0
votes
0answers
10 views

certification verification using x509

I have been provided with X509 certificates in PEM format by interface system. they are sending byte of 256 length which they call it as public certificate. I need to verify this 256 bytes with X.509 ...
0
votes
0answers
11 views

Opening Tor-downloaded files while offline

I've read that opening files using certain programs such as Flash or Word can automatically send out information from your computer which may compromise anonymity when using Tor. What I'm wondering ...
1
vote
0answers
11 views

What can you do with an ATM pin but no card

I understand that various types of malware attempt to steal ATM pins . Presumably the attackers have no access to the physical card, so what can they do with the pin?
0
votes
2answers
16 views

Vmware over unsecure os

I run a vmware with linux through my windows os. I want to use vmware online for online transactions. Is it possible for a virus, spy or worm to attack my vmware linux? Is my linux environment the ...
1
vote
0answers
10 views

How to use SSL approach at the application level

The SSL approach of using public/private key (asymmetric) mechanisms to establish a symmetric working key for data encryption seems like it would be a good approach for end-to-end secure data ...
1
vote
1answer
23 views

Gaining root access on Ubuntu 14.04

I am taking a Computer Security class and I am supposed to harden my system really well but I am supposed to leave one "hard backdoor" for the adversary to gain root access. I have been trying to ...
0
votes
1answer
26 views

Malicious JavaScript warning

I visited a site yesterday and received no malicious javascript warnngs. Today I visited that same site and got the warnings. Do I need to be worried about being infected with something?
0
votes
0answers
24 views

Methods to find IP Address?

I'm currently exploring methods of recon and discovery on my Metasploitable 2 and Kali Linux VM environment. I've worked with nmap scans which is great if you are connected to a specific network and ...
1
vote
0answers
5 views

Secure point to point remote access to NAS drive

This question is very similar but also distinctly different (How do I ensure data encryption on Samba transmission on *NIX systems?) I'm looking to set up remote access to a NAS unit locally sharing ...
1
vote
0answers
6 views

How to configure pam to use with two different passwords?

Goal: I want to configure pam to use regular user password (pam_unix.so) and extra password. (with success only when I type both passwords correctly and deny (pam_deny.so) in case I type only one ...
1
vote
0answers
27 views

Difference between fully homomorphic and semi-homomorphic encryption

What is the difference between fully homomorphic and semi-homomorphic encryption?
0
votes
0answers
10 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
0
votes
1answer
22 views

why isn't my rule alerting to snort?

I am in the process of writing a custom snort rule for this exploit; http://www.exploit-db.com/exploits/35712/ and this is what I have so far alert tcp any any -> any any (msg:"BulletProof FTP ...
3
votes
1answer
48 views

Predicting Math.random() numbers?

I was reading up on the documentation for Math.random() and I found the note: Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to ...
0
votes
0answers
15 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
2
votes
1answer
32 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
0
votes
3answers
65 views

How can I spoof source ip address while making a ping request from windows command prompt? [on hold]

I am using ping command to test my website which is running on a local server at the moment.
0
votes
0answers
10 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
7
votes
2answers
636 views

Why don't popular web services mask the CVV?

Most popular web services like PayPal, Google Wallet, and others do not mask CVV numbers, eg: (<input type="password">). As I read, the CVV is a security feature and it seems logical to mask it ...
0
votes
1answer
38 views

Secure Delete RAM at Shutdown

How can I configurate a Linux distribution [like Debian or Ubuntu] to secure-delete RAM memory at shutdown? I have thought to edit the shutdown file script, making it to do something like this: ...
0
votes
1answer
24 views

Can I hide information from the device I use to encrypt it?

Assume I have some Information (i.e. my choice during an election) I want my device to encrypt. At the same time i don't want my device to know the meaning of the information it decrypts. Example: ...
2
votes
1answer
26 views

Anonymous communication network - Tor

When using an anonymous communication network like Tor, to ensure privacy you must route your DNS traffic through the system even if your computer always uses DNSSEC for DNS lookups, would this be ...
0
votes
1answer
18 views

Signing the Recovery Partition

Do any computer manufacturers sign (DSA, or just publishing a hash) their recovery partitions so that I can be sure that these bits are authentic? I'd like to buy a second-hand computer and reduce ...
1
vote
2answers
67 views

Need some docs that say we shouldn't upper the string when saving it as a password [on hold]

I'm trying to find on the Internet some manual, guide or policy secure about applications should not convert lower string to upper string to store as password I mean, don't make ...
3
votes
1answer
29 views

A certificate site name mismatch when using preinstalled Toshiba software? (Superfish?)

On my Toshiba laptop there are a variety of different Toshiba programs that came pre-installed. Many of them are some sort of utility, optimizer, checkup, and update kind of programs that I guess are ...
3
votes
0answers
49 views

How are symmetric cryptographic keys stored?

If you have a symmetric key which is negotiated via SRP protocol between a mobile device (e.g. smartphone) and a server, what would be a safe way to persist this resulting key on each side? On the ...
0
votes
0answers
21 views

How can MITM be performed in WebRTC?

From what I could tell, certificates are self-signed. When A wants to call B, after they finish relaying data to server, they initiate communication with each other. Certificates are self-signed, ...
-2
votes
1answer
33 views

Issue regarding vulnerability of cookies [on hold]

If someone somehow manage to copy all the cookies from my PC,can they be misused to get my private information or can information extracted through them? If yes,Please suggest some counter measures. I ...
1
vote
1answer
27 views

Authenticity of PDF document printed from Word

My MS Word Add-In generates PDF preview of DOCX file on client PC and uploads both files to server. I cannot generate PDF on server. Is there any way to make sure that the PDF is the printed version ...
0
votes
0answers
18 views

Hack Laravel based website using sqlmap [on hold]

I am currently building a website using Laravel Framework (PHP). Using sqlmap to test the safety, however it seems that that Laravel has already covered this. Has anyone tried methods/parameters to ...
0
votes
1answer
60 views

How to build a secure stateless authentication system for a client-side JavaScript application

i'm building a stateless authentication system for a Dart application (Dart gets compiled to JavaScript, so the whole application is an index.html file which loads JavaScript and runs in the browser) ...
-2
votes
0answers
37 views

What dashboards are really helpful in a Security Operations Center(SOC) [on hold]

How effective are the current dashboards projected on big screens (or even viewed in desktops) in a SOC Center ? Are the eye candy geographical maps, histograms of top-k hosts/malware/files etc. , pie ...
1
vote
1answer
21 views

Difference between Architecture review and a Design review

As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a ...
1
vote
1answer
41 views

Tracing stolen android tablet via MAC address [on hold]

I lost my tablet , but I can see that the tablet is connected to the network on my router: :So I know the MAC address but I am unable to trace my tablet using this information and I am running out of ...
-1
votes
0answers
31 views

Computer Security [on hold]

In the ideal block cipher with 64-bit blocks, there are 2^64! possible keys. How many bits one needs in order to represent the keys in binary? Show your calculation steps.
1
vote
1answer
25 views

Getting started with biometric locks?

I am not sure if this is the place to ask this question and if it is not, i would really appreciate it if you could direct me to the right place. I wanted to understand the functionality and the ...
1
vote
1answer
78 views

How can I tell if a user is access website with a forged IP?

there is a username (USERX). It's a suspended user. It it appearing in my user login files. It always appears in the middle of someone elses attempt (USERA) to reset their password, and WITH USERA's ...
2
votes
1answer
39 views

Mysterious Incoming/Outgoing Packets on my Wireless Connection

Right now I am connecting to my work server as usual and during my connection through the VPN I always monitor the network ping through terminal and its always between 70-90. It usually never goes up ...
0
votes
1answer
132 views

Post from HTTPS to HTTP

If a server posts a message via HTTPS to another server that does not have HTTPS enabled, will that message still have been sent encrypted? For example, a message from https://example.com to ...
0
votes
1answer
23 views

follow up to previously answered “Escalating from Apache shell to root”

I have seen numerous questions similar to the above with answers that relate to elevation of privileges to those of root. the answer and example that silverlightfox has given is one of the better ...
0
votes
2answers
52 views

Looking for a (simple) utility to decrypt rsa-encrypted text in Windows?

Quick question: I'm looking for a simple utility program to be able to decrypt rsa-encrypted data (either base64-encoded or binary attachment) on a Windows workstation. Scenario: There is a group of ...
-5
votes
0answers
33 views

Is someone using my PHP script? [on hold]

Well I've made a forum in PHP from scratch and I'd like to share it online. I'd like to know if there's any way to figure out if someone's using my script.. Basically I'd like to know how many people ...
0
votes
1answer
14 views

General concerns with cookies and privacy

The following post is in regards to headless *nix machines only... I know programs like wget allow options to control cookies. However if a program is not HTTP centric, has little or no options for ...
-1
votes
0answers
35 views

DDoS detection system [on hold]

When designing a DDoS detection system, one must make use of statistical characteristics of DDoS traffic, what are they? Also, the person should include an appropriate traffic collection method, which ...
0
votes
1answer
44 views

What these Wireshark screenshoots should demonstrate?

I'm reading an article about the recent Github DDoS with traffic comming from non-chinese Baidu users here. There are two Wireshark screenshoots in the middle of the article with arrows pointing to ...
2
votes
2answers
85 views

Is VPN the best solution against man-in-the-middle attack? [on hold]

I'm looking for the best way to protect my enterprise against man in the middle attacks, because a lot of people connect to the same network. So I was thinking of creating a VPN. Is this really the ...
0
votes
1answer
14 views

Double socket connection

I'm busy experimenting with TCP socket connnections. I have made a client SOCK_STREAM socket andi've got a few questions: Is there any way that a streaming(TCP) socket can get data from another ...
1
vote
2answers
68 views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
0
votes
0answers
10 views

How can i make Digital forensic Images with Vmware?

My tittle did not complete. I will explain as a wide view. How can i make Digital Forensic Images with V-mware, Virtual box, V-sphere for practice digital forensic. and then how can i add various ...
0
votes
0answers
37 views

What is basic Digital Forensic Hardware? [on hold]

Last a few months, I wanna setup a small lab about Digital Forensic. So I searched which hardware device need for my small lab. I cannot imagine about that which device need for my digital lab and ...

15 30 50 per page