Download Mykonos Security User Guide

Processor Reference
Cause: MWS is capable of issuing non blocking warning messages to potentially malicious users. These
warning messages are designed to force the user to wait for a period of time, before they can dismiss the
warning and continue using the site. If the user attempts to exploit or bypass this delay mechanism in
order to dismiss the warning early, this incident will be triggered.
Behavior: Once a hacker has been warned, they are then aware that a security appliance is monitoring their
activity. This may cause some hackers to investigate what might be protecting the site. This could involve
additional scanning, or it could involve attacking the warning mechanism directly. This type of behavior
generally indicates a hacker with moderate to advanced skill levels. Depending on what they modify the
warning code input to be, this could represent a simple exploratory test, or the user could be trying to
launch a more complex attack against he warning code handler itself, such as "Buffer Overflow [http://
projects.webappsec.org/Buffer-Overflow]", "XSS [http://projects.webappsec.org/Cross-Site+Scripting]",
"Denial of Service [http://projects.webappsec.org/Denial-of-Service]", "Fingerprinting [http://
projects.webappsec.org/Fingerprinting]", "Format String [http://projects.webappsec.org/Format-String]",
"HTTP Response Splitting [http://projects.webappsec.org/HTTP-Response-Splitting]", "Integer Overflow
[http://projects.webappsec.org/Integer-Overflows]", and "SQL injection [http://projects.webappsec.org/
SQL-Injection]" among many others.
89