0
votes
0answers
3 views

How TLS certificate chain is verified

Assume the verification of a TLS certificate chain. Suppose the chain has certificates A-B-C-D where D is the root certificate and A is signed by B, B by C, C by D. SUppose the intermediate ...
0
votes
0answers
2 views

Iterate through and decode Dot11Elt layers — Scapy

OBJECTIVE I want to iterate through the Dot11Elt layers of a beacon frame that I captured with Scapy. I also want to decode the .info of each ID layer. def packet_handler(packet) : if packet....
-1
votes
1answer
4 views

Not sure if I have got a virus

About an hour ago a friend of mine sent me a suspicious link on Skype. It was a 'Goo.gl' link with my username in the url. I accidentally clicked on it and think I've gotten a virus. However I'm not ...
0
votes
0answers
9 views

How to Edit Malicious Webpage in BindTCP

I'm studying Ethical Hacking, using BindTCP on Metasploit, Kali Linux. This video shows the steps, and I successfully exploited an unpatched Windows XP running a vulnerable IE 6 (on my personal ...
-1
votes
1answer
15 views

Malware from TPB(piratebay) infected my pc. I need to transfer my data into external hdd before wiping my hard drive

OS: Windows (Primary), Ubuntu (secondary). Few days back I was using TPB(piratebay) obviously for educational purposes,even though I have ad-blocker at the time of browsing some advertisement did pop-...
0
votes
0answers
8 views

Client side encryption over SSL

I need to handle hyper secure data collected from webforms on a site. I was thinking of using whole site SSL encryption with client side encryption of the forms data. Due to a higher than usual risk ...
0
votes
1answer
23 views

understanding where tor interferes (screenshot)

with just goal to better understand where tor interferes and where it hides my browsing from ISP, please look at this picture which just explains how to computers communicate. You can check on step ...
0
votes
0answers
4 views

Can 802.1X, EAP and RADIUS work together?

So this is an academic question I came up with while researching the topic. Can 802.1X, EAP and RADIUS work together to provide a secure authentication? If yes, how? Thanks!
0
votes
0answers
9 views

Iphone 6s/ Ipad mini won't connect to proxies?

I've tried charles proxy and fiddler. I'm not really tech-savy, and the tutorial mentioned something like using an app that uses connections for charles/fiddler to detect for confirmation, but before ...
0
votes
1answer
5 views

Can software keyboard add security to decrypting FDE'd Drive

Having a LUKS Full Disk Encrypted Linux installation means that I need to input my decryption password before the Operating System can even start. This will require me to use a hardware keyboard on ...
-1
votes
1answer
30 views

Keeping passphrase away from telepahic interception

Assuming that someone is able to intercept telepathically thoughts and words in my mind, what mechanism will allow me to authenticate securely? A solution that does not yield to physical search or ...
-2
votes
0answers
5 views

What is the use of TCPoptimizer?

So,I have Windows 10. I switched off update option,so my bandwidth will not used by Microsoft by default. Then I made some changes and used TCP optimizer. SO which is more effective? switching off ...
0
votes
0answers
4 views

Knowledge base solution access

Presently working on a knowledge-based solution platform which I want to be accessed both online /offline via data and sms by searching keywords.... Please I need help with regards to the offline(sms) ...
0
votes
0answers
4 views

Who and where X-Forwarded-For header in user's request is added? [migrated]

X-Forwarded-For is a HTTP header which is used to identify the IP Address of originating user. I was wondering "where" this header is added in the request and "who" actually adds it? Is it your ...
0
votes
1answer
10 views

how to debug for DNS changing Maleware on (linux/android)?

So by opening an application/browser on my Android device, I found that it pops open a set of ads. I channeled a proxy through my laptop trying to track the first web site it connects to. Later I ...
-2
votes
0answers
14 views

Dictionary File Generator for download

I have seen in many different sites people searching by a good dictionary file or a good generator, I myself did that last week and didn't find good alternatives, so decided to code my own generator ...
-2
votes
0answers
14 views

Am I being spied on?

[chrome.exe] TCP 192.168.0.2:53959 ord30s21-in-f2:http TIME_WAIT TCP 192.168.0.2:53960 ord30s21-in-f2:http TIME_WAIT TCP 192.168.0.2:53962 www:http ...
0
votes
0answers
19 views

Why is it so hard to make longer hashes?

I was reading this answer about why there is no such thing as a SHA-1024 hash: SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), ...
0
votes
0answers
6 views

Can a third party passively read transmissions if WEP / WPA / WPA2 key is known?

If I connect to a WiFi network sporting either WEP, WPA or WPA2 encryption, can someone other decipher my communication he passively received if he knows the network's passphrase?
0
votes
0answers
16 views

Error based injection in Insert query

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds to ...
0
votes
0answers
5 views

How to create alerts for Watchgurd firewall in SIEM

I'm working in a SOC (Security Operation Center) where we use a WatchGuard firewall in our customer's environment. We currently create alerts for other devices (SonicWall,Cisco ASA) based on event ...
0
votes
1answer
15 views

Metasploit INFILENAME

I am learning *MSF on Kali but I ran into a problem. I am trying a simple adobe_pdf_embedded_exe and when I set INFILENAME to something simple such as nutrition.pdf it cannot find the file, so ...
0
votes
0answers
5 views

Why is my 3rd gen X1 Carbon not showing the “ThinkPad” logo when Secure Boot is disabled?

When I disabled Secure Boot, it still showed the "Lenovo" logo, not the "ThinkPad" one (the one it normally boots up in out of the box) Could BIOS malware have caused this?
2
votes
0answers
18 views

How does a website know my location? Checked with ipleaks and VPN seems to work correctly

Recently I have been using a VPN to watch a free web series available only in the US -- on a website called https://go90.com. Until a few days ago everything was running smoothly with just Hola VPN. ...
1
vote
0answers
12 views

Which clients support only TLSv1.1 but not TLSv1.2? [on hold]

I phrased the question originally as Is there any point in supporting TLSv1.1 on the server side? The recommended current setup if you don't have full control over your clients is to support TLSv1.0, ...
1
vote
1answer
3 views

Why doesn't the number of bytes required by GnuPG generating the key decrease?

I ran a gpg --gen-key on a remote machine connected with SSH and left it to do its job. It finished successfully, however during the execution time it asked to perform random actions to collect more ...
0
votes
3answers
79 views

How a professional hacker would penetrate a computer in a network?

Which kinds of vulnerabilities or security holes a hacker would use to penetrate and take over a computer in a network, like a normal PC in a default network (Wireless-LAN). I often hear that the ...
1
vote
1answer
10 views

How secure is it to use ODBC Driver with SSL

When Connecting from clients (such as Windows) to remote databases such as (MS-SQL Server), it is usually advised that this connection be via a service that runs on the database server. It is ...
12
votes
3answers
677 views

How can html5 geolocalisation bypass my vpn?

About two month ago I've decided to use a vpn all the time (it's launched at startup) for various reasons, privacy being the first one. But recently I realized that if you agree to share your location ...
-2
votes
0answers
23 views

Suspicious addresses from netstat -b under chrome.exe [on hold]

[chrome.exe] TCP 192.168.0.2:54827 69.172.216.55:https TIME_WAIT TCP 192.168.0.2:54828 69.172.216.55:https TIME_WAIT TCP 192.168.0.2:54829 69.172.216.55:https ...
0
votes
1answer
62 views

Is a rootkit not an exploit?

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
0
votes
1answer
26 views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
0
votes
1answer
47 views

Do I have the private keys to CAs installed on my browser?

Could someone please help explain the following comment from Why was the private key of the Superfish certificate so easily extractable? The main issue with private key extraction is the use of ...
3
votes
2answers
50 views

How to trust root CA

When I download a browser such as Mozilla, it comes bundled with several root Certificates. How do I trust that these certificates are legitimate? How do I know that my download does not contain ...
0
votes
2answers
17 views

Integrity of downloaded Oracle JDK (/software in general)

Found something related Why aren't application downloads routinely done over HTTPS? This is a question about general security from a noob. I couldn't find anything relevant about this topic via ...
0
votes
1answer
17 views

Does wireless card need to be on same channel as AP to sniff beacon frames?

OBJECTIVE Essentially, my goal is to emulate something like airodump-ng wlan0 Here is a link just in case ... airodump-ng Collects raw 802.11 frames Displays nearby access points and data ...
-7
votes
2answers
27 views

Can someone Hack my phone personal data using my IP address? [on hold]

There is "My wifi router" Installed in one of my office PC's. I once connected my nokia lumia 925 to it. That software "my wifi router" Shows our IP when we get connected. Is there any possibility ...
-3
votes
1answer
45 views

Are PDF zero-days still being widely used? [on hold]

Even after all those patches for PDF programs, would you estimate that there are still many zero-days out there? If so, would you estimate that these zero-days are being widely used for various ...
0
votes
0answers
43 views

What is the Linux Kernel attack surface? [on hold]

What is the full Linux Kernel attack surface ? meaning what are the vectors through which untrusted or unprivileged access interacts with the Kernel. For instance, system calls are an attack vector, /...
0
votes
0answers
21 views

rdp connection with netcat pivoting

I want to connection from local computer to another local computer. I have 3 machine. for example A: 192.168.1.50 -> in local windows machine B: 50.3.52.110 -> linux server C: 192.168.5.25 -&...
0
votes
1answer
32 views

Windows Firewall: Restricted RDP to 1 IP, but still see login attempts from other IPs

I restricted the Firewall rules for RDP incoming restricting the Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. I did not ...
0
votes
1answer
39 views

Hiding my activity from mobile service provider

Ok there is mobile service provider which also happens to be providing mobile internet. Now, I am interested to hide my activity from that provider. e.g. it can't see my browsing habbit. Basically ...
3
votes
3answers
26 views

How does the same origin policy apply to two different windows of a browser?

One particular scenario I am interested in: If I a open one chrome browser window with --disable-web-security option, then SOP is disabled. Will this window be able to access data on websites opened ...
1
vote
0answers
14 views

Are GeoTrust SHA-256 intermediate chain and cross-root legacy support, mutually exclusive?

I have purchased a GeoTrust TrueBusiness ID SHA-256 with EV SSL Certificate. According to GeoTrust website, I must also install the corresponding intermediate certificate, which is "GeoTrust EV SSL ...
-1
votes
1answer
24 views

In what order are digital certificates verified?

I understand how digital signatures work and how they are verified, but in what order does the CA verify each of the attributes of the digital certificate such as version, issuer, validity etc..? Any ...
-3
votes
0answers
50 views

Internet stopped working while a stranger was standing at my front door [on hold]

I had a stranger ring my doorbell while I was in the shower (my kids were home and told me about it). While he was standing there, my music stopped playing on pandora (on my phone) and my phone made a ...
0
votes
0answers
18 views

SSL Certificate for Web API [duplicate]

I'm currently developping a web html/2 API for my mobile application, and I would need an SSL certificate for my application, Is it safe if i use a self-signed SSL certificate rather than a trusted ...
0
votes
0answers
17 views

Client secret verification vs redirect URL verification - is one more secure than the other is? [on hold]

Is client secret verification (code flow) considered more secure that redirection URI verification (implicit flow)? Why? It seems to me that they are equivalently secure. https://tools.ietf.org/...
0
votes
0answers
13 views

PHP: decrypting a file directly to a stream using the defuse/PHP_encryption library

I have for a while been using the excellent Defuse PHP Encryption library for storing encrypted data strings in a database. I have an extension of this need where I now have files that need to be ...
9
votes
3answers
1k views

Would a (password + combination of images) be stronger for user's login regarding keyloggers?

The scenario: We have a login system for a web application that requires a plaintext password and 3 images (from a collection of images that the users select during registration, the images are ...

15 30 50 per page