attacks – What else can be done with R/W FTP file system?


Microsoft FTP server (Windows Server 2012 host) 

Attacker can access the remote filesystem which is READ/WRITE 

As well as being a risk in terms of malware injection (files on the server can be tampered with malicious code ) what else could an attacker do?

Transferring a payload (msfvenom technique) in order to start a meterpreter session, doesn’t make sense since FTP protocol doesn’t allow to execute arbitrary commands

I thought about exploiting some vulnerabilities related to Microsoft FTP server but I couldn’t find any (except one very old which doesn’t work).

dnd 3.5e – How many primary/secondary attacks does a voidmind half-illithid/half-farspawn get?

Leaving aside how template stacking makes it unclear what the actual race/base creature should be–being half-illithid gives a creature four tentacles; being half-farspawn gives it up to four more, and being a voidmind creature grants one more psionic tentacle. Each template specifically says that it gets these in addition to its other natural weapons, though the voidmind template says that a creature uses its psionic tentacle “if the base creature doesn’t have natural weapons”.

The creature becomes amorphous and extrudes its psionic tentacle, then makes a full attack using its tentacles. How many can hit in a round, and what are their attack penalties?

dnd 5e – Does the Swords bard’s Slashing Flourish work with the Swashbuckler rogue’s Fancy Footwork to prevent opportunity attacks by any affected target?

This does not work; the extra damage from Slashing Flourish is not an “attack”.

The Swashbuckler rogue’s Fancy Footwork feature says (XGtE p. 47, SCAG p. 135; emphasis mine):

(…) During your turn, if you make a melee attack against a creature, that creature can’t make opportunity attacks against you for the rest of your turn.

The Swords bard’s Slashing Flourish option for the Blade Flourish feature says (XGtE, p. 15; emphasis mine):

You can expend one use of your Bardic Inspiration to cause the weapon to deal extra damage to the target you hit and to any other creature of your choice that you can see within 5 feet of you. (…)

Finally, the rules for “Making an Attack” say (emphasis mine):

If there’s ever any question whether something you’re doing counts as an attack, the rule is simple: if you’re making an attack roll, you’re making an attack.

Since the extra damage to another creature does not involve an attack roll, and the feature doesn’t say you’re “making an attack” against those other creatures, you are not “making an attack” against them. However, Fancy Footwork requires that you make an attack against the creature. Therefore, Fancy Footwork would not affect them; it would only prevent opportunity attacks from the initial creature that you actually made the attack roll against.

pathfinder 2e – How do criticals interact with degrees of success for attacks in PF2E?

In General

Chapter 9: Playing the Game (Core Rules) describes how criticals work. As you noted, a critical success and failures occur when your result is the DC +/- 10. You seem to misunderstanding how rolling a natural 20 works. From page 445:

If you rolled a 20 on the die (a “natural 20”), your result is one degree of success better than it would be by numbers alone. If you roll a 1 on the d20 (a “natural 1”), your result is one degree worse.

A natural 20 is not a critical hit. A natural 1 is not a critical failure. They only modify what your result would have been by one step.

Your Examples

In your first example (a strike against a DC 40), you have a success. Your result of 30 would normally be a failure, but since it is a natural 20 it becomes a success.

The second example works the same. If you would have failed your saving throw, that natural 20 makes it a success. If it would have been a critical failure, then it now becomes a failure instead.

dnd 5e – Can I use my “free object interaction” between multiple attacks?


The rules for your object interaction are found in the section Other Activity on Your Turn:

You can also interact with one object or feature of the environment for free, during either your move or your action.

During your action seems clear enough. Between the two attacks of your attack action is definitely during your action.

In what ways site administrators can detect incoming CSRF attacks?

You implement a CSRF token on every vulnerable form. When there is a CSRF error, it is logged, so you “detect” it (do note that it might be a false positive, such as having cleared the cookies). If you protect from CSRF attacks, I don’t think it would be woth preparing such attack, as it won’t work.

You might do some checks based on Referer header, which could allow you to detect certain CSRF attacks. Although that depends on the browser and settings, if there’s no referer header (which could be suppressed by the attacking page on modern brower) you would receive no information.

hash – How does memory-hard hashing passwords protect against brute force attacks?

Password hashing is concerned with brute-force attacks that take place offline using a dump of hashed passwords, not online against a running service. See this answer for how password hashes are usually obtained.

A running service does pay a cost when verifying passwords since it is not completely cheap. A strongly recommended step to take is to rate-limit the number of login attempts that can be performed, thus preventing the attacker from sending more than “a few” password guesses.

If there is no rate-limiting, the likely result would be the server CPU being fully consumed with password verification, slowing things down even more potentially to the point of crashing. This would be equivalent to a denial-of-service but would not result in a successful brute-force attack.

If the servers can handle it, it would still take entirely too long to brute-force due to time needed to verify each password (as well as the round-trip to the server).

Finally, there are password hashing techniques where the load is mostly on the client (eg: SCRAM), but this is more useful with heavier custom clients (eg: DB clients).

dnd 5e – Can you use combat maneuvers on attacks granted by Polearm Master but not made with the Attack action?

(Unless the maneuver itself says otherwise, i.e. Restraining Strike)

Firstly, you are right in stating that the bonus action granted by the Polearm Master feat must be made after taking the Attack action, since the timing is specified in the description:

When you take the Attack action and attack with only a glaive, halberd, or quarterstaff, you can use a bonus action to make a melee attack with the opposite end of the weapon.

You must have taken the Attack action first, otherwise you’re just using your bonus action without having actually made an attack with the glaive, halberd, or quarterstaff.

If you do make this attack, then use your bonus action to make an attack with the butt of the weapon, this is still a melee weapon attack, so you would qualify for any combat maneunver that specifies “… hit a creature with a (melee) weapon attack …” or similar.

As you’ve also noticed, Restraining Strike goes out of its way to ensure that it can only be done on your turn. Therefore, any maneuver that does not specify this can apply to attacks that are not made on your turn, such as opportunity attacks (including the “enter your reach” kind that Polearm Master allows). So yes, your plan of tripping someone as they enter you reach would work.

As a comparison, a paladin’s Divine Smite can also be used on reaction attacks, as it has similar wording that does not relate to when you attack, only how you attack:

when you hit a creature with a melee weapon attack, you can expend one spell slot to deal radiant damage to the target, in addition to the weapon’s damage.