Imperva Blog|Login|中文Deutsch日本語

ADC Hacker Intelligence Initiative

The Imperva Hacker Intelligence Initiative goes inside the cyber-underground and provides analysis of the trending hacking techniques and interesting attack campaigns.

Selected Tag: Hacking | Show All

Download Report

Get What You Give: The Value of Shared Threat Intelligence


Imperva's ADC analyzed real-world traffic from sixty Web applications in order to identify attack patterns. The report demonstrates that, across a community of Web applications, early identification of attack sources and attack payloads can significantly improve the effectiveness of application security. Furthermore, it reduces the cost of decision making with respect to attack traffic across the community. Here's how, based on the traffic analyzed by the ADC:
  • Multiple target SQL attackers generated nearly 6x their share of the population.
  • Multiple target comment spam attackers generated 4.3x their share of the population.
  • Multiple target RFI attackers generated 1.7x their share of the population (this amounted to 73% of total attacks).


Tags: Hackers, Hacking, Web Application Security, Database Security, Application Security, Remote File Inclusion, Local File Inclusion, Comment Spam


Download Report

Monitoring Hacker Forums


Imperva's second annual hacker forum analysis detects black market for social network fraud. By examining what information hackers seek out or share in forums, security teams can better understand where hackers are focusing their efforts. One thing is unmistakable: If organizations neglect SQL injection security, we believe that hackers will place more focus on those attacks.

Tags: Hackers, Hacking, Trends, SQL Injection, Web Application Security, Database Security, Application Security


Download Report

A CAPTCHA in the Rye


How effective are CAPTCHAs as a security mechanism against malicious automation? We report and analyze four case studies and draw conclusions as to the best ways to implement CAPTCHAs as an integrated part of a security strategy. Specifically, security teams should use novel CAPTCHA methods that make the CAPTCHA into something enjoyable, like a mini-game. Also, we help identify how to present a CAPTCHA only when users exhibit suspicious behavior by implementing various automation detection mechanisms.

Tags: CAPTCHA, Web Security, Web Application Attacks, Hacking


Download Report

Dissecting a Hacktivist Attack


The fundamental tenet of Web 2.0, user-generated content, is also the Achilles Heel from a security standpoint. Why? Allowing the upload of user-generated content to the website can be extremely dangerous as the server which is usually considered by other users and the application itself as "trusted" now hosts content that can be generated by a malicious source.

Tags: Hacktivist, Web Application Attacks, Hacking, Lulzsec, Remote File Inclusion, RFI, Passwords


Download Report

Automation of Attacks


How do hackers automate? What do they automate? And most importantly: How can security teams block automated attacks? The latest Hacker Intelligence Initiative from Imperva's Application Defense Center will help you answer these questions and many more.

Tags: Automated Web Application Attacks, Hacking, SQL Injection, SQLi, Remote File Inclusion, RFI, sqlmap, Havij, NetSparker, libwww-perl


Download Report

Remote and Local File Inclusion Vulnerabilities 101


Remote and local file inclusion (RFI/LFI) attacks are a favorite choice for hackers and many security professionals aren't noticing. RFI/LFI attacks enable hackers to execute malicious code and steal data through the manipulation of a company's web server. RFI was among the four most prevalent Web application attacks used by hackers in 2011. In fact, RFI/LFI was used most prominently by hacktivists. Most recently, a military dating website was breached using RFI/LFI by hacktivist group Lulzsec. RFI and LFI attacks take advantage of vulnerable PHP Web application parameters by including a URL reference to remotely hosted malicious code, enabling remote execution. PHP is a programming language designed for Web development and is in use across more than 77 percent of applications on the Internet.

Tags: File Inclusion, Remote File Inclusion, RFI, LFI, Web Application Attacks, Hacktivist, Hacking


Download Report

The Anatomy of an Anonymous Attack


This ADC report details the never-before-seen details on an attack by hacktivist group 'Anonymous' against a high-profile unnamed target during a 25 day period in 2011. The Hacker Intelligence Summary Report - The Anatomy of an Anonymous Attack offers a comprehensive analysis of the attack including a detailed timeline of activities from start to finish, an examination of the hacking methods utilized as well as insights on the use of social media to recruit participants and coordinate the attack.

Tags: Anonymous, Web Application Security, Web Application Attacks, SQL Injection, Data Security, Database Security, Hacktivist, Hacking


Download Report

Monitoring Hacker Forums


As a part of Imperva's hacker intelligence initiative, we monitor hacker forums to understand many of the technical aspects of hacking. Forums are the cornerstone of hacking - they are used by hackers for training, communications, collaboration, recruitment, commerce and even social interaction. Forums contain tutorials to help curious neophytes mature their skills. Chat rooms are filled with technical subjects ranging from advice on attack planning and solicitations for help with specific campaigns. Commercially, forums are a marketplace for selling of stolen data and attack software. Most surprisingly, forums build a sense of community where members can engage in discussions on religion, philosophy and relationships.

Tags: Hackers, Hacking, Trends, LulzSec, Hacktivist, DDoS, SQL Injection, Web Application Security, Database Security, Application Security


Download Report

The Convergence of Google and Bots: Searching for Security Vulnerabilities using Automated Botnets


This Imperva's Hacker Intelligence Initiative (HII) report reveals that hackers are leveraging the power of search engines to conduct cyber reconnaissance. Hackers, armed with a browser and specially crafted search queries ("Dorks"), are using botnets to generate more than 80,000 daily queries, identify potential attack targets and build an accurate picture of the resources within that server that are potentially exposed. Automating the query and result parsing enables the attacker to issue a large number of queries, examine all the returned results and get a filtered list of potentially exploitable sites in a very short time and with minimal effort. As searches are conducted using botnets, and not the hacker's IP address, the attacker's identity remains concealed.

Tags: Google Hacking, Botnets, Bots, SQL Injection, Data Security


Download Report

Remote File Inclusion


We begin our first report by describing an attack which usually flies under the radar – Remote File Inclusion (RFI). Although these attacks have the potential to cause as much damage as the more popular SQL Injection and Cross-Site Scripting (XSS) attacks, they are not widely discussed. HII has documented examples of automated attack campaigns launched in the wild. This report pinpoints their common traits and techniques, as well as the role blacklisting can play in mitigating them.

Tags: Google Hacking, Web Application Attacks, Buffer Overflow, CSRF, SQL Injection, Cross-Site Scripting, XSS, Search Engine Poisoning, SEP, Botnets, Remote File Inclusion, RFI

Selected Tag: Hacking | Show All