A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

0
votes
1answer
381 views

How to generate self-signed EV SSL Certificate?

I configured XAMPP / Windows on my laptop so that this URL: https://www.supersite.com/ points to XAMPP / localhost rather look elsewhere. I basically generated a self-signing certificate, imported ...
51
votes
2answers
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
2
votes
1answer
3k views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of ...
1
vote
1answer
229 views

Execute cmd commands with http directory traversal attack

Question Summary: I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can ...
0
votes
1answer
458 views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
5
votes
3answers
409 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
2
votes
2answers
1k views

Windows Update - Interception

I'm trying to monitor the HTTP requests/responses made when performing a Windows Update. I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp: netsh ...
1
vote
0answers
22 views

Protect Specific Services on Client PC

I am not sure if I am asking in the correct location for this, but will ask in the hopes you assist. I want to be able to lock certain services from being restarted/stopped/ended. I know most ...
1
vote
2answers
62 views

secure notebook options [closed]

How can I secure my notebook with highly sensitive information stored in a spreadsheet. I am keeping the following options in mind: Password protect & encrypt BIOS Full disk encryption Password ...
0
votes
2answers
214 views

Can server administrator dump memory remotely thru Dell iDrac card?

I might at some point to invite another person into my software project. I don't mind sharing the code but the data I use is very sensitive. Once he gets hands on both pieces I wont see him again (if ...
1
vote
1answer
116 views

Can the Windows lock screen be attacked with software? [duplicate]

As a follow-up to this question, I am wondering how much care I need to put into my Windows login password, for when I leave my computer alone in "sleep" mode. (I know that Windows passwords can be ...
0
votes
0answers
40 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...
32
votes
4answers
4k views

Is my data safe if, with an encrypted hard disk, I put Windows in “sleep” mode

Both my boot partition and my data partition are encrypted with TrueCrypt. My password is lengthy, so I find myself avoiding a reboot of my system whenever possible. When going to lunch (for ...
25
votes
4answers
4k views

Is it possible to detect a honeypot? [closed]

Do techniques exists to know if a machine is a honeypot (or suspicious indicators)? What techniques can be used for a software inside the honeypot or outside it? What techniques uses malware to ...
1
vote
1answer
59 views

How do I get the thumbprint of an SSH2 public key on windows?

I have a SSH2 public key with a .PUB extension and when viewed in notepad it has this header: ---- BEGIN SSH2 PUBLIC KEY ---- How do I view the thumbprint of this key? I've attempted ssh-keygen ...
5
votes
3answers
1k views

Is it possible to catch a virus on my LAN without clicking on anything?

My unpatched PC running Windows is connected to a network which contains other "infected" computers, can I get infected by viruses without any interaction on my part?
2
votes
3answers
55 views

Utility to build IP exclusion list? [closed]

Are there any utilities out there that can assist in building an IP exclusion list? Scenario: Recently suffered a brute force attack where 50000 failed login attempts came from a multitude of ...
2
votes
2answers
145 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
0
votes
0answers
156 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
1
vote
1answer
215 views

What is the difference between certified and non-certified drives for Windows To Go?

Microsoft suggests "certified drives" for http://www.microsoft.com/en-us/windows/enterprise/products-and-technologies/devices/windowstogo.aspx, but it appears that other than confirming that these ...
6
votes
3answers
3k views

Man-in-the-middle Blue coat proxy ssl or what?

I have just discovered that my workplace have enabled some new feature in the blue coat network proxy. It seems like all https certificates in chrome on windows is being issued by this internal ...
7
votes
2answers
24k views

Is there an SSL / TLS Certificate state-cache on Windows, IE, and Outlook and how it it managed?

Today I changed the SSL certificate that 3,000+ Outlook clients are using. In doing this I changed the certificate to an "older" one that had the same subject name, expiration and everything else. ...
0
votes
1answer
63 views

Disable a specific services in Windows 7 [closed]

I am using a Windows 7 and I want to Disable some Services, How can I do this? For my machine only? For some machines inside the Active Directory I can control? For all machines inside the Active ...
3
votes
3answers
2k views

What risks are involved in exposing our home computers over the public internet?

I'm currently running a webserver from home accessible on the public internet via a static IP. What kind of risks are there in doing so? From what I understand, the setup will not allow connections ...
15
votes
7answers
4k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
0
votes
0answers
50 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
-2
votes
1answer
179 views

What are the new security features in Windows 10? [closed]

Title says it all really. I realise I can Google this, but the top links don't cover all the new features I am aware of, so people will benefit from a canonical answer here.
1
vote
1answer
71 views

Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment?

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production ...
2
votes
3answers
399 views

Completely encrypting virtual machine (for free) [closed]

I know in VMware workstation there's the option to encrypt a virtual machine. Is there a free way to do this without VMware workstation? I'm aiming for the fullest encryption and encapsulation ...
5
votes
4answers
176 views

How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how ...
1
vote
4answers
163 views

Possible to find out the last person to open a file on Windows without specialist tools?

So I suppose this is specific to the OS you are using or the filetype or software used to open it, but my question stands open for all really but I am particularly interested in more common files such ...
2
votes
1answer
181 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
4
votes
1answer
265 views

How do I continue pentesting with access to local station?

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an ...
0
votes
1answer
141 views

How does driver install with an expired cert?

I'm working on making a silent installer of WinpkFilter driver. In my silent installation, I'm always getting a (not so silent) prompt that says "Windows can't verify the publisher of this driver ...
2
votes
4answers
408 views

Can any dangerous file(Virus, Trojan, Malware, etc) cause harm inside a zip or rar?

I am using Windows 8.1 pro with Mozilla Thunderbird for my email requirements. I have my Thunderbird set to auto download all email attachments, however upon runnning a Virus scan I am seeing many ...
0
votes
2answers
45 views

Can I add a new user to an unencrypted Windows installation from a Windows installation disk?

I recall hearing this before, the ability to boot up a Windows PC with an unencrypted hard drive using an installation disk/usb, and use the command line utility on the Windows installation disk to ...
2
votes
0answers
93 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
19
votes
3answers
4k views

How can I tell if I have the citadel virus without downloading an antivirus?

I recently received an e-mail from Virgin Media indicating that I might have the Citadel virus. It obviously sounds like a fake e-mail, but I am almost certain it is genuine, as they had my name and ...
0
votes
2answers
2k views

Bitlocker without TPM with both a startup USB and password?

On a Windows 8.1 Pro PC without TPM, how can I use Bitlocker with both a startup USB drive and password? I don't have the option to use both of them, is this possible via command line? Currently, ...
6
votes
1answer
287 views

Should I install my subordinate Certificate Authority on the domain controller? Why?

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
3
votes
3answers
2k views

Task Manager and Keyloggers

I know that some of the best keyloggers can't be viewed from the Task Manager. Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden ...
9
votes
1answer
2k views

Why is Windows Explorer making external connections?

I'm seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe 4052 ...
7
votes
2answers
9k views

Can running a browser in Windows Compatibility Mode be a security issue?

I have several clients that are having trouble logging into vendor's web service. When talking to the vendor about the issue, they told me to set them up with Chrome running in Windows XP ...
2
votes
0answers
36 views

ESI and EDI Overflow [duplicate]

I tried fuzzing an application and ended up with my fuzz string in the EDI register and my program stopped with access violation when reading ESI. I checked the SEH, but it seems un affected :( I am ...
0
votes
0answers
27 views

Apache.exe trojan attack on xp server, wiped it with a linux install am i safe? [duplicate]

Hello I ran a apache web server on a windows xp pc on my home network. My antivirus picked up an attack, but didn't prevent it. It seems I had a Trojan attack on my apache.exe that got through. I know ...
7
votes
2answers
17k views

Windows groups and permissions: Authenticated Users group meaning

What is the purpose of the "Authenticated Users" group in Windows? Under Linux it doesn't exist and I'm starting to think this is another idiosyncrasy or over-engineering of the Windows operating ...
7
votes
3answers
461 views

CTF competitions/challenges that are Windows based?

I've been messing about in CTF's for a while and I also do pen-testing professionally, what i've noticed is a distinct lack of CTF competitions using windows environments. This is in stark contrast ...
1
vote
1answer
207 views

Minimize risk with Windows 2003 end of life

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime ...
3
votes
2answers
58 views

Signing the Recovery Partition

Do any computer manufacturers sign (DSA, or just publishing a hash) their recovery partitions so that I can be sure that these bits are authentic? I'd like to buy a second-hand computer and reduce ...
8
votes
3answers
5k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...