0
votes
0answers
4 views

bell lapadula model and composite services

I am studying on evevaluation security of composite services.The bell lapadula model is useful for access control.Can I use of this model for access control in composite services? Security level of ...
0
votes
0answers
7 views

Boot Attacks possible on encryption keys used in virtual machines

Is it possible for an attacker to restore passwords or encryption keys that one has used in a virtual machine the same way like restoring keys that have been used in a standard system applying a boot ...
-1
votes
0answers
17 views

How to test if my server is secure?

I'm using a debian7 VPS for hosting my websites. I have only installed webmin, apache, mysql, SSH and a wordpress website. I always update my packages and wordpress version. What is the best (free) ...
4
votes
0answers
24 views

How to publish scanned documents anonymously?

I was thinking of the following question for a long time and did not find a lot of material* in the web and nothing at all on Security.SE. I think its a very interesting question as it covers ...
1
vote
3answers
24 views

Methods to have multiple Anti Virus installed on one machine

I am running Windows 8.1 Pro, Ideally I would like to have the top 5 Anti Virus installed but I am aware it is not advised as they can clash with each other. I was wondering if there is a favoured ...
5
votes
1answer
154 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
3
votes
4answers
303 views

Does read-only access to the database prevent sql injection?

I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack ...
0
votes
1answer
13 views

Any Value in an AIA Extension in a Certificate Issued by Root CA

While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in ...
0
votes
0answers
21 views

startups - securing data and applications on laptop

I am starting an organisation of web development. I owned some laptop(s) for same reason. Employee can carry those laptops at home. But when they will be login to system in office, they can have ...
0
votes
1answer
21 views

Android email encryption

Is there a reliable (in terms of security), open-source application for handling (send/receive + en-/decrypt) encrypted emails on Android? Something like TextSecure for emails. I just found a command ...
0
votes
0answers
9 views

On firefox behind corporate proxy, intercepting on WebGoat using burp Suite error

i'm following a tutorial on hacking web application WebGoat using burp suite I've downloaded webGoat which now runs on port 8080, set up burp suit and the browser connection as in the pictures, but ...
1
vote
1answer
25 views

How could honeypot be vulnerable?

We've been hacked for the 2nd time without knowing how/who did it. Luckily we were able to shutdown everything! We're trying to deploy Honeypot to be in control of what is going on from our local ...
0
votes
0answers
17 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
0
votes
1answer
23 views

Suspicious wifi networks from distant places and hotels

When I check my Macbook's network settings, I see some unfamiliar wifi networks from distant places like famous hotels. It's impossible to connect to those networks because I've never been to those ...
0
votes
0answers
20 views

Are there any regulations regarding password storing schemes in the EU or US?

I'm interested in the existence of regulations (mostly EU, but US is also relevant) that particularly state some minimal requirements on the schemes used for storing passwords, applicable for ...
-2
votes
0answers
19 views

What is the most secure way to stream video? [on hold]

If the privacy is primary, when video is streaming from RPi surveillance camera to only one user, what is the best protection of transferred data, which encoding and which protocols are suitable? ...
3
votes
1answer
61 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
-1
votes
0answers
19 views

Split Wireless Card For Fake Access Point? [on hold]

I'm trying to make a fake access point. Here are the steps I'm taking. How can I split my wireless card, so I have one half being the Access Point, and the other half leading to the internet. Is this ...
-3
votes
0answers
15 views

verification code problem, can't continue on my Yahoo inbox [on hold]

Please help. I can log in with my Yahoo but it needs a verification code to continue to my inbox and I've lost my phone.
1
vote
2answers
108 views

Is browsing http sites insecure?

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, ...
-6
votes
0answers
23 views

Public and private key geerating in C Code source ? [on hold]

I'm looking to a public and private pair key with C ( like this one in the link below ) , is there any one have the source code of it ? any help would be appreciated ! Thank you . Create RSA public, ...
-7
votes
0answers
21 views

shared wifi router problen [on hold]

i have shared wifi in my home but one of our member once she used her laptop the signal goes too slow and shutoff my signal, is he had been hacked? or how can i protect my router even one of my shared ...
0
votes
2answers
41 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
3
votes
1answer
45 views

Bypassing XSS filter

<script> Something.execute("injectionpoint"); }, true); </script> I am trying to bypass an XSS filter but its not working since since " is filtered as \" or ;\" depending on where " is ...
-4
votes
0answers
18 views

Server side script to check if browser is vulnarable to SSLv3 Poodle [migrated]

I want to implement a browser SSLv3 Poodle vulnerability test like https://zmap.io/sslv3/sslv3test.html on my web application. My idea is to put a routine in the application first page to tell to my ...
2
votes
0answers
32 views

Securely delete a file in Ubuntu? [migrated]

I have been reading about government standards for secure data erasure by overwriting the file location with random data [wikipedia: data erasure standards]. I am wondering if Ubuntu's default Delete ...
0
votes
1answer
19 views

Are DLLs in URLs executed on users local machine or on the remove machine?

In this question I am referring to DLLs listed in URLs such as this one: http://survey1.sendyouropinions.com/mrIWeb/mrIWeb.dll When this kind of URL is navigated to, is the code in the DLL executed ...
-5
votes
0answers
16 views

how to write fragmented attack code? [on hold]

what kind of attack of fragmented attack do? is all kinds of attack be rewritten into fragmented attack code? what kind of attack that fragmented attack can not do? where do fragmented packet ...
2
votes
1answer
27 views

Choosing a group of symbols that contains a password

My bank employs a step in its authentication process besides [the card itself and] the regular password, where the user has a secondary password (3 small sequences of letters, such as Hy X Ba) ...
-2
votes
0answers
12 views

Is there a MITM tool for forcing weak SSL cipher suite like by using ettercap or mitmproxy? [duplicate]

I know that this question has already been asked before, but i could not get an answer of how to do it?
1
vote
1answer
30 views

VM production server and low entropy

I'm monitoring a VM functioning as our production server. I noticed it has at many times, quite low entropy (/proc/sys/kernel/random/entropy_avail). On average our server(which among other stuff does ...
3
votes
1answer
37 views

Can user send fake request if it has JWT token?

I developed an android application that request to a REST service for do actions! My questions are: If anyone trace the requests and responses, Can he get the token from headers? Where should I ...
-2
votes
0answers
41 views

Problem with Nessus scanner [on hold]

I downloaded Nessus scanner (home edition) and installed it. Then i updated its plugins and choose a WebSite for scanning ( Web Application Scanning mode ) But it ends after 5-6 seconds :| What's the ...
1
vote
1answer
25 views

is there a Virus that attempted to foil generic decryption techniques and how it did that?

is there a Virus that attempted to foil generic decryption techniques and how it did that ? need t o know the VIRUs name because i tried searching and unable to locate any virus who did that and the ...
0
votes
0answers
15 views

Win server 2008 partition security [migrated]

I am trying to lock a partition in the server so, that it is accessible by only one domain admin, and not even the administrator can open it. But at the same time I want to keep it shared so, that the ...
0
votes
0answers
18 views

Timestamp response behaviors in different tools [migrated]

I was testing out icmp time stamp response on one of my servers using ping and hping3. Here is result of hping3 # hping3 --icmp-ts x.x.x.x HPING x.x.x.x: icmp mode set, 28 headers + 0 data bytes ...
1
vote
1answer
60 views

backdoor php trojan still dangerous on my local machine?

I recently removed and fixed a lot of backdoor trojans in some files in one of my servers, and I copied those files to my local computer. But the issue is that now that I run the virus scanner on my ...
-8
votes
1answer
44 views

How to attack a web page to gain username and password of any or specific user? [on hold]

Web page does not use SSL. Server uses SQL. Given that passwords are not stored in plaintext in database. I want to find out methods to do so.
-7
votes
1answer
35 views

How to attack on a web page to gain username and password? [on hold]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
2
votes
0answers
51 views

Can Google tech be trusted? [on hold]

With the Snowden leaks, Google has been implicated in the activities of the NSA. There really is no way for ordinary citizens to know with certainty what the exact reality of this involvement is. In ...
0
votes
0answers
29 views

How to secure peer-to-peer chat (includes video) - school project [on hold]

I am making a school project in which I have a private network (but not always) of peers in which everyone can contact everyone and I need to secure it somehow. Everyone has their own IP address. I am ...
0
votes
1answer
24 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
-4
votes
0answers
35 views

blocking skype or webcam signals via router? [on hold]

hello guys i wanted to block skype through my router, is this possible? anyone know how? if thats impossible, is there a way to block a webcam from sending video signals through my router? thanks
3
votes
2answers
125 views
+100

How can I explain “zero knowledge proof” to an end user?

A ZKP allows proof of knowing the answer to a secret, without actually disclosing what that answer is. Is there any analogy that can help people put this concept into everyday practice? A "lie to ...
1
vote
1answer
43 views

Which security documents do providers typically share with their customers?

In the context of managed/cloud hosting, what level of information does a provider typically share (under NDA) with its customers for compliance audit/3rd party risk assessment purposes? What are ...
-4
votes
1answer
53 views

How to make my PHP website vulnerable to SQL injection [duplicate]

For training purposes, I want to make a demo website vulnerable to SQL injection. I went to the .htaccess file in the server and added these 2 lines: php_flag magic_quotes_gpc Off php_flag ...
-4
votes
0answers
38 views

How to hack hearing aids [on hold]

I have hearing aids. They came with this lovely remote https://starkeypro.com/surflink-mobile/ which I can do cool things like direct phone calls and music directly to my hearing aids. However the ...
0
votes
0answers
23 views

How come UAC logs are not being stored in Event Viewer? [migrated]

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
-4
votes
0answers
49 views

How to perform simple DOS attack for my class presentation? [on hold]

I am in a computer networks class at my college. I am going to be doing a presentation on DOS attacks for that class. Does anyone have any ideas on how I could perform a simple DOS attack on ...
0
votes
0answers
25 views

Is it possible to configure Azure Web site SSL protocols & ciphers [on hold]

I want to be able to disable TLS 1.0 protocol and the RC4 cipher on an Azure website (or Web App) and I can't figure out if it's possible or not. I know what registry settings to update but the ...

15 30 50 per page