0
votes
0answers
2 views

Is there an alternative AES schedule?

I'm currently reversing an AES implementation for disk encryption. The odd thing I'm stumbled about is a key schedule where the encryption round keys are not the same as the decryption round keys (in ...
-1
votes
1answer
30 views

Can you still be tracked when using a VPN?

If I am using a VPN on twitter, can an organisation like Anonymous or Lulzec track me and find out my identity?
1
vote
1answer
32 views

Risk when attacker has only physical access to a computer's USB port

Attacker has only access to USB port and can either attach a device or pen-drive to a computer, that can be on or off. Imagine a scenario where non-reliable people have access to offices, either ...
-2
votes
0answers
24 views

Anonymity on Facebook. Most of the answers are at least partially incorrect [on hold]

I cannot see how I have gotten some people on a "People You May Know" result since I identified someone I know that I never emailed, nor have any similar interests with at all -I did not even list my ...
0
votes
0answers
11 views

Error 207: ERR_CERT_INVALID

I'm trying to make it so people can create a private key via the browser via the element and then after have it so that an X.509 cert is sent to them that's then installed into the browser. But I ...
-3
votes
1answer
17 views

Which is less complex web or network pen-testing? [on hold]

I know both network and web pen-testing but wanted to know people think is less complex. I would really appreciate your answers and looking forward for it. From my prospective i think network is more ...
0
votes
1answer
53 views

Cryptolocker virus removal

I am facing cryptolocker virus problem, I have tried decryptcryptolocker website but it did not work. In the below link you will find an example encrypted file in my pc. ...
-1
votes
0answers
17 views

MD5/SHA1 error with long filename strings containing spaces (w/ File Checksum Integrity Verifier) [migrated]

I'm learning about MD5 and SHA1 verification. Using WIN7 cmd prompt, ran fciv -md5 on a file with a name containing multiple spaces. Used the name shown with dir cmd, but resulted in error msg. Error ...
0
votes
2answers
76 views

typical request, what type of encryption is this? [on hold]

so our company's CTO quit, and i replaced him and we need to change the system's passwords, however some passwords are encrypted in our database and i need to know what encryption to use in order to ...
1
vote
2answers
52 views

is it sufficient to convert '(single-quote) to ` ' `

Is it sufficient to convert ' to &#039; , > converted to &gt; and < converted to &lt; to avoid xss A bit of context: the payload would be going through the URL and landing in a ...
2
votes
2answers
58 views

Why Google Chrome complains about mozilla.org identity?

On a "brand new" (but fully updated) Windows XP installation (an Asus EeePC that I restored to factory setting and than updated with all Microsoft's upgrades) I installed a few days ago Google Chrome. ...
1
vote
1answer
13 views

Will changing the 'Action' for Heartbleed signatures in PAN from 'alert' to 'drop' have any production impact in my organization?

I have been seeing some Heart-bleed PAN alerts. I want to set the default action from 'alert' to 'drop'. But I am not sure if this would block some legitimate packets. Since there are a vast number ...
0
votes
0answers
11 views

Authorization using shibboleth sso

We have integrated shibboleth web sso into our application to authenticate the user, Now we want to do authorization for our application. The below is the process which is i am thinking for authz. ...
17
votes
6answers
1k views

How do you explain to experts that a Database Server should not reside in the DMZ?

Our security experts, DBAs, network team and infrastructure team are all saying it's ok to have the DB server located in the DMZ along with the HTTP server and middle-ware server. Their reason: ...
5
votes
1answer
50 views

Can a caller “Hijack” your SIM information?

We have all heard them, rumors about people randomly calling you on your Mobile Phone number, and asking you to confirm something by typing in a specific combination onto your dial pad (the rumor I'm ...
0
votes
1answer
22 views

SSL/TLS Session Resumption with Session Tickets

We already have SSL session resumption enabled using a session cache. Based on an in-house performance report, enabling Session Resumption using Session Tickets is recommended. Is the performance ...
-2
votes
0answers
12 views

WebGoat Access Control Flaws help

I am using Web Security Dojo 2.1 and I am trying to complete an exercise in WebGoat, but it isn't working out the way it did in the video. The objective is to use the Tamper Data add-on with the ...
0
votes
1answer
37 views

Security concerns on API

I just encountered API which I find pretty vulnerable. Could you clarify if my concerns are wrong? 1)For retrieving user data, API KEY, which is unique for every user i used. This api key is stored ...
18
votes
4answers
851 views

Password Storage - Self Encryption vs Hashing?

Self Encryption: Encrypting a password using the password itself (as a symmetric key). Basically, by doing this, I'll get random data as an output. Now, in order to retrieve the password from this ...
0
votes
1answer
28 views

How to protect publicly placed NFC tags?

Recently, the appearance of public NFC tags are growing in major populated areas. The company I am currently working along side with wants to increase their advertisements with a NFC tag placed on the ...
0
votes
1answer
39 views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...
2
votes
1answer
80 views

Transmitting Credit Card Information

I want to know how secure it is to transmit Credit Card details as plain text to the payment gateway from my website using HTTPS. We are not storing any details in our database but I read that ...
0
votes
1answer
31 views

Is there a security difference between remote desktop or VPN?

Is there any difference in security between browsing the internet on a remote desktop and using a VPN to browse the internet on a local machine? In this case assume both use the same encryption ...
-7
votes
0answers
31 views

How do they usually do to discover security issue [on hold]

I just wonder how they usually do to discover the security issue? I have heard of fuzzing tool like american-fuzzy-lop developed by Michal Zalewski is one of tool which will can be used to detect ...
3
votes
4answers
1k views

Is this PHP code XSS proof?

Is the following PHP code XSS proof? <?php $site = $_GET["url"]; echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), ...
2
votes
2answers
29 views

W3af and automated vulnerability scanners vs manual testing

How effective are tools such as w3af in looking for web app vulnerabilities compared to looking for vulnerabilities manually? Are they able to find all vulnerabilities from OWASP top 10 such as ...
0
votes
0answers
28 views

Ensuring security of web based games and contests

I have previously analysed an online contest and found that it was trivial to reverse engineer the handshake process since it was all done in javascript. As a result, it was possible to code an ...
0
votes
0answers
42 views

SSL certificate expired on laptop what does that mean? [on hold]

SSL certificate says it is expired on my laptop. What are the implications.
1
vote
1answer
34 views

how to find a cryptography scheme (either authentication or encryption) for which some formal analysis of security has not been done yet

I have a project in Cryptography where I have to discuss the provable security of any proposed scheme (encryption or authentication) which has not been discussed yet. Any pointers on how and where to ...
0
votes
1answer
19 views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...
2
votes
4answers
58 views

Does Tor browser work with college network? [on hold]

I'm in a system where my modem connects to a college network (KotNet) that monitors its internet traffic. Since I'd like some privacy I was wondering if a Tor browser would hide my identity or if it ...
-1
votes
0answers
12 views

OSFClone and its quality [on hold]

Nowhere in the forums do I detect that you have written about OSFClone. I am interested in your experience with this program, and how well it clones disks. I intend to use in the following programs ...
1
vote
1answer
45 views

What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning?

Alice navigates to https://example.com. https://example.com delivers an invalid certificate. https://example.com 302 redirects to https://www.example.com https://www.example.com delivers a valid ...
1
vote
0answers
37 views

Test if an email address is spammer's

How can I test if an email address is a spammer's? I received a reply to my Craigslist post, with a gmail address in the email body. Craigslist uses some way to hide my email addresses, if I choose ...
0
votes
1answer
34 views

How much security would I lose if I enabled “easy enter” pins on an android device?

There is an option on android devices to unlock when the correct pin/password is entered, but without the user explicitly pressing the "done" or "enter" button. How much security does this remove from ...
1
vote
1answer
41 views

How zip symlink works?

I've seen lately some bugs that used zip symlink technique , can anyone explain how this vulnerability works , how attackers use it to exploit applications? Thanks
1
vote
1answer
45 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
-1
votes
1answer
18 views

is it secure to use proxychains+tor while logged in as root

when using proxychains+tor in kali,you should be logged in as root because proxychanis doesnt work when you are not logged in as root but using tor while logged in as root is not secure so what is ...
2
votes
3answers
116 views

Can a form submission be encrypted even though address bar shows HTTP?

I was going to apply for a Student ID card through ISIC, but noticed that the form where they ask for payment (such as credit card number) details is not available through HTTPS. The URL to their ...
0
votes
1answer
55 views

Mixed content - stylesheet being blocked because of a querystring parameter?

I've just run into a scenario where a stylesheet was being blocked on a secure payment page. The stylesheet was loaded like so: <link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" ...
1
vote
1answer
42 views

Why does firefox still display website ssl to be 128 bit encrypted after changing to 256

I recently renewed an ssl certificate to use SHA-2 but on firefox the website still shows to be SHA-1 and 128 bit encrypted, on all other browsers it show SHA-2 , 256 bit. Can anybody help me with ...
0
votes
1answer
24 views

Is there a way to securely lockdown a website to an Iphone?

So with a typical website, perhaps the fastest and most effective (arguably) way to secure the site is to add a simple .htaccess and restrict by ip addresses: .htaccess DENY from ALL ALLOW from ...
2
votes
4answers
166 views

How is security of server's RSA private key is ensured?

We repeatedly hear news of hacking of passwords from PW database (server side) but nothing about hacking of server's RSA private key (not asking regarding finding p and q for a given public modulus ...
1
vote
1answer
50 views

Email sent to people with my name in the from section, but not my email address

I have had a couple emails sent to people who have sent me an email in the past (in my inbox, but who are not necessarily on my contact list). They have my full name in the from section, and in the ...
1
vote
0answers
31 views

Understanding Java Security Providers

I'm hoping to use the below issue we came across recently to better understand Java's security providers, ciphers and encryption in general. We got the following error during an SSL Handshake (using ...
0
votes
2answers
53 views

Lock And Unlock Files Using USB Key

I am looking for a way to make a set of files only able to be read when a USB key is plugged into the system. For example, if I have FILE A on my C drive and I try to open it, it will say something ...
12
votes
6answers
1k views

Is XSS a server-side or client-side vulnerability?

My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?
1
vote
1answer
93 views

Evil PHP code I need help analyzing

I found on my server something like this at the beginning of my php files: <?php ...
3
votes
2answers
155 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
0
votes
1answer
18 views

Is thread's auto-login from email implementation secure/good user experience?

As far as I can tell thread.com log their users in automatically based on a token in their emails, appended to the URL. e.g https://www.thread.com/1234logmeintomyaccount-forexample This is a really ...

15 30 50 per page