0
votes
1answer
17 views

What reliable methods are available for tracing the source of an ARP poisoning attack?

If an attacker on the network attempts to use ARP poisoning (spoofing) in order to redirect traffic to his own machine, what mechanisms and techniques are available for tracking the spoofed ARP ...
0
votes
0answers
13 views

What is the risk of installing Facebook Video Calling jar file?

I'm trying to talk with somebody on Facebook, but after many Facebook privacy scandals, it's a big question. Secondly on OSX, it's giving me the error that “FacebookVideoCalling_v1.6.jar” can’t be ...
3
votes
1answer
37 views

How exactly are new viruses discovered?

When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X? This answer to this question ...
-2
votes
0answers
32 views

Encoded Parenthesis

Is there any difference in encoded Parenthesis? I mean &#x28 and &#40? If Yes then tell me the difference in detail. I was testing somewhere and ( is only working with &#x28, so are they ...
-4
votes
0answers
20 views

how to bruteforce a device password in a Serial port com3

i have a device and i think its easy to get the password its just 4 digits only numbers , the problem is i forgot the password i can try like 30 or 50 password per minute.so i think a bruteforce ...
0
votes
1answer
51 views

Installed some software over a public insecure wireless network — should I consider myself compromised?

A couple months earlier, I made the mistake of downloading some software over an insecure wireless network and running it without checking its integrity. I am now considering reinstalling my system, ...
1
vote
0answers
12 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
1
vote
2answers
17 views

How can an email sender include his PGP key, so I can answer with an encrypted mail?

Let's say I were to post my e-mail address and public PGP key to my website. When a client contacts me, they would have to include their PGP public key in the e-mail so that I can respond to them in ...
-2
votes
1answer
36 views

Scanner / tool to generate a list with all forms and input fields of a website

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
2
votes
2answers
33 views

How are packets received by a Tor exit node routed back through the Tor circuit?

What happens to the packets that the exit node sends/receives from the desired web server? Does each response packet get routed back through the Tor circuit (encrypting on the way) individually? If ...
1
vote
1answer
46 views

Is drive-by-download possible with NoScript?

I am using and getting my friends to use NoScript, and the argument I usually have to use to convince them is "It prevent website to infect you without you downloading something (by yourself)". But ...
1
vote
2answers
17 views

Can the GPG master secret key be stored as read-only?

Once you have generated your master PGP key, will the "data" in the private key ever change? For instance, if you add another subkey, uid, or any other data to the master key, do these changes need ...
0
votes
0answers
19 views

Possible cross site scripting vulnerability caused by url_with_protocol

I used pullreview to review my project. It came back with a security concern ( Possible cross site scripting vulnerability) on this line: link_to portfolio.website, ...
1
vote
2answers
39 views

How to block users from downloading an attachment of a timed WordPress -post before article goes live?

So I'm trying to solve how to block users from downloading an attachment of a timed WordPress -post before article goes live? Attachments work as uploads on a custom field in an article. My current ...
3
votes
3answers
1k views

Can Cryptolocker (Or Other Ransomware) Encrypt Files That Are Already Encrypted?

If you have already encrypted files, are they still vulnerable to being encrypted a second time by a program like Cryptolocker, or would this protect them?
1
vote
2answers
39 views

PayPass debit card safety and PINs

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
-1
votes
0answers
14 views

Which is best SOAP application(free version) for understanding the SOAP protocol message and fuzzing the protocol [on hold]

I want to fuzz SOAP protocol for evaluating the fuzz tools, Can anyone suggest some good simple client and server application (freeware) which using SOAP XML protocol.
-1
votes
0answers
19 views

How to identify the javascript function rendering the web-page in my browser?

I'm testing a website for security issues, the website uses a REST based webservice to obtain data in the form of JSON data and this JSON data is taken by the JavaScript on the browser rendering the ...
1
vote
1answer
52 views

Is Payment using an iframe more secure than using as Javascript library?

Traditionally most Payment providers only provide Hosted Payment Sites via redirect or iframe. But now an increasing number is also supporting payment integration via a Javascript library. I imagine ...
-2
votes
1answer
42 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
2
votes
3answers
313 views

Can an unlisted directory on webserver be discovered?

Assume the following sample directory: - / - /images - /28374728127636438 - /css Directory listing is disabled on the server and the directory named 28374728127636438 never linked anywhere on the ...
-5
votes
0answers
30 views

doubt about career in software engineer [on hold]

i wann make software engineer but also learn CEH and pentester, can get advantages in software engineer please tell me clearly
17
votes
3answers
959 views

Is there a security issue in using the same certificate for all a company's services?

We are a small startup. One of our products is a B2B web service, accessible through its https://service.example.com canonical URL. For testing purposes, that service also runs on different ...
0
votes
0answers
9 views

How to create .pfx file containing only one of private/public key [migrated]

As far as I know .pfx files are not required to contain both public and private key. However, I could not find a way how to create a file that contains only one of them. I need this because I am ...
-1
votes
1answer
32 views

Where can I find good word list for MySQL 5? [on hold]

I wonder where can I find good collections of dictionaries which can be used for MySQL 5 dictionary attack? I just need MySQL 5 word lists / dictionaries. I found a lot of MD5, SHA1, etc. but not ...
-3
votes
2answers
53 views

Time it takes to crack a password on site like yahoo [on hold]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
0
votes
0answers
24 views

Regaining control over Google Apps account [on hold]

I have an ex board member who will not turn over control of the super user rights to the Google Apps account that runs our email through our domain. I want to know what I can do to gain control of the ...
0
votes
2answers
62 views

Questions about ddosing?

I just had a question pop into my head and if someone could explain this to me it would be amazing. Ok, so say someone is hitting a website with a 500mbps ddos. Then the ddos stops for a second or so, ...
0
votes
1answer
26 views

SSL question TLS response in TCP

After some careful looking at one .pcap of my network i would like to undestand why a request appears on the communication like IP [TLS Application Data] Application Data Protocol: http Version ...
17
votes
5answers
1k views

Why is security through obscurity not a good option for encryption? [duplicate]

I feel like there must be a simple explanation, but I've been looking around haven't found any wholesome answers. Take for example my name is Alice and my best friend Bob and we want to communicate ...
17
votes
4answers
2k views

Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it?

The unix read permission is actually the same as the execute permission, so if e.g. one process has write access it's also able to execute the same file. This can be done pretty easily:First this ...
2
votes
2answers
39 views

Why can't PGP/GPG Web-of-Trust be automated?

We heard lots of complaints about hard to use crypto tools, and recent ideas of Google how to fix this. I had another idea about this which seems quite obvious, but couldn't find anything about it on ...
0
votes
2answers
58 views

WiFi Hotspot's Evil Twin

So an Evil Twin Wifi hotspot is a hotspot with the same SSID and/or same MAC that when the victim auto-connect to this hotspot, all traffic go through this evil twin and thus the information ...
1
vote
3answers
78 views

Encrypting a huffman encoded file

I wrote a huffman encoding program that can compress and decompress files. The file contains a header which contains information that allows me to retrieve the huffman tree. I wanted to add a simple ...
0
votes
0answers
12 views

Installer digital signature timestamp inconsistency

I just noticed that the digital signature on an old installer EXE is expired (it's LibreOffice from May 2013, and I'm pretty sure it was valid when I installed it). Investigating further, the time ...
0
votes
2answers
44 views

UK Law: Are Websites allowed to track your location? [on hold]

I was looking at the source code of a website the other day and I noticed it knew my coordinates. I was surprised since this was the first time I had visited it and there was no popup asking if the ...
0
votes
1answer
30 views

Is it possible to inject information into a clients TLS session cache?

Hypothetically speaking, could an attacker run a targeted attack on a network that would inject information into a victim's cache of recent TLS connections? Specifically, the master-key and sessionID ...
0
votes
0answers
34 views

Computing science career track query - Security [on hold]

I'm a recent computing science graduate. I'm interested in Cyber Security, more specifically, I'm interested in the areas of security that deal with the analysis and assessment of vulnerabilities in ...
-2
votes
0answers
30 views

What if my wifi router/ modem is hacked? [duplicate]

It seems hacking wifi is easy, so what is the worst case scenario?
0
votes
0answers
37 views

Which shell is more secure, mksh or bash?

Which shell is more secure, mksh or bash? There has been some discussion pointing into the direction, that mksh is more secure. How to come to that conclusion? By looking which code was more audited ...
0
votes
1answer
23 views

Real-world applications of Differential Privacy?

Differentially private techniques guarantee privacy while often permitting accurate answers ...this is something I have been reading up on lately as a means of preserving user ...
0
votes
0answers
18 views

Bitlocker with bootloader on a seperate drive

I believe the answer to this may simply be it's not possible but all the same: Is it possible to have an OS partition protected by bitlocker loaded from a seperate drive with another bootloader ...
0
votes
1answer
54 views

True or False: HSTS is absolutely useless against MITM attacks

I do understand that it is a good security measure to implement HSTS, because it will reduce the number of incidents. Statement 1: If clients IO traffic goes through MITM from the start, can the ...
0
votes
0answers
13 views

Difference between Base address and actual address in debugger [migrated]

I was looking was different functions in immlib library of Immunity debugger. I launched the python shell in the debugger and ran following commands: >>>imm.assemble("jmp esp") '\xff\xe4' ...
0
votes
0answers
35 views

What are the risks associated with SSH'in from corporate LAN to untrusted server on the Internet

At work (a huge organisation) I found a server on the LAN that opens SFTP connections to 2 servers across the Internet. I assume the remote hosts are in the other parties DMZ. I know you are not ...
1
vote
0answers
34 views

My website redirects to malware link [migrated]

I coded my own website and uploaded to a host. Some days ago I realized that in front page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects ends up at: ...
-1
votes
1answer
60 views

“<” and “>” is filtered, is there any way bypass it? [on hold]

I found that the characters; < and > are filtered (shown as: &lt; and &gt;), when I pen test for a website. Is there any methods to bypass < and >?
2
votes
3answers
745 views

AntiForgeryToken versus Captcha

I am having some question regarding captcha and AntiForgeryToken Do I need to use captcha if I am using AntiForgeryToken in an MVC application. Does AntiForgeryToken prevents automated form ...
2
votes
0answers
7 views

Viewing and listing keys in MSCAPI CSP containers [migrated]

I have a MSCAPI container created and hosted within a Windows Server 2003 environment. How do I use the command line to list keys and their details within the container onto the command line ?
1
vote
1answer
31 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...

15 30 50 per page