A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

23
votes
4answers
4k views

Is it possible to detect a honeypot? [closed]

Do techniques exists to know if a machine is a honeypot (or suspicious indicators)? What techniques can be used for a software inside the honeypot or outside it? What techniques uses malware to ...
3
votes
2answers
107 views

How does process migration work in Meterpreter [closed]

Did anyone try to figure out how process migration works in Meterpreter in Windows? I want to make my own script to learn that, but am failing to find a starting point for that. Well, I have an idea ...
2
votes
3answers
53 views

Utility to build IP exclusion list? [closed]

Are there any utilities out there that can assist in building an IP exclusion list? Scenario: Recently suffered a brute force attack where 50000 failed login attempts came from a multitude of ...
0
votes
0answers
115 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
3
votes
1answer
62 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
2
votes
1answer
79 views

How do I audit the effect of security policy on a computer?

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policies but so far I am not able to detect the visible ...
0
votes
1answer
52 views

Disable a specific services in Windows 7 [closed]

I am using a Windows 7 and I want to Disable some Services, How can I do this? For my machine only? For some machines inside the Active Directory I can control? For all machines inside the Active ...
0
votes
0answers
47 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
-2
votes
1answer
120 views

What are the new security features in Windows 10? [closed]

Title says it all really. I realise I can Google this, but the top links don't cover all the new features I am aware of, so people will benefit from a canonical answer here.
1
vote
1answer
62 views

Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment?

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production ...
1
vote
1answer
118 views

Windows Passwords

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account ...
2
votes
3answers
256 views

Completely encrypting virtual machine (for free) [closed]

I know in VMware workstation there's the option to encrypt a virtual machine. Is there a free way to do this without VMware workstation? I'm aiming for the fullest encryption and encapsulation ...
1
vote
4answers
140 views

Possible to find out the last person to open a file on Windows without specialist tools?

So I suppose this is specific to the OS you are using or the filetype or software used to open it, but my question stands open for all really but I am particularly interested in more common files such ...
2
votes
0answers
88 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
0
votes
2answers
45 views

Can I add a new user to an unencrypted Windows installation from a Windows installation disk?

I recall hearing this before, the ability to boot up a Windows PC with an unencrypted hard drive using an installation disk/usb, and use the command line utility on the Windows installation disk to ...
2
votes
1answer
143 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
0
votes
2answers
763 views

Bitlocker without TPM with both a startup USB and password?

On a Windows 8.1 Pro PC without TPM, how can I use Bitlocker with both a startup USB drive and password? I don't have the option to use both of them, is this possible via command line? Currently, ...
8
votes
1answer
1k views

Why is Windows Explorer making external connections?

I'm seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe 4052 ...
0
votes
0answers
27 views

Apache.exe trojan attack on xp server, wiped it with a linux install am i safe? [duplicate]

Hello I ran a apache web server on a windows xp pc on my home network. My antivirus picked up an attack, but didn't prevent it. It seems I had a Trojan attack on my apache.exe that got through. I know ...
2
votes
4answers
347 views

Can any dangerous file(Virus, Trojan, Malware, etc) cause harm inside a zip or rar?

I am using Windows 8.1 pro with Mozilla Thunderbird for my email requirements. I have my Thunderbird set to auto download all email attachments, however upon runnning a Virus scan I am seeing many ...
2
votes
0answers
36 views

ESI and EDI Overflow [duplicate]

I tried fuzzing an application and ended up with my fuzz string in the EDI register and my program stopped with access violation when reading ESI. I checked the SEH, but it seems un affected :( I am ...
3
votes
0answers
54 views

Determine in which process a virus is hiding [closed]

My computer got one of those Recycle bin viruses, e621ca05.exe. It's an old installation of Windows XP and I can't even enter safe mode because it was in a shaky state already. So I can't follow the ...
0
votes
1answer
97 views

Do I need dedicated firewall? [closed]

I have two servers in the datacenter. FreeBSD <--> Windows Server FreeBSD configured as a gateway for Windows Server. What is the best: FreeBSD has only firewall. All services are on the Win ...
1
vote
1answer
195 views

Minimize risk with Windows 2003 end of life

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime ...
9
votes
2answers
1k views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
0
votes
2answers
50 views

Windows / Sensitive Data / Prevent access by various process

It's my understanding if you're logged into your Windows PC as DOMAIN\DUDE.NAME and you have access to \DOMAINFILES\SECRET STUFF\SUPER SECRETS.xlsx any process you run can also access that file - ...
1
vote
0answers
48 views

Domain Exploitation [closed]

I have set up a domain testing environment on a couple of old computers that i had lying around at home. I have done a lot of information gathering and attempts at exploiting the machines via ...
4
votes
1answer
148 views

Accessing user accounts without asking for their password

I don't like asking my (windows network) users for their passwords, it doesn't seem like a good security practice. I also want to train my users to never give their password to anyone if they ask for ...
2
votes
0answers
72 views

Remote accessed? [closed]

I'm not an IT professional but I'm hoping someone will take the time to answer this. I'm not generally such an idiot but this happened: I was using Ancestry.com on Chrome and clicking links within ...
1
vote
0answers
183 views

Null Session Questions [closed]

Null Session means using unauthenticated SMB session to IPC$ share and accessing the resources anonymously using the RPC function calls in SMB Since The Processes running Under Local System Account ...
0
votes
3answers
156 views

How does Nessus send remote commands on Windows without RDP? [closed]

I would like to know how Nessus sends remote commands on Windows. I have a scan with credentials launched on a Windows machine without RDP enabled, and Nessus can launch commands (.audit with the item ...
1
vote
2answers
142 views

Hidden Malware on a windows OS able to startup [closed]

How do hackers hide there malware on windows, to startup and be impossible to find then delete. The results I found that a hacker can use to hide his malware: (found here) Windows: Setting hidden ...
0
votes
0answers
42 views

Why windows do not alarm when an application hook keyboard [duplicate]

In microsoft windows , we can simply develop an application that hook the keyboard and mouse or take an screenshot of display. Why windows do not alarm that a program uses hooking (for example ...
0
votes
1answer
87 views

Organizing results from netstat using find on Windows [closed]

I am trying to figure out a way to natively do this within Windows without having to load any 3rd party applications. When I run: netstat -ba I want to find established connections without losing ...
1
vote
2answers
185 views

How to wipe potentially infected SSD?

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the ...
0
votes
1answer
104 views

Windows Server Update Services (WSUS) - can I pivot to a client machine?

I'm considering setting up WSUS on a Server 2008 machine to push updates to my Windows 7 clients. If I do, I'll be following the hardening guidelines issued by MS (such as enabling SSL). One thing I ...
0
votes
1answer
124 views

I just found many facebook entries on my registry? [closed]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
1
vote
2answers
136 views

Vmware over unsecure os

I run VMWare with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
1
vote
1answer
107 views

Secure point to point remote access to NAS drive

This question is very similar but also distinctly different (How do I ensure data encryption on Samba transmission on *NIX systems?) I'm looking to set up remote access to a NAS unit locally sharing ...
0
votes
1answer
188 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
0
votes
3answers
534 views

How can I spoof source ip address while making a ping request from windows command prompt? [closed]

I am using ping command to test my website which is running on a local server at the moment.
3
votes
2answers
56 views

Signing the Recovery Partition

Do any computer manufacturers sign (DSA, or just publishing a hash) their recovery partitions so that I can be sure that these bits are authentic? I'd like to buy a second-hand computer and reduce ...
1
vote
3answers
439 views

Looking for a (simple) utility to decrypt rsa-encrypted text in Windows?

Quick question: I'm looking for a simple utility program to be able to decrypt rsa-encrypted data (either base64-encoded or binary attachment) on a Windows workstation. Scenario: There is a group of ...
1
vote
2answers
198 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...
0
votes
1answer
327 views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
1
vote
0answers
39 views

Use cases for IPC security windows communication

There are two processes on windows machine. One is in user space and second is a service. User space process sends data to service. Because iam starting to think about securing somehow communication ...
1
vote
0answers
52 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
0
votes
1answer
137 views

Are there any alternatives to EFS for transparently encrypting the contents of a folder in Windows?

EFS is not an option for me because I'm using Windows 7 Home Premium. I am looking for folder encryption, not drive encryption.
1
vote
0answers
147 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
4
votes
1answer
99 views

Security risk: Digitally sign communications for SMB

I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: ...