A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

1
vote
3answers
204 views

Why are keyloggers a problem for password managers?

Reading the API definition of SetWindowsHookEx, I see Calling the CallNextHookEx function to chain to the next hook procedure is optional, but it is highly recommended; otherwise, other ...
1
vote
1answer
30 views

How can user credetials be leveraged when doing a penetration test for a Windows network? [closed]

Assume the following scenario: NTLMv2 only Only Vista machines or higher Remote desktop disabled throughout network No open shares psexec needs administrative level access. Without any shares ...
-1
votes
1answer
45 views

Undelete-secure AES software and software for carrying out “full undeletion” free-partition-space zeroing/reformatting on Windows?

It is fairly well known that on Windows, when you delete a file (or folder which may contain any number of files and subfolders possibly containing other files and subfolders and so on), Windows just ...
3
votes
2answers
67 views

Is it possible to “fingerprint” the “patches” applied to a Windows system?

Two situations with a similar goal: 1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to ...
0
votes
2answers
56 views

How does RealVNC Enterprise Know My System Credential?

After the installation of RealVNC on a Windows computer, the default login username and password via VNC is the same as the system username and password. Can anyone tell me how RealVNC can access such ...
1
vote
3answers
102 views

How to find what has been added to my hard drive [closed]

Why is my hard drive being filled up when I am not installing anything? How would I find out the cause, e.g. is it malware, a hacker, or potentially something else? Every few days I come home to ...
0
votes
1answer
212 views

How does LSARPC protocol work?

I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it. I couldn't find anything in the internet or in different books.
3
votes
2answers
1k views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
2
votes
3answers
58 views

Controlling variables used by an application

One thing that I have seen commonly used by game cheating engines it to control variables that the game is using. The idea is to edit the variables used by the game to say, give ones self unlimited ...
-1
votes
1answer
49 views

Mitigate DDos on Windows box

I would love to know, If you know some way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the IPTables Almighty, but I wonder If there is something like that in Windows. ...
1
vote
0answers
66 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
4
votes
3answers
362 views

Security of a Windows XP system after April 8th when running the latest Firefox or Chrome

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially ...
0
votes
2answers
2k views

Encrypted code file (.vbs) hide all my files and shows .lnk files

I am using Windows XP Professional and what happens is that when I try to connect any gadget like a pen drive or a mobile through USB, all my data got hidden and it shows a 1 kb file which is a .lnk ...
0
votes
1answer
116 views

What registry windows keys malwares target often?

I wonder what are the main registry windows keys malware target often ? I would love to code a program that will check the state of those windows registry keys for eventual modifications by malware.
-1
votes
1answer
8k views

How to get a Network's WIFI Password through CMD? [closed]

I found that Wifi's Password can be retrived using the network and sharing wizard in Windows, And Technicaly theres no way to store Passwords/collection of bytes in the memory after switching/shutting ...
3
votes
2answers
113 views

Microsoft recommended patching period - Security Patch release and updates

Ideally a security patch released by a vendor such as Microsoft for the Windows OS is required to be patched immediately. What would be the recommended patching period that Microsoft or best practices ...
0
votes
1answer
138 views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
9
votes
0answers
725 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
0answers
122 views

Using “Security Compliance Manager” to audit a Windows system

I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions: Windows security policy analysis tool How do I apply a ...
1
vote
1answer
52 views

How to configure routing infrastructure so that the appropriate network traffic gets passed to the honeypot machine (windows xp)

I would like to configure local honeypot on windows xp which is installed on vmware, to do so I follow instruction on this link, but as I am new I don't know how can I configure routing infrastructure ...
19
votes
3answers
4k views

How can I tell if I have the citadel virus without downloading an antivirus?

I recently received an e-mail from Virgin Media indicating that I might have the Citadel virus. It obviously sounds like a fake e-mail, but I am almost certain it is genuine, as they had my name and ...
1
vote
2answers
101 views

Unregistering keyboard hooks by timeout expiration

I'm writing a password manager for Windows which I want to protect against keyloggers. There is a timeout of 5000 ms for keyboard hooks. The hook procedure should process a message in less time ...
1
vote
2answers
577 views

Can I exploit Windows kernel from user-mode application?

In this document is detailed technique of exploiting Windows kernel. But writer is talking about accessing kernel memory & doing exploit from user-mode application at the same time. Can I do this ...
15
votes
6answers
3k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
1
vote
1answer
160 views

How can one restrict Windows shared folders access to specific applications?

There are few shared folders in my company that are accessed by applications from different branches across the country for different transactions. Hence they are kept "open". During a recent PT ...
2
votes
1answer
180 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
4
votes
1answer
219 views

How to protect against viruses that takes files as hostages by encrypting them?

Today I was infected by CoinVault, a new malware similar to CryptoLocker I believe. Before today I was unaware of this entire type of malware. Fortunately I was protected by offline backups, but I ...
0
votes
1answer
104 views

How is Thread local storage used by malware/Virus?

I have been told that code in TLS is run before the entry point of an exe is reached ,so if one puts a breakpoint on this TLS address he/she could debug the behavior of the virus.Can Fiber local ...
1
vote
2answers
134 views

Can folders [alone] have viruses?

I know that files can be infected, but can a Folder itself have a virus/trojan?
3
votes
1answer
78 views

C:\Users\Public\ for sensitive data

Installing a MS Windows based system that is to handle various sensitive data (accounting, personnel etc.). Somewhat to my surprise it consistently want to put everything under c:\Users\Public\ ...
1
vote
0answers
38 views

Right security architecture for SQL Server access in a distributed Windows-based system [closed]

I am designing a software product for which multiple SQL Server databases will be accessed by multiple applications residing in different Windows environments. Some of the environments are process ...
0
votes
1answer
131 views

Upgrade my Dell Inspiron laptop for PenTesting [closed]

I have a Dell Inspiron N5110 & wanna upgrade it to start practising pentesing with virtual machines. What do u suggest from specs below to upgrade (I have Kali Linux, Tails OS, XP, Metasploitable ...
-1
votes
1answer
108 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
48
votes
1answer
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
3
votes
2answers
88 views

Corporate Domain-Joined PC Used in China [closed]

What would be the disadvantages of allowing a user to travel to China (business trip) using a domain-joined corporate Windows PC as opposed to a non-domain-joined PC?
2
votes
1answer
201 views

Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)

My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model. After reading Qualys's blog regarding slow TCP reading, I ...
1
vote
2answers
100 views

Quick question regarding suspicious disk space use: [closed]

Quite some time ago I used a friend's computer. I can't remember exactly what I was doing; but as part of whatever it was, I needed to use a USB flash drive. At a point in time soon after connecting ...
1
vote
3answers
305 views

Security in Windows 7 vs Ubuntu

I have two semi-related questions about the security-related reasons I hear for switching to Ubuntu over Windows 7 (or from other Windows OSs to other Linux distributions). Someone people say that ...
3
votes
1answer
195 views

If I visit a https site from a Family Safety-enabled computer, and someone drops in on the connection, will I be notified?

While reading about Family Safety and HTTPS: Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is ...
1
vote
0answers
56 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
0
votes
1answer
83 views

csh http shellshock on a windows 2008 server

My company's McAfee system detected many "http CSH bash ShellShock code injection attacks" attempts on a Windows 2008 server running Apache Tomcat Coyote. Does this config present a potential attack ...
12
votes
6answers
15k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
8
votes
5answers
11k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
1
vote
1answer
84 views

What is the difference between certified and non-certified drives for Windows To Go?

Microsoft suggests "certified drives" for http://www.microsoft.com/en-us/windows/enterprise/products-and-technologies/devices/windowstogo.aspx, but it appears that other than confirming that these ...
4
votes
2answers
49 views

monitor port scan on the same segment

if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. is there any solution to that ? maybe using the windows fw on ach workstation to ...
2
votes
2answers
2k views

Chrome is denying me access to the youtube website and it says incorrect certificate for host

I've been trying to access the website of youtube but it keeps denying permission. It says Incorrect certificate for host. The server presented a certificate that doesn't match built-in ...
1
vote
1answer
119 views

How can Stolen Laptop tracking softwares survive OS reinstall?

Some softwares such as Computertrace claim that it can survive on a laptop even if the thief successfully reinstalls the operating system, reformats the hard drive, or (in some laptop models) swaps ...
1
vote
0answers
130 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
1
vote
1answer
120 views

Does anything stop applications from reading your saved passwords and cookies from your browser's AppData folder?

Obviously the first answer is "a malicious application can do much worse than that." However, it seems like a really easy thing for an application to read your cookies, saved passwords, etc. from your ...
0
votes
0answers
66 views

Which antivirus scanners detect malicious files like image files / text files that seem harmless? until double clicked?

I'm on win7 64bit, and I just found out that you can embed scripting data into images and plain text files where it would run the cmd.exe file to execute other scripts. What type of antivirus scanners ...