framework 1.8 and I get some errors. Here is the code snippet: The form element: $element = new Zend_Form_Element_File('doc'); $element->setLabel('Upload an image:') ->setDestination('/path/to/my/upload/folder'); $element->addValidator('Count', false, 1); $element->addValidator('Size', false, 102400); $element->addValidator('Extension', false, 'jpg,png,gif,doc,docx,xls,xlsx,txt'); $this->addElement($element); The code for handling the upload: $adapter = new Zend_File_Transfer_Adapter_Http(); if (!$adapter->receive()) { $messages = $adapter->getMessages(); echo implode("\n", $messages); } This works fine and the file is uploaded but I get the error "The file 'doc' was illegal uploaded, possible attack". I managed to get past this problem by not creating a new Zend_File_Transfer_Adapter_Http() but instead using: $adapter = $form->doc->getTransferAdapter(); With this modification, the first error disappears but now I have an error saying I have provided 2 files instead of one (probably its reading the temp) and when I adjust the validator to accept two files I then get the arror saying "The file 'doc' was not found" and the upload now fails completely. Please help

  Read the article

• Secure Password Storage and Transfer

  - by Andras Zoltan

  I'm developing a new user store for my organisation and am now tackling password storage. The concepts of salting, HMAC etc are all fine with me - and want to store the users' passwords either salted and hashed, HMAC hashed, or HMAC salted and hashed - not sure what the best way will be - but in theory it won't matter as it will be able to change over time if required. I want to have an XML & JSON service that can act as a Security Token Service for client-side apps. I've already developed one for another system, which requires that the client double-encrypts a clear-text password using SHA1 first and then HMACSHA1 using a 128 unique key (or nonce) supplied by the server for that session only. I'd like to repeat this technique for the new system - upgrading the algo to SHA256 (chosen since implementations are readily available for all aforementioned platforms - and it's much stronger than SHA1) - but there is a problem. If I'm storing the password as a salted hash in the user-store, the client will need to be sent that salt in order to construct the correct hash before being HMACd with the unique session key. This would completely go against the point of using a salt in the first place. Equally, if I don't use salt for password storage, but instead use HMAC, it's still the same problem. At the moment, the only solution I can see is to use naked SHA256 hashing for the password in the user store, so that I can then use this as a starting point on both the server and the client for a more secure salted/hmacd password transfer for the web service. This still leaves the user store vulnerable to a dictionary attack were it ever to be accessed; and however unlikely that might be - assuming it will never happen simply doesn't sit well with me. Greatly appreciate any input.

  Read the article

• HttpWebRequest Timeouts After Ten Consecutive Requests

  - by Bob Mc

  I'm writing a web crawler for a specific site. The application is a VB.Net Windows Forms application that is not using multiple threads - each web request is consecutive. However, after ten successful page retrievals every successive request times out. I have reviewed the similar questions already posted here on SO, and have implemented the recommended techniques into my GetPage routine, shown below: Public Function GetPage(ByVal url As String) As String Dim result As String = String.Empty Dim uri As New Uri(url) Dim sp As ServicePoint = ServicePointManager.FindServicePoint(uri) sp.ConnectionLimit = 100 Dim request As HttpWebRequest = WebRequest.Create(uri) request.KeepAlive = False request.Timeout = 15000 Try Using response As HttpWebResponse = DirectCast(request.GetResponse, HttpWebResponse) Using dataStream As Stream = response.GetResponseStream() Using reader As New StreamReader(dataStream) If response.StatusCode <> HttpStatusCode.OK Then Throw New Exception("Got response status code: " + response.StatusCode) End If result = reader.ReadToEnd() End Using End Using response.Close() End Using Catch ex As Exception Dim msg As String = "Error reading page """ & url & """. " & ex.Message Logger.LogMessage(msg, LogOutputLevel.Diagnostics) End Try Return result End Function Have I missed something? Am I not closing or disposing of an object that should be? It seems strange that it always happens after ten consecutive requests. Notes: In the constructor for the class in which this method resides I have the following: ServicePointManager.DefaultConnectionLimit = 100 If I set KeepAlive to true, the timeouts begin after five requests. All the requests are for pages in the same domain. EDIT I added a delay between each web request of between two and seven seconds so that I do not appear to be "hammering" the site or attempting a DOS attack. However, the problem still occurs.

  Read the article

• How do I setup NInject? (I'm getting can't resolve "Bind", in the line "Bind<IWeapon>().To<Sword>()

  - by Greg

  Hi, I'm getting confused in the doco how I should be setting up Ninject. I'm seeing different ways of doing it, some v2 versus v1 confusion probably included... Question - What is the best way in my WinForms application to set things up for NInject (i.e. what are the few lines of code required). I'm assuming this would go into the MainForm Load method. In other words what code do I have to have prior to getting to: Bind<IWeapon>().To<Sword>(); I have the following code, so effectively I just want to get clarification on the setup and bind code that would be required in my MainForm.Load() to end up with a concrete Samurai instance? internal interface IWeapon { void Hit(string target); } class Sword : IWeapon { public void Hit(string target) { Console.WriteLine("Chopped {0} clean in half", target); } } class Samurai { private IWeapon _weapon; [Inject] public Samurai(IWeapon weapon) { _weapon = weapon; } public void Attack(string target) { _weapon.Hit(target); } } thanks PS. I've tried the following code, however I can't resolve the "Bind". Where does this come from? what DLL or "using" statement would I be missing? private void MainForm_Load(object sender, EventArgs e) { Bind<IWeapon>().To<Sword>(); // <== *** CAN NOT RESOLVE Bind *** IKernel kernel = new StandardKernel(); var samurai = kernel.Get<Samurai>();

  Read the article

• Converting a PHP associative array to a JSON associative array

  - by Extrakun

  I am converting a look-up table in PHP which looks like this to JavaScript using json_encode: AbilitiesLookup Object ( [abilities:private] => Array ( [1] => Ability_MeleeAttack Object ( [abilityid:protected] => [range:protected] => 1 [name:protected] => MeleeAttack [ability_identifier:protected] => MeleeAttack [aoe_row:protected] => 1 [aoe_col:protected] => 1 [aoe_shape:protected] => [cooldown:protected] => 0 [focusCost:protected] => 0 [possibleFactions:protected] => 2 [abilityDesc:protected] => Basic Attack ) .....snipped... And in JSON, it is: {"1":{"name":"MeleeAttack","fof":"2","range":"1","aoe":[null,"1","1"],"fp":"0","image":"dummy.jpg"},.... The problem is I get a JS object, not an array, and the identifier is a number. I see 2 ways around this problem - either find a way to access the JSON using a number (which I do not know how) or make it such that json_encode (or some other custom encoding functions) can give a JavaScript associative array. (Yes, I am rather lacking in my JavaScript department). Note: The JSON output doesn't match the array - this is because I do a manual json encoding for each element in the subscript, before pushing it onto an array (with the index as the key), then using json_encode on it. To be clear, the number are not sequential because it's an associative array (which is why the JSON output is not an array).

  Read the article

• Php sting handling triks

  - by Dam

  Hi my question Need to get the 10 word before and 10 words after for the given text . i mean need to start the 10 words before the keyword and end with 10 word after the key word. Given text : "Twenty-three" The main trick the having some html tags tags need to keep that tag with this content only the words from 10before - 10after content is bellow : <div id="hpFeatureBoxInt"><h2><span class="dy">Top News Story</span></h2><h3><a href="/go/homepage/i/int/news/world/1/-/news/1/hi/world/europe/8592190.stm">Suicide bombings hit Moscow Metro</a></h3><p>Past suicide bombings in Moscow have been blamed on Islamist rebels At least 35 people have been killed after two female suicide bombers blew themselves up on Moscow Metro trains in the morning rush hour, officials say.<img height="150" width="201" alt="Emergency services carry a body from a Metro station in Moscow (29 March 2010)" src="http://wwwimg.bbc.co.uk/feedengine/homepage/images/_47550689_moscowap203_201x150.jpg">Twenty-three died in the first blast at 0756 (0356 GMT) as a<a href="#"> train stood </a>at the central Lubyanka station, beneath the offices of the FSB intelligence agency.About 40 minutes later, a second explosion ripped through a train at Park Kultury, leaving another 12 dead.No-one has said they carried out the worst attack in the capital since 2004. </p><p id="fbilisten"><a href="/go/homepage/i/int/news/heading/-/news/">More from BBC News</a></p></div> Thank you

  Read the article

• Ruby page loading very very slowly - how should I speed it up?

  - by Elliot

  Hey guys, I'm going to try and describe the code in my view, without actually posting all the garbage: It has a standard shell (header, footer etc. in the layout) this is also where the sub navigation exists which is based on a loop (to find the amount of options) - on this page, we have 6 subnav links. Then in the index view, we have a 3rd level nav - with 3 links that use javascript to link/hide divs on the page. This means each of those original 6 options, all have their own 3'rd level nav, with each of their own 3 div pages. These three pages/divs have the input form for creating a record in rails, and then the other 2 pages show the records in different assortments. ALL of this code lives on one page (aside from the shell). The original sub nav uses a javascript tab solution, to browse through all of it... (this means its about 6 divs, which all contain 4 divs of function - so about 24 heavy divs). Loading it seems to take forever, although after loaded its extremely fast (obviously). My big question, is how should I attack this? I don't know ajax - although I imagine it'd be a good solution for loading the tabs when clicked. Thanks! Elliot

  Read the article

• Automatic multi-page multi-column flowing text with QtWebkit (HTML/CSS/JS -> PDF)

  - by Peter Boughton

  I have some HTML documents that are converted to PDF, using software that renders using QtWebkit (not sure which version). Currently, the documents have specific tags to split into columns and pages - so whenever the wording changes, it is a manual time-consuming process to move these tags so that the columns and pages fit. Can anyone provide a way to have text auto-wrapped into the next column/page (as appropriate) when it reaches the bottom of the current container? Any HTML, CSS or JS supported by QtWebkit is ok (assuming it works in the PDF converter). (I have tested the webkit-column-* in CSS3 and it appears QtWebkit does not support this.) To make things more exciting, it also needs to: - put a header at the top of each page, with page X of Y numbering; - if an odd number of pages, add a blank page at the end (with no header); - have the ability to say "don't break inside this block" or "don't break after this header" I have put some quick example initial markup and target markup to help explain what I'm trying to do. (The actual documents are far more complicated than that, but I need a simple proof-of-concept before I attack the real ones.) Any suggestions? Update: I've got a partially working solution using Aaron's "filling up" suggestion - I'll post more details in a bit.

  Read the article

• Parallel scroll textarea and webpage with jquery

  - by Roger Rogers

  This is both a conceptual and how-to question: In wiki formatting, or non WYSIWYG editor scenarios, you typically have a textarea for content entry and then an ancillary preview pane to show results, just like StackOverflow. This works fairly well, except with larger amounts of text, such as full page wikis, etc. I have a concept that I'd like critical feedback/advice on: Envision a two pane layout, with the preview content on the left side, taking up ~ 2/3 of the page, and the textarea on the right side, taking up ~ 1/3 of the page. The textarea would float, to remain in view, even if the user scrolls the browser window. Furthermore, if the user scrolls the textarea content, supposing it has exceeded the textarea's frame size, the page would scroll so that the content presently showing in the textarea syncs/is parallel with the content showing in the browser window. I'm imagining a wiki scenario, where going back and forth between markup and preview is frustrating. I'm curious what others think; is there anything out there like this? Any suggestions on how to attack this functionality (ideally using jquery)? Thanks

  Read the article

• Integrating Search Server 2008 Express with WSS 3.0

  - by Jason Kemp

  I'm setting up the environment for an intranet using WSS (Windows SharePoint Services) 3.0. The catch is getting the environment configured to work with MS Search Server 2008 Express. Here's the environment I'd like to setup: A: Web Server; Win Server 2003 SP2; WSS 3.0 SP2; IIS 6.0; .NET 3.5 SP1 B: Search Server; Win Server 2003 SP2; WSS 3.0 SP2; IIS 6.0; .NET 3.5 SP1; Search Server 2008 Express C: Database Server; Win Server 2003 SP2; SQL Server 2000 SP3 - Admin db, Content db, Config db, Search db The question is whether 3 servers can be used like the above configuration or if the Search Server (B) has to be combined with (A) since we're using the free Express version of the Search Server. The documentation from MS doesn't make it clear either way. I can attack this problem with trial and error but would rather not. The bigger question is: What is the best practice for a WSS / Search Server installation?

  Read the article

• chrome extension login security with iframe

  - by Weaver

  I should note, I'm not a chrome extension expert. However, I'm looking for some advice or high level solution to a security concern I have with my chrome extension. I've searched quite a bit but can't seem to find a concrete answer. The situation I have a chrome extension that needs to have the user login to our backend server. However, it was decided for design reasons that the default chrome popup balloon was undesirable. Thus I've used a modal dialog and jquery to make a styled popup that is injected with content scripts. Hence, the popup is injected into the DOM o the page you are visiting. The Problem Everything works, however now that I need to implement login functionality I've noticed a vulnerability: If the site we've injected our popup into knows the password fields ID they could run a script to continuously monitor the password and username field and store that data. Call me paranoid, but I see it as a risk. In fact,I wrote a mockup attack site that can correctly pull the user and password when entered into the given fields. My devised solution I took a look at some other chrome extensions, like Buffer, and noticed what they do is load their popup from their website and, instead, embed an iFrame which contains the popup in it. The popup would interact with the server inside the iframe. My understanding is iframes are subject to same-origin scripting policies as other websites, but I may be mistaken. As such, would doing the same thing be secure? TLDR To simplify, if I embedded an https login form from our server into a given DOM, via a chrome extension, are there security concerns to password sniffing? If this is not the best way to deal with chrome extension logins, do you have suggestions with what is? Perhaps there is a way to declare text fields that javascript can simply not interact with? Not too sure! Thank you so much for your time! I will happily clarify anything required.

  Read the article

• need primitive public key signature with out of band key distribution

  - by Mike D

  I pretty much a complete neophyte at this signature business so I don't know if what I'm asking is nonsense or not. Anyway, here goes... I want to send an out of band message (don't worry about how it gets there) to a program I've written on a distant machine. I want the program to have some confidence the message is legit by attaching a digital signature to the message. The message will be small less than 200 characters. It seems a public key based signature is what I want to use. I could embed the public key in the program. I understand that the program would be vulnerable to attack by anyone who modifies it BUT I'm not too worried about that. The consequences are not dire. I've looked through the MSDN and around the web but the prospect of diving in is daunting. I'm writing in straight c++, no NET framework or other fancy stuff. I've had no experience including NET framework stuff and little luck during previous attempts. Can anyone point me at some very basic resources to get me started? I need to know 1)how to generate the public and private keys 2)how to sign the message 3)how to verify the signature Any help much appreciated. TIA, Mike

  Read the article

• How do I setup NInject? (i.e.

  - by Greg

  Hi, I'm getting confused in the doco how I should be setting up Ninject. I'm seeing different ways of doing it, some v2 versus v1 confusion probably included... Question - What is the best way in my WinForms application to set things up for NInject (i.e. what are the few lines of code required). I'm assuming this would go into the MainForm Load method. In other words what code do I have to have prior to getting to: Bind<IWeapon>().To<Sword>(); I have the following code, so effectively I just want to get clarification on the setup and bind code that would be required in my MainForm.Load() to end up with a concrete Samurai instance? internal interface IWeapon { void Hit(string target); } class Sword : IWeapon { public void Hit(string target) { Console.WriteLine("Chopped {0} clean in half", target); } } class Samurai { private IWeapon _weapon; [Inject] public Samurai(IWeapon weapon) { _weapon = weapon; } public void Attack(string target) { _weapon.Hit(target); } } thanks

  Read the article

• Update a PDF to include an encrypted, hidden, unique identifier?

  - by Dave Jarvis

  Background The idea is this: Person provides contact information for online book purchase Book, as a PDF, is marked with a unique hash Person downloads book PDF passwords are annoying and extremely easy to circumvent. The ideal process would be something like: Generate hash based on contact information Store contact information and hash in database Acquire book lock Update an "include" file with hash text Generate book as PDF (using pdflatex) Apply hash to book Release book lock Send email with book download link Technologies The following technologies can be used (other programming languages are possible, but libraries will likely be limited to those supplied by the host): C, Java, PHP LaTeX files PDF files Linux Question What programming techniques (or open source software) should I investigate to: Embed a unique hash (or other mark) to a PDF Create a collusion-attack resistant mark Develop a non-fragile (e.g., PDF -> EPS -> PDF still contains the mark) solution Research I have looked at the following possibilities: Steganography Natural Language Processing (NLP) Convert blank pages in PDF to images; mark those images; reassemble PDF LaTeX watermark package ImageMagick Steganograhy requires keeping a master copy of the images, and I'm not sure if the watermark would survive PDF -> EPS -> PDF, or other types of conversion. LaTeX creates an image cache, so any steganographic process would have to intercept that process somehow. NLP introduces grammatical errors. Inserting blank pages as images is immediately suspect; it is easy to replace suspicious blank pages. The LaTeX watermark package draws visible marks. ImageMagick draws visible marks. What other solutions are possible? Related Links http://www.tcpdf.org/ invisible watermarks in images Thank you!

  Read the article

• int considered harmful?

  - by Chris Becke

  Working on code meant to be portable between Win32 and Win64 and Cocoa, I am really struggling to get to grips with what the @#$% the various standards committees involved over the past decades were thinking when they first came up with, and then perpetuated, the crime against humanity that is the C native typeset - char, short, int and long. On the one hand, as a old-school c++ programmer, there are few statements that were as elegant and/or as simple as for(int i=0; i<some_max; i++) but now, it seems that, in the general case, this code can never be correct. Oh sure, given a particular version of MSVC or GCC, with specific targets, the size of 'int' can be safely assumed. But, in the case of writing very generic c/c++ code that might one day be used on 16 bit hardware, or 128, or just be exposed to a particularly weirdly setup 32/64 bit compiler, how does use int in c++ code in a way that the resulting program would have predictable behavior in any and all possible c++ compilers that implemented c++ according to spec. To resolve these unpredictabilities, C99 and C++98 introduced size_t, uintptr_t, ptrdiff_t, int8_t, int16_t, int32_t, int16_t and so on. Which leaves me thinking that a raw int, anywhere in pure c++ code, should really be considered harmful, as there is some (completely c++xx conforming) compiler, thats going to produce an unexpected or incorrect result with it. (and probably be a attack vector as well)

  Read the article

• How to modify/replace option set file when building from command line?

  - by Heinrich Ulbricht

  I build packages from a batch file using commands like: msbuild ..\lib\Package.dproj /target:Build /p:config=%1 The packages' settings are dependent on an option set: <Import Project="..\optionsets\COND_Defined.optset" Condition="'$(Base)'!='' And Exists('..\optionsets\COND_Defined.optset')"/> This option set defines a conditional symbol many of my packages depend on. The file looks like this: <Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <PropertyGroup> <DCC_Define>CONDITION;$(DCC_Define)</DCC_Define> </PropertyGroup> <ProjectExtensions> <Borland.Personality>Delphi.Personality.12</Borland.Personality> <Borland.ProjectType>OptionSet</Borland.ProjectType> <BorlandProject> <Delphi.Personality/> </BorlandProject> <ProjectFileVersion>12</ProjectFileVersion> </ProjectExtensions> </Project> Now I need two builds: one with the condition defined and one without. My attack vector would be the option set file. I have some ideas on what to do: write a program which modifies the option set file, run this before batch build fiddle with the project files and modify the option set path to contain an environment variable, then have different option sets in different locations But before starting to reinvent the wheel I'd like to ask how you would tackle this task? Maybe there are already means meant to support such a case (like certain command line switches, things I could configure in Delphi or batch file magic).

  Read the article

• Need simple advice for graph solving problem

  - by sap

  Hi there, a collegue of mine proposed to me an exercise from an online judge website, which is basically a graph solving problem of an evacuation plan on a small town. i dont need the answer (nor do i want it) i just need an advice on which is the best approach to solving it since im kinda new to these kind of problems. the problem consists of town buildings with workers and fallout shelters in case of a nuclear attack. i have to build an algorithm that will assign the workers of each building to one or more fallout shelters but in a way that some shelters wont became too overcrowded while others remain almost empty (else i would just make the workers go to the nearest one). the problem is this: http://acm.timus.ru/problem.aspx?space=1&num=1237 in case its offline heres the google cached version of it: http://webcache.googleusercontent.com/search?q=cache:t2EPCzezs7AJ:acm.timus.ru/problem.aspx%3Fspace%3D1%26num%3D1237+vladimir+kotov+evacuation+problem&cd=1&hl=pt-PT&ct=clnk&gl=pt what i've done so far is for each building get the nearest shelter and move the number of workers from that build equal to the shelter capacity. then move to the next building. but sometimes the number of workers is greater than the shelter capacity, in that case after i iterate through every building, ill just iterate then again apllying the same algorithm until every building has 0 workers in it, problem is this is hardly the best way to solve it. any tip is welcome, please dont feel like im asking for the answer, i just want an advice in the right direction of solving it. thanks in advance.

  Read the article

• Load Spikes on a Apache MySQL Server with Wordpress MU

  - by Vikram Goyal

  Hi there, I am trying to investigate the reasons for some mysterious load spikes on a Linux Apache server (2.2.14) running PHP 5.2.9 on a dedicated server with enough processing power and memory. My primary web application is a Wordpress MU (2.9.2) installation. I have investigated and ruled out DOS attack, MySQL or Apache configuration issues. The log files don't give me anything of interest, except to tell me that there is severe load. The load (which can go up to 100) just seems to come and go. It helps that I have a script that checks every 3 minutes for the load, and restarts Apache. Restarting it helps, and the server comes back, till it happens again. There seems to be no set time frame, or visitor numbers on the site that can trigger this. Even a low number of concurrent visitors (20) can trigger it. I am almost convinced that there is a rewrite loop somewhere that is causing Apache to go mad. Apache is trying to serve something that is causing it to spawn more and more processes till it keels over. My question is: Given that I am convinced that this is a rewrite issue or something similar, how can I try and figure out what the issue is? What should I monitor? Apache logs are voluminous, and not very helpful. Of course, if this is not the issue, then at least knowing what to look for will help me eliminate this as an issue and look for something else. Thanks! Vikram

  Read the article

< Previous Page | 23 24 25 26 27 28 29 30 31 32 33 34  | Next Page >