-1
votes
0answers
7 views

Python based router pentesting framework failed to work [on hold]

I am pentesting my local network using the python-based routersploit framework. During execution it gives the error: Traceback (most recent call last): File "./rsf.py", line 11, in <module> ...
0
votes
0answers
11 views

Which is better Detecting spam at receiver or Source?

Background I researched on detection of spam sent out using bots.After studying different techniques used by bots to deliver spam,I have no generalised solution to detect spamming at the source ...
0
votes
0answers
7 views

Generate Subject Key Identifier by hand using openssl command sequence

When creating a signed certificate I get the lines inside the certificate that identify the keys used: X509v3 extensions: X509v3 Subject Key Identifier: D8:D7:3F:99:CC:D7:20:AF:62:31:...
3
votes
1answer
17 views

Where to find modern information on cipher suite strength?

I am hardening the configuration for my /etc/ssh/sshd_config and have a few choices for Ciphers: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,...
-1
votes
0answers
20 views

Browser change the IP addesses of the POST requests

On my work PC i have web server working on localhost for development purpose, i use vhosts to access the projects - example: mycompany.dev -> 127.0.0.1 In this project there is a protection against ...
-3
votes
1answer
51 views

Does combining two encrypted strings secures password?

For example, a person having password 123456. it's MD5 is e10adc3949ba59abbe56e057f20f883e and SHA1 is 7c4a8d09ca3762af61e59520943dc26494f8941b and after joining both hashes. Which comes to be ...
2
votes
0answers
7 views

Would it be possible for shellcode to call non exported functions in a dll?

It is just a question that came into mind today. I know that you can use getprocaddress to get the location of exported functions at runtime.. http://stackoverflow.com/questions/2918234/calling-a-non-...
0
votes
0answers
41 views

ipaddress of my VM doesn't look correct [migrated]

I am trying to setup metasploitable in a Virtualbox VM. My impression is, that once Virtualbox is set up to work in host-only adapter mode, the VMs should follow the networking settings defined in the ...
0
votes
0answers
14 views

Feeding Azure portal logs into a SIEM solution

Currently working on a cloud transformation project where all infrastructure is being placed into Azure. We currently use a SIEM solution to monitor and assess events across the environment. The ...
1
vote
1answer
9 views

Are browsers fetching the XSLT namespace over HTTP when transforming XML?

According to the W3C recommendation https://www.w3.org/TR/xslt#xslt-namespace (and according to http://www.w3schools.com/xsl/xsl_transformation.asp), an XSL style sheet using XSLT should be declared ...
0
votes
2answers
21 views

Different certificates for the same website?

When I load https://objective-see.com in Safari, it shows me a certificate with CN=objective-see.com. However, when I retrieve the certificate using echo -e | openssl s_client -connect "objective-see....
1
vote
2answers
40 views

What is a firewall and its DMZ?

My question is in regards to network security. I understand that there should be a demilitarization zone at the border for your network. It is there where the perimeter firewall should live and ...
1
vote
1answer
15 views

How useful is Protocol Anomaly-based IDS?

Protocols such as IP, TCP, UDP, ICMP, and RPC, according to Juniper networks could potentially be useful for IDS objectives of determining the direction and test conditions. In a way, protocol anomaly-...
2
votes
2answers
48 views

Phone Call from weird number

I just got a call from a very weird number. On my phone it displays as "+1 (1) (5 )" and "USA" below. I answered the call and there was 100% silence. Then about 2 seconds later the call ended. Next ...
0
votes
1answer
25 views

Stolen Remote Desktop Protocol (RDP) credentials

I would like to know how to guard against RDP-renting services such as dedicateexpress.com which rents out stolen corporate laptops credentials. Are there IDS for such events?
4
votes
3answers
592 views

Adding “Email or Username” in login page, is safe?

Suppose a website has a login page with "Email or Username", and shows the username publicly to every user on that site. Does that make it easy for an attacker to hack other someone's account?
0
votes
2answers
83 views

Threatening text messages on my cell phone, 120 in one day but no phone number for sender, how do I get this info?

Threatening text messages on my cell phone, 120 in one day, but no phone number for the sender, how do I get this info? I think they were sent via home pc. What type of wording, code, etc. should I ...
0
votes
1answer
20 views

Questions regarding DNSSEC

Until now I understood the following about DNSSEC: A client requests a certain Domain let's say google.se The root server sends the client his public KSK and public ZSK signed by his private KSK so ...
0
votes
2answers
28 views

How secure is LAN wireless 802.11 if password is used with access point?

I've read a book on computer networks, and among other subjects the author touched WiFi security. It was said that WiFi has some serious security flaws and that there is even free publicly available ...
0
votes
2answers
88 views

Why is it a problem to store strong passwords as unsalted hashes?

My users all have strong (80-bit true entropy) passwords. How do I know that? Because my imaginary website randomly generates the passwords for them (client-side). In that context, could you explain ...
-4
votes
2answers
48 views

What is the difference between Social Engineering Attack and APT Attack?

Doesn't social engineering attack mean APT attack? They seem similar in my mind, because both of them focuses human, not technology. Shortly, what is the difference between social engineering attack ...
0
votes
0answers
44 views

Tunneling through 2 VPN's [migrated]

My university has recently instituted a no public VPN policy (basically to stop piracy) and I was busted for it but managed to scape off without any fines by pleading ignorance (my school really loves ...
4
votes
1answer
58 views

What infection vectors is Trojan.Linux.BillGates usually delivered with?

I just discovered that my server is infected with Trojan.Linux.BillGates.G and is being used to launch DOS attacks. It surprises me as the server is kept up-to-date (CentOS/Tomcat/CouchDB) as much as ...
0
votes
0answers
22 views

Basic question regarding OpenSSL and AES-GCM

While researching how to encrypt private keys for SSH connections as securely as possible, I have run into the following very basic understanding problems (Note: I have used the newest stable release ...
1
vote
1answer
81 views

Unencrypt Data Encrypted by Cryptolocker Virus

A while back my computer was encrypted by the cryptolocker virus. I ended up taking an image of the encrypted drive and then formatting it and installing a new operating system. Since I have the ...
0
votes
2answers
69 views

Bruteforcing hardware-encrypted SSD

Can you bruteforce a hardware-encrypted SSD drive? I mean recovering the password needed to unlock the drive. Is there any software could do this?
1
vote
3answers
58 views

Necessity of physical access to air-gapped computers

In an intriguing paper Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers (also see this summary) the authors demonstrate that they are able to exfiltrate data from an air-...
3
votes
1answer
58 views

How secure is a Windows 10 PIN not needing enter?

I've searched around about Windows 10 PINs and although have seen a few answers regarding the security of them as a whole, I haven't found any discussing the fact that when I type in my PIN, the ...
0
votes
0answers
31 views

MS Office 2013 hash algorithm in Python

I'm trying to make my own password cracker for Microsoft Word 2013 documents. I can get the hashed password from the file using office2john.py, but then I need to be able to take test passwords and ...
3
votes
1answer
65 views

How does Let's Encrypt prevent imposters?

Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?
0
votes
0answers
9 views

How to integrate or use pkcs7 response from Esign service provider [on hold]

I am getting response from Esign service provider wherein I am getting pksc7 response in base64 format. How do i use it and embed the signature in pdf file.
1
vote
0answers
9 views

Feasibility and scalability of a large biometric system (UID Aadhar)

Over the last five years, India has systematically advanced a biometric identification scheme, which now has an enrollment of over 800 million users. To ensure the accuracy of matching for such a ...
0
votes
2answers
32 views

Spam mails originating from botnet

Background I am working on spam detection at the receiver side,i.e where all mails are delivered,i.e at the mailserver side. Spammers are capable of sending spam mails through Bots,Open relays and ...
2
votes
2answers
32 views

Does MITM refer to what you do in the middle or how you get there?

Does the term "MITM attack" refer to what happens once an attacker is between two hosts or to attacks like ARP poisoning, DHCP snooping that allow the attacker to insert himself between two hosts in ...
1
vote
0answers
7 views

Where should the SCEP requests be decrypted?

Let's say you provide a SCEP service available to the outside world, where should the SCEP requests be decrypted? At the load balancer, in the backend server, elsewhere? It doesn't look like there is ...
0
votes
2answers
38 views

If I run an infected DOS .COM file in DOSBox on C: directory will my main OS be damaged?

I want to test some DOS viruses. If I run them from C: will my computer be damaged?
1
vote
1answer
8 views

SELinux: command line tool to look security context (like selabel_lookup(3))

The selabel_lookup(3) library function gives a way to obtain the SELinux security context information for a file - or rather what security label a file is expected to have [1]. Is there a command ...
6
votes
1answer
82 views

Is there a reason why legit web sites are using this type of obfuscation?

Saw some top 200 web sites (by Alexa) using obfuscation in the javascript code. Any ideas on why they do it? My guess is that they do it to prevent data scraping, but not sure. Thanks. youtube ...
0
votes
1answer
31 views

How does the exploit of CVE-2012-4221 work?

I am researching a number of Android/Linux kernel vulnerabilities. Towards CVE-2012-4221, I can only get two patches online: https://source.codeaurora.org/quic/la//kernel/msm/commit/?id=...
1
vote
2answers
42 views

When should I create and use my own CA?

I was taking a look to one Docker tutorial in which is explained how to create and use our own CA for encrypting the communication between the Docker client and the daemon and immediately a couple of ...
1
vote
1answer
42 views

Security disadvantages of sending a password with GET? [duplicate]

Other than over your shoulder peeping, if a password is sent using GET in plaintext over an encrypted connection, are there any extra security disadvantages or is it the same as POST?
1
vote
2answers
58 views

Risks in avoiding AdBlock detection by importing cookies or simulating the displaying of ads

I've increasingly been finding that many of the websites that I access have now been requesting whitelisting by my adblocker. Sites that do this like Forbes, NDTV, do not allow you to proceed until ...
0
votes
2answers
30 views

Is exposing the default plesk page dangerous?

Is exposing the default plesk page on an IP dangerous? I can imagine it is somehow usable for fingerprinting a version maybe. But is it dangerous anyhow?
2
votes
1answer
29 views

Is it safe to rely on email address from 3rd party identity provider?

Assuming that a 3rd party identity provider is reliable (eg; Facebook, Google, WindowsLive), is it safe to use email address (as provided by the service) to connect a user logging in with different ...
0
votes
0answers
25 views

How do you shun an IP automatically based on the number of current connections?

If I have a single IP that's trying a Denial of Service attack, how can I automatically have it banned/shunned? I go in and manually put it in a group of banned IP addresses, but I'd like for it to ...
1
vote
0answers
8 views

Storage of account password on keychain iOS to enable TouchID login

Currently in the middle of a rather long-winded process of deciding upon the use of TouchID within an application being developed due, to security concerns, and wondered if anyone had any advice? The ...
-4
votes
1answer
35 views

Public IP from my UVerse router

Please keep in mind that I don't know much so use small words and talk slowly when helping me out. At work we have our network set up in the following way: Our internet comes from AT&T U-verse ...
-12
votes
1answer
50 views

I have an MD5 encrypted link. How do I decrypt?

I have this MD5 hash of a link: 687474703a2f2f696d6775722e636f6d2f45554a43734742 I only have this code, no other information. How can I crack it?
1
vote
0answers
12 views

How does deauth protection (IEEE_802.11w-2009) work?

I read a Wikipedia article on IEEE_802.11w-2009 and I wonder how does it work with WPA2. In other words, how do I turn it on in my Linux kernel? If I enable it both in it and in an OpenWRT router, am ...
1
vote
0answers
32 views

Diagnose encryption problem in Microsoft Outlook?

I am unable to send an encrypted email to a party for whom I have a certificate. How can I diagnose the problem? Microsoft's error message does not explain what the problem is: Notes: The party's ...

15 30 50 per page