There is no such thing as “too small to hack"

Does this bother you?
average website is attacked 22 times per day

No?
How about this one?
Thirty-nine percent of the hacked sites were infected with shell programs, and 73% contained backdoors. 






More Here:
https://blog.sitelock.com/wp-content/uploads/2017/07/SiteLock-Security-by-Obscurity-Infographic-Q2-2017.pdf

Another security buzzword "PasteJacking"

This one is not from a hacker but a POC from a security researcher.


From the article:

Researcher-warns-PasteJacking-hack-attacks-targeting-users-clipboards

Researcher Dylan Ayrey explains that some web browsers now allow developers to add content to a user's clipboard under certain circumstances.

Attackers can theoretically exploit this ability to trick users into running commands they otherwise wouldn't want entered on their computers, in order to gain remote code execution. These types of attacks generally make use of HTML/CS


For more info
https://www.grahamcluley.com/2016/05/researcher-warns-pastejacking-hack-attacks-targeting-users-clipboards/

Attackers install a backdoor on an estimated 30,000 to 50,000 websites;

Here is the strange part:

Atackers have exploited the bug to install a backdoor on an estimated 30,000 to 50,000 websites, some that don't even run WordPress software or that don't have MailPoet enabled, according to Daniel Cid, CTO of security firm Sucuri.

"To be clear, the MailPoet vulnerability is the entry point," he wrote in a blog post. "It doesn't mean your website has to have it enabled or that you have it on the website; if it resides on the server, in a neighboring website, it can still affect your website." In an e-mail to Ars, he elaborated:

The link below has more information:-

http://arstechnica.com/security/2014/07/mass-exploit-of-wordpress-plugin-backdoors-sites-running-joomla-magento-too/

HeartBleed - How to extract the private Key?

The author provides details.



The link below has more information:-

http://arstechnica.com/security/2014/04/how-i-used-heartbleed-to-steal-a-sites-private-crypto-key/

SQL Injection attack - Still successful according to Ponemon Institute.

I guess , it does not matter if  Injection attack is #1 in OWASP top 10.

According to the article:-

52% of respondents said that their organizations don’t even test or validate third-party software they use to see if it’s vulnerable to SQL injection.

Other findings in the study include:

1. Nearly half (46 percent) were familiar with the term “WAF Bypass” 56 percent agreed or strongly agreed that determining the root cause of SQL injection is becoming more difficult because of the trend for employees to use their personally owned mobile devices in the workplace (BYOD)
2. 52 percent of respondents indicated that they don’t test or validate any third party software to ensure it’s not vulnerable to SQL injection
3. 44 percent utilize professional penetration testers to identify vulnerabilities in their IT systems; but only a third (35 percent) of those penetration tests included testing for SQL injection vulnerabilities
4. 88 percent of respondents had a favorable or very favorable opinion of the use of behavioral analysis technology for detecting SQL injection attacks
5. 52 percent indicated they either had begun replacing or would be replacing their signature-based IT security systems with behavioral analysis based IT security systems within the next 24 months
6. 49 percent said they would be using behavioral analysis based systems specifically for database transaction security

The link below has more information:-

http://www.tripwire.com/state-of-security/top-security-stories/organizations-remain-vulnerable-to-sql-injection-attacks/

CSRF & XSS - Lethal Combo

A nice article on how this combination can be devastating



Check it out:
http://www.acunetix.com/blog/web-security-zone/csrf-xss-brothers-arms

Ever heard of UXSS - Universal Cross-Site Scripting

According to the article:- 

Unlike the common XSS attacks, UXSS is a type of attack that exploits client-side vulnerabilities in the browser or browser extensions in order to generate an XSS condition, and execute malicious code. When such vulnerabilities are found and exploited, the behavior of the browser is affected and its security features may be bypassed or disabled.

The net effect of this is the fact that the attacker doesn't just get access to a compromised session on a vulnerable web page, but may get access to any session belonging to web pages currently opened (or cached) by the browser at the time the attack is triggered.

Simply put, UXSS does not need a vulnerable web page in order to trigger, and can penetrate web sessions belonging to secure, well written web pages, thus creating a vulnerability where there isn’t one

Well-known vulnerabilities exploitable by UXSS:

1. Vulnerability in the Adobe Acrobat extension for Internet Explorer 6 (or Mozilla plugin)
2. Flaw in the XSS filters of Internet Explorer 8.
3. Flash Player UXSS Vulnerability - CVE-2011-2107
4. Vulnerability in Chrome for Android

The links below has more information:

http://www.acunetix.com/blog/web-security-zone/universal-cross-site-scripting-uxss

Interesting Article - Top Targets of Blind XSS

According to the Article:-

Potential targets in your environment

1. Security appliances
2. Managed services
3. On-premise IT management applications
4. Others (SaaS, CMS)

The links below has more information:

http://www.acunetix.com/blog/web-security-zone/top-targets-blind-xss