0
votes
0answers
2 views

Secure way to encrypt (not hash) passwords?

I'm building a system that for reasons I'll outline below, can't used hashed passwords, but I'd still like to encrypt them so that it's as hard as possible to crack them, in the (unlikely) event the ...
0
votes
0answers
13 views

Completely getting rid of SSLv3 on Apache

Our security team is asking that we completely disable SSLv3 on some of our servers running Apache. I've used the SSLProtocol entry in the ssl.conf file (like SSLProtocol ALL -SSLv2 -SSLv3) and ...
0
votes
0answers
14 views

Windows 2000 System Profile

I have found a computer (W2000 operating system) with a System Profile under Document and Settings Folder. As far I know this user doesn´t log in the computer. In a new W2000 PC this system profile ...
3
votes
0answers
8 views

Open source tools to run generic audit of user entitlements? [on hold]

Over the past years, my team has been asked to conduct audits/reviews for other teams. Most of these audits have been compliance-driven and almost all of them have followed the same format: some group ...
1
vote
1answer
33 views

What are the traces of a mysql attack on a server when the attacker has full permissions?

I just turned my server off yesterday, after it began to distribute comment spam across the internet, at an astounding rate over 70 "spams"/min, bottom of the line 1/2 gig ram VPS. I'm still trying to ...
2
votes
0answers
25 views

Can we send and receive uTorrent packets through TOR?

I just started using pcapy python module to caputre network packets... What I want to ask is that is it possible to Capture packets going out from uTorrent (on my own machine) with pcapy or scapy and ...
2
votes
4answers
55 views

Mitigate resend confimartion email flooding

While writing server code for resend confirmation page something came to my mind: an attacker could make several requests to /resendemail?user=blah (example URL) and flood such user with registration ...
-4
votes
1answer
30 views

is it that easy to listen a phone? [on hold]

In movies, police or government or secret services, they can easily listen a phone, and locate it. i read a lot of things about it, and i need ask it here. 1) listening a phone, is it easy for ...
-2
votes
0answers
17 views

Torrent Blocking [on hold]

I'm a student at a university, and recently the system admin has installed a proxy server.By doing do, he has blocked nearly all ports (for security). Torrenting is not against the university ...
-4
votes
0answers
28 views

Slash Cipher??? Decrypt message of slashes? [on hold]

So in a CTF from a year ago that I'm doing for practice right now, I'm given this text file of just slashes and backslashes and I'm told to figure out what this message means...How do I decrypt this ...
0
votes
1answer
9 views

Relationship between CVSS and Risk Level in Nessus output data

In a Nessus output file, does the Risk Level (e.g. Critical, High, Medium, Low, None) depend on the CVSS score? What relationship, if any, do the Risk Level and CVSS have? Thank yo
1
vote
0answers
15 views

Can NATs and firewalls blacklist IPs when trying to UDP hole punch?

I am developing a P2P application that will make use of UDP hole punch to connect two peers behind NAT. When dealing with connections between a cone and a symmetric, unpredictable NATs, however, hole ...
0
votes
0answers
24 views

dieharder - results interpretation

I'm playing around with dieharder on some of my systems and have gotten some worrisome results from OS X 10.10.2 (14C109). This is running dieharder -a -g 500 so it should be testing /dev/random. I ...
7
votes
4answers
533 views

VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?

I can't think of a reason as to why you'd want to create a hidden volume in VeraCrypt. It says because "you may be asked to hand the information," but why would I need to hand it over? Nobody has any ...
1
vote
0answers
15 views

Two keys in ~/.ssh directory [migrated]

I originally had a DSA public key in my ~/.ssh directory on my server id_dsa.pub. The corresponding private key id_dsa is stored on my local machine. I then generated an RSA key pair directly inside ...
0
votes
1answer
24 views

Does Google hand over captcha IPs to webmasters?

Google gets to know a user's IP when someone enters a captcha even if they are using tor (see http://www.wired.com/2014/12/google-one-click-recaptcha/). So, If I go to a non-google website, such as ...
-1
votes
0answers
76 views

PHP strpos and strlen Bypass

This is from a CTF event that has ended, but a writeup has not been done for it yet, and I'm quite curious as to how it would be done. With this code: $a = $_GET["pl"]; if(isset($a)) { ...
1
vote
0answers
10 views

Can a Radius server mitigate an ARP spoofing attack?

I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...
1
vote
1answer
21 views

Asking questions randomly from a set of questions instead of a password?

I was thinking about this for a while. Say we have an app for which there is an admin console, and we need to provide access to the admin console over the browser (yes, HTTPS). For authentication, ...
5
votes
2answers
63 views

How to safely display html emails like gmail does it?

I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting? In gmail, when I receive some emails from, lets say, ...
0
votes
1answer
18 views

OSX Yosemite and Security/Privacy

I currently have a Macbook Pro running OSX Mavericks, being the skeptic that I am I always wait a bit before upgrading to 'new' OS versions when they are released to see how they fare both stability ...
1
vote
2answers
20 views

Certificate pinning and the key distribution problem

I (think I) understand the concept of certificate pinning. However, I'm wondering if, in the worst-case scenario: is certificate pinning any more secure than the hierarchical trust model it is built ...
-1
votes
0answers
8 views

VA Scan for Linux server Running with Apache and SQL [on hold]

I want to do VA for Ubuntu server installed with Apache and SQL. Which open source tool you recommend?
1
vote
1answer
34 views

Is it possible to dump an exe from ram and create a distributable exe from it?

Is it possible to dump the ram and get an exe and use that ram dump to distribute an app? If so, is this something that is a practical concern and if so how best should a developer protect against it? ...
1
vote
1answer
25 views

Protecting the root ca bundle

Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates. How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
4
votes
1answer
260 views

Why are buffer overflows executed in the direction they are?

I'm following The Security Tube’s video here. He overviews buffer overflows, and mentions how memory is executed from highest to lowest in the stack (at least with his implementation I assume). So we ...
1
vote
0answers
15 views

Vega Scanner Took Website offline? [on hold]

I used the Subgraph Vega scanner to scan a website, I wanted to get any linked social media pages from their site. Anyway soon into the scan the page went offline with a 404. I checked with different ...
0
votes
1answer
14 views

PHP and other files on the server, their visibility and access [on hold]

Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through ...
-3
votes
0answers
22 views

reusing old bank issued security device

i have several security devices issued by banks and wondering if there is any way to reuse, reprogram or repurpose to use with more contemporary services such as lastpass and / or google authenticate? ...
1
vote
1answer
17 views

Downloading and updating the software via Playstore

I'm using android play store to download and update software for my phone. And some times its automatically updated as by settings.The play store is linked to one of my Gmail account. Here my question ...
-5
votes
0answers
25 views

how to decode this license file [on hold]

I need to decode a license file so I can make mi own license for other users. The string look like this: oAZNM3RSIFR4TUaPRhoYL+1bcAvd8vS5xIWFrZF4omtI2EDMWfLCrmN/ldwvzI9HLU6KGN98rlnpn/ ...
0
votes
0answers
39 views

Full key space coverage when generating a rainbow table

Many rainbow tables available online have different tables for various character sets and lengths. Are tables like these usually completely exhaustive for those character sets/lengths? For such a ...
-5
votes
0answers
30 views

Which is best secure public DNS server for free [on hold]

Which is best secure public DNS server for free.
5
votes
3answers
122 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
-1
votes
0answers
16 views

How to identify the script that's sending spam from my server? [on hold]

So, this is what I wanna know. How do I identify the script that is sending spam from my server?. Server is using exim. Maldet scanning did not help much. Any advises ?
1
vote
2answers
38 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [on hold]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
1
vote
3answers
39 views

Is it good practice to let Node/Go/… act as a frontend webserver?

I'm used to writing web stuff in PHP and let Apache or nginx handle the actual HTTP handling and load my code via whatever means (mod_php, fcgi, fpm, ...). I'm under the impression that this is a ...
1
vote
0answers
14 views

Will this code run in real machine or is it some kind of Anti Reversing code? [migrated]

I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below : POP EDI ; value of edi is 0x7C816D4F kernel32.7C816D4F PUSH EAX ;value of eax is 0 INC ...
4
votes
4answers
65 views

What's to stop someone from just MITMing a checksum?

A lot of sites offer MD5 or SHA sums to verify the validity of your download, but why do some things rely almost entirely on this? Is there anything in place to prevent people from just replacing ...
4
votes
2answers
32 views

Is hashing schema information for client when generating SQL queries more secure?

I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...
-2
votes
0answers
20 views

Access encrypted hard drive with password login [on hold]

I was doing an anti-virus scan and there was a .ecryptfs file that the scan would always get stuck on even for days, that is because it was encrypted file. Somehow I managed to disable the function of ...
-3
votes
0answers
18 views

New case, audio not detected [on hold]

As the title says, I moved to a nzxt phantom case and now my audio say's "Not detected" I've tried reformatting and reinstalling drivers, no help. First person who helps me gets paypal dollars.
3
votes
3answers
296 views

Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key?

Starting with a one time pad say you want to encrypt some small strings like the words in this sentence but you want to reuse the same OTP key for each string so that when you encounter the same word ...
2
votes
1answer
32 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
0
votes
0answers
17 views

No VirtualHost filter (a good practice?) [migrated]

I am trying to figure out the cons of a current setup and discovered a potential anomaly. There's a webpage hosted at (say) webpage.com. If I point my domain (say) mydomain.com to the raw IP of ...
-5
votes
0answers
44 views

Link to more active security sites? [on hold]

I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security. Serverfault and Stackoverflow seem to be the go to place ...
0
votes
0answers
34 views

How can I encrypt in the column level of SQL for numeric data [on hold]

I want to encryption in the column level of SQL for numeric data.What should I do?Is there an algorithm for this? Where should I put the function of encrypting in the source code?
-2
votes
0answers
58 views

Am I a victim of industrial espionage? [on hold]

I had a weird experience, that I don't quite know how to explain. My setup is this: I have my desktop machine, which I connect to my company's VPN. On this machine I also run a VirtualBox VM with ...
1
vote
1answer
32 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
0
votes
1answer
24 views

Acceptable secure solution to replace static IP addresses for a web application

I am currently working as a technical lead on a project at a financial institution and have a question about how to provide the same level of security expected by the business in an application we are ...

15 30 50 per page