0
votes
1answer
5 views

Is it secure to have two password managers?

For various reasons I use both Keepass 2 and Lastpass. They have 90% the same password database. Is it secure to be using and maintaining both of them? Is it secure if they both use the same password ...
0
votes
0answers
4 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
-2
votes
0answers
27 views

How Do I Hack This Login Page?

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
1
vote
1answer
17 views

How do password suites store and encrypt their metadata and prevent attacks based on that knowledge?

If a user uses a password suite and actually tries to organize their passwords well, wouldn't that make attacks easier? Let's assume an attacker has the encrypted set of passwords for offline ...
0
votes
2answers
34 views

Are backups really secure?

In many places a common practice is to connect in a backup drive at the end of the day and let the computer do an automatic backup in case of an emergency. I have been doing that for the past 2 years ...
1
vote
1answer
16 views

How do two Tor relays communicate with one another?

Nodes don't know each other's IP address right? So how do they manage to address one another when it comes to sending data?
0
votes
1answer
19 views

Is a properly configured server secure against unauthorized data access?

Take for example a game. Typically, when you buy or download a game that can be played offline, all of the data required to run the game is shipped with the executable. In order to protect these ...
2
votes
1answer
23 views

How can you detect an insecure, non-random token?

I know that some of PHP's random functions are insecure due to them not being completely random and are considered a bad practice. My question is how an attacker go about finding that the developer ...
0
votes
0answers
21 views

OpenSSL Code Review

Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
1
vote
0answers
22 views

How does the NSA restrict public access to cryptography?

In Bruce Schneier's book Applied Cryptography (1994?) he writes The NSA uses its power to restrict the public availability of cryptography, so as to prevent national enemies from employing ...
-2
votes
0answers
21 views

Exploiting CVE-2013-6282 vulnerability

On October 25, 2013, a Linux kernel bug CVE-2013-6282 was published. It was largely exploited around that time to get root access on existing Android devices. After reading tons of user review, I also ...
2
votes
0answers
17 views

Is there a way to get msfpayload to generate a regular cmd.exe reverse tcp shell?

It looks like msfpayload now generates a powershell-based payload when you pass it windows/reverse_tcp_shell. Is there a way to generate a regular cmd.exe reverse shell instead? Thanks!
5
votes
1answer
50 views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the ...
2
votes
2answers
52 views

TrueCrypt vs “native” whole-disk encryption on Linux?

When preparing to encrypt an entire partition, is it better to rely on "native" whole-disk encryption (eg following this tutorial), or an external tool like TrueCrypt? The wikipedia article comparing ...
2
votes
2answers
77 views

What prevents me from using ARP poisoning to force a client to use HTTP?

So I was just thinking about how ARP poisoning can be used to intercept a clients request, forge an SSL cert, and send it back, with the caveat of not meeting certificate validation, but what if I ...
16
votes
1answer
581 views

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following Source IP Destination IP Source ...
1
vote
1answer
47 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
1answer
37 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
2
votes
1answer
29 views

How to sign data with OpenSSL 0.9.8?

I am building a license generator for nodejs and I am currently testing on Heroku. On my local machine running OpenSSL 1.0.1g, I'm able to test my key pairs (sign and verify) like this: # data.txt's ...
10
votes
5answers
1k views

How many Stack Exchange logins should I have?

On Stack Exchange's Add a login page, one can add logins with Google, Facebook, Yahoo, etc. How many logins should I have to provide the least chance of a hacker gaining access to my Stack Exchange ...
0
votes
0answers
28 views

Suggestion for developing project that is related to android [on hold]

I want to contribute open source projects for improve my skills. There's not many android open source projects that is related to security. I developed some project but I have no experience with open ...
1
vote
1answer
31 views

Simple protection against reflected XSS

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques. My question ...
1
vote
1answer
35 views

PCI Compliance relating to 'other' passwords

I see PCI compliance related only to password security, as far as storage and transmission goes, for user names and email accounts. How does this relate to passwords for programs that run on a PCI ...
1
vote
1answer
43 views

-bash: -sudo: command not found [on hold]

Some dependencies were missing when I installed THC Hydra. I found this site which directs me to install the missing package: sudo apt-get install libsvn-dev libapr1-dev libaprutil1-dev But when I ...
13
votes
7answers
2k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
2
votes
0answers
41 views

Risk analysis Information Security Checklist

I wouldn't bother asking this question if it was easy to find. In the past I've used a risk-analysis-checklist which was split up in serveral factors. For example, there are Human factors, Hardware ...
1
vote
1answer
23 views

X509Certificate - How to set validation Policies?

I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully. ...
1
vote
2answers
65 views

How to build a secure affiliate network

I'm going to build a demo affiliate network, which needs to be secured. Let say I have a web application called Affiliate Network Manager that manages all affiliates associated with my online book ...
1
vote
1answer
47 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
2
votes
1answer
47 views

Unsafe sanitization? Is this code SQLi vulnerable?

Function RemoveSuspeitos(ByVal strTXT) Dim txtAux As String txtAux = strTXT txtAux = Replace(txtAux, chr(34), "") txtAux = Replace(txtAux, ...
0
votes
0answers
18 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
-1
votes
1answer
70 views

can you get someone's ip address using skype?

Like if you're chatting with them via skype, how can you get their ip address? do you need some kind of program or is there a simple, obvious way? is it illegal?
-2
votes
0answers
51 views

okcupid hackable with Hydra? [on hold]

Is it possible to hack an okcupid account using THC Hydra, Brutus, or Cain and Abel? *I'm not asking for anything illegal, just asking if it's possible using one of those tools
2
votes
2answers
67 views

What can my university see if they have my MAC address?

when i first got to my university i had to provide my MAC address to get access to the internet. What i want to know is what information can they get from having my MAC address linked to my name. i ...
1
vote
1answer
36 views

How do you identify a website's form-type?

How do you know which attack method to use when using software like thc hydra, brutus, etc? e.g. http-get, https-get, http-form-get, http-form-post, etc? For example, for sites like Yahoo, Gmail, and ...
0
votes
1answer
92 views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
0
votes
0answers
17 views

error in net excess [on hold]

Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security websites in order to protect ...
2
votes
4answers
116 views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
1
vote
2answers
55 views

How to prevent attacks before HSTS is established for the first time? [on hold]

What is the best way to accomplish this and prevent attacks like SSL Strip?
1
vote
1answer
22 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
-1
votes
0answers
19 views

How do you identify a websites form-type? [on hold]

How do you know which attack method to use, http-get, https-get, http-form-get, http-form-post, etc. etc.?
2
votes
1answer
119 views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
1
vote
1answer
46 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
1
vote
3answers
68 views

Go through proxy server to Find an original IP Address [on hold]

I work for a small company who has troubles with third parties selling our products on Amazon. Sometimes those third parties have websites and when I use an IP address finder online it gives me ...
1
vote
0answers
27 views

How do I ensure programs ask for permission to access the internet?

I am just beginning to use Debian 7 which happens to be my first ever Linux OS. I chose the default installation for Debian 7. It came with Gnome (gdm3) desktop and a lot of programs. Below are my ...
1
vote
1answer
58 views

Are there any “offline” open source software with I can check my HTTPS site? [on hold]

There are many sites that can rank the HTTPS quality of a website. But are there any that is open-source and can be used "offline"? So example in an intranet environment. The tool needs to check for ...
1
vote
2answers
15 views

Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?

Put simply, CSRF tokens can be sniffed out of responses from the server unless the request/response are transmitted using encryption. Is this enough of a concern to worry about, or is it reasonable ...
2
votes
0answers
19 views

How to make a captcha maker [on hold]

I want to make a captcha maker. I am using PIL library of python to generate an image. I would like to know how should the image be (i.e. numbers with weird font style or some mathematical ...
6
votes
3answers
1k views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
2
votes
2answers
17 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...

15 30 50 per page