-3
votes
1answer
11 views

Is possible get password with stored XSS?

Is it possible to get password of a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
1
vote
1answer
20 views

If I can disable antivirus tamper protection, couldn't a malicious worm do it as well?

I was wondering how those client softwares protect themselves from worms / malwares etc. Symantec protects their files from malicious users / admins with the tamper protection mechanism, but sometimes ...
0
votes
2answers
22 views

SSL protocol analysis

1) What is the use of Cert B in this protocol? 2) What does it prove to Alice? 3) Is it okay if we remove Cert B in this protocol? Even without Cert B, isn't the fact that Bob used his private key ...
1
vote
1answer
18 views

Is broadcasting your Windows computer name a vulnerability?

Some software I'm using sends out bug reports occasionally. The bug reports contain a fair bit of information. I'm concerned about some of the user identifiable information in the bug report. In ...
0
votes
0answers
5 views

Insecure data in-transit

My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
2
votes
1answer
23 views

How difficult is it for ISPs to understand a user is using VPN?

If a user is using VPN, how difficult is it for an ISP to know that a user is using VPN ? If the government demands, isn't it possible for the ISP to provide a list of customers who could be using VPN ...
1
vote
0answers
9 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? ...
0
votes
0answers
4 views

Administrative recovery control mentions antivirus - error?

I am reading through Version 7 of the CISSP study guide and stumbled on a possible error. It mentions - in the administrative controls section - that Recovery is a subset/alternate version of ...
-1
votes
0answers
11 views

Vulnerability in site when XSS attempts cause a button to dissappear

On a site e.g. http://security.stackexchange.com/questions/ask after XSS like this http://security.stackexchange.com/questions/ask,onmouseover="alert('Zep')" a button on that site got affected ...
1
vote
0answers
17 views

Sulley - Logic behind primitives

Are sulley's primitives used to build a description of the protocol or to specify what kind of data we want to generate? Let's take for instance the following primitive s_string("ok", ...
-7
votes
0answers
20 views

Formal secure programing languages ranking?

Someone knows something about a secure programing languages ranking? I want it to use it for a formal article at the university.
-4
votes
0answers
18 views

What Authentication protocol is better than Kerberos? [on hold]

If Kerberos is outdated, what is the alternative?
-2
votes
2answers
34 views

Will storing a split of a hashed password into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is alot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
-1
votes
0answers
14 views

How to use Tor “on” and “off” at the same time with Chrome? [migrated]

I want to use both Tor "on" and "off" in chrome. As for example one tab of chrome with tor "on", and another tab or directory of it as "off". Is it possible?
0
votes
0answers
14 views

Azure AD B2C vs Auth0

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct ...
-9
votes
0answers
35 views
1
vote
1answer
17 views

Is it ok to append the nonce/iv to the ciphertext when using AES GCM?

I want to use AES GCM to encrypt data at rest. When retrieving the data, I want to make sure that the key is valid and the data has not been tempered with. Can I store the nonce/iv along with the ...
0
votes
0answers
8 views

PTRACE_TRACEME Process stopped

I'm trying for fun to exploit a code which uses ptrace to prevent debugging. This executable is suid, therefore thre's no use in cracking it. It have also the stack segment executable. It is made for ...
-1
votes
0answers
47 views

What is this virus doing?

So I created a small Windows VM to make a template out of and opened it up to RDP. I created a really easy password when I made the VM so, lo and behold, within three days of it being online it was ...
-2
votes
3answers
56 views

Is there something other than “if” and “else”

There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
0
votes
1answer
40 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). ...
0
votes
0answers
32 views

How to decrypt SSL data on a considered-to-be-compromised host?

I have a package which I want to encrypt on my machine and send it to another remote machine. If I use asymmetric encryption, I must have the private key on the remote side. However, I don't trust the ...
1
vote
1answer
17 views

Sensitive files in the Cloud: Automated mounted TrueCrypt volume

My current setup currently I'm using Boxcryptor Classic 1.x (still compatible to EncFS) to mirror some files with SyncBack Pro into the virtual Boxcryptor-Harddisk. Those get then encrypted by BC ...
1
vote
2answers
25 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
1
vote
2answers
89 views

Is there a civilian friendly indicator of stored password safety?

As I understand it, by using one-way encryption we can protect stored password data in the event that they are stolen. Broadly speaking, password data can usually be cracked by guessing so the ...
0
votes
1answer
15 views

Application proxy structure & funtions

http://postimg.org/image/76newirnv/ For application proxy, Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
3
votes
2answers
280 views

What is the exact problem if a website has an SHA-1 certificate?

There was a recent question about trusting (or not) a website showing an SHA-1 certificate. I would like to know whether I understand the actual issue correctly. The dangers are (a) that someone ...
0
votes
2answers
27 views

Stateful Packet Filter structure

http://postimg.org/image/o1ojanqq3/ For stateful packet filter, Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter? Secondly, how can stateful ...
0
votes
1answer
11 views

CoAP over DTLS duplication of epoch and seq no

I am currently looking at the DTLS overhead when running CoAP and found a strange thing. DTLS record layer header, 13 Byte, consists of: { content type, 1 Byte version , 2 Byte epoch ...
-1
votes
0answers
14 views

Cisco any connect home wifi use

While Cisco Any Connect is logged into VPN on my work computer over my home private wifi...can web searches made on an iPhone that is also connected to the same private wifi be monitored by the VPN ...
0
votes
0answers
28 views

shared hosted web server used as forward proxy

When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
1
vote
1answer
23 views

Can I be identified across different access points to same ISP?

The ISP I use at home also provides access points in cafés etc. Can they, for example with my MAC address, match my identity when I'm using one of these access points to when I'm at home? And what ...
0
votes
0answers
41 views

What kind of hash is in JSON of “Bing image of the day”

I just found the JSON output of Bing image of the day. Here it is: http://www.bing.com/HPImageArchive.aspx?format=js&idx=0&n=1&mkt=en-US I saw a hsh JSON object, and after I checked ...
-1
votes
0answers
21 views

HMAC Signature Based authentication for REST APIs

We are building publicly available RESTful APIs for eCommerce where clients can place logistics requests with us. We want stateless authentication on these APIs. While on-boarding, every client will ...
0
votes
0answers
18 views

Should CAs refrain from declaring HSTS policies that cover CRL hosts?

CRLs are usually not served over HTTPS, which makes sense. Further, according to this related answer, some clients may refuse to follow HTTPS URLs when validating certificates. Now, suppose a ...
0
votes
1answer
30 views

Virus Warning after clicking on a Google search results link

When researching a high school project on the guillotine, my daughter googled: quillotine quotes One of the top results was: topfamousquotes.com/quotes-about-guillotine/ Apparently she ...
0
votes
2answers
55 views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
0
votes
0answers
24 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses As answered here:Good ...
1
vote
0answers
15 views

Would the following practice make email PCI compliant?

If a system applied to the following three practice/technologies to each e-mail, would it rate as PCI compliant? The email itself is encrypted Encryption is applied end-to-end in the transport layer ...
-1
votes
0answers
22 views

Key Management - general question

I have a little question regarding the wonderful topic of "Key Management". Let's imagine I would use a service like AWS Key Management. According to their API documentation one can easily decrypt a ...
-1
votes
0answers
27 views

Monitoring what is being done on your PC when TeamViewer is used? [on hold]

How can I watch what someone is doing on my PC while they are logged in on TeamViewer?
1
vote
0answers
17 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. ...
0
votes
0answers
37 views

Best way to store SQLite password offline?

I'm developing a Windows application that uses SQLite, and I want to encrypt it (there is some sensitive information). The trouble is that one of the application requirements is that it must work ...
0
votes
1answer
28 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
0
votes
0answers
12 views

accessing file through an RDC or sharing across network more secure?

Question: Which is more secure? The Goal: Billy works in an office that is setup on a domain and needs to create files then have a different department access them. Option 1: Billy rdp's into a ...
0
votes
0answers
19 views

Privacy concerns for personal data shared between Facebook and Amazon

I was looking for a tablet from my home PC on Amazon and sometimes I find Amazon ads on Facebook which contain suggestions related to my search criteria; I never worried too much as I thought the ...
0
votes
0answers
22 views

Attaching orphaned/stageless session meterpreter

I have problems with meterpreter reverse_https. In my engagement, I saw this message in console; "Attaching orphaned/stageless session meterpreter" But after I lose connection, and victim connects ...
1
vote
0answers
14 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
1
vote
0answers
29 views

How can I authenticate securely to an internal website from an iPad without an strong password?

I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities: Credentials stored in the iPad (like Gmail credentials). Using ...
3
votes
1answer
35 views

May HSTS block access to your site when you renew your SSL certificate?

I've thinking in using HSTS in my sites but I don't understand if I need to sync the HSTS timing with the time when the certificate is going to be renewed or not. Can I use safely a static time for ...

15 30 50 per page