0
votes
0answers
3 views

which browser render \ to /?

I wanted to confirm one issue. What are the browser which render \ to /. So i mean if the application is filtrating / and " then is it possible to trigger XSS? For example: <script> var a = ...
1
vote
0answers
5 views

What is the Padding used by SSL 3.0 in OpenSSL

Im Currently working to exploit POODLE, However i have encounter a problem. I want to know what is padding in my SSLv3 protocal, is there any method to get padding with a private key?
-2
votes
0answers
9 views

What are the pros and cons (from security perspective) of stateful protocols vs stateless protocols (and vice versa)?

What are the pros and cons (from security perspective) of stateful protocols vs stateless protocols (and vice versa)?
0
votes
0answers
9 views

Slow Loris Incomplete GET Request

A slow loris attack is an attack of incomplete GET requests to most famously an Apache server because the server does not timeout the connection made after extremely long periods of time, from my ...
0
votes
0answers
13 views

Windows Server Update Services (WSUS) - can I pivot to a client machine?

I'm considering setting up WSUS on a Server 2008 machine to push updates to my Windows 7 clients. If I do, I'll be following the hardening guidelines issued by MS (such as enabling SSL). One thing I ...
0
votes
0answers
9 views

View all incoming and outgoing connections on a router?

I know that you can view the connection on the computer that you are sitting at right now just by opening cmd and typing netstat. But I was wondering if you I'm able to download a program to see all ...
0
votes
0answers
14 views

VPN Log Files Windows

I have a friend who is quitting their job. He is owed overtime, but the workplace has been casual about recording hours. He regularly signs out a work laptop, and will work from home via VPN. Is ...
6
votes
1answer
141 views

Do Chrome and Firefox send random values rather than the actual timestamp in ClientHello of TLS?

I'm doing some analysis of TLS in different browsers (using Safari, Chrome, and Firefox) and have noticed that while Safari sends the correct unix timestamp, Chrome and Firefox send random values each ...
1
vote
1answer
25 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
0
votes
1answer
43 views

Can I trace a spoofed text message?

Someone is texting me threats and I have no idea who. Is there a way to "unspoof" the number? I know for a fact that they are spoofing as a legit number, because I called it. Thanks in advance.
8
votes
2answers
353 views

Password hashes history to prevent user to keep same passwords again and again

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
0
votes
0answers
31 views

Virus changed folder to executable [migrated]

I loaned my flash drive to someone who used said drive on a Windows machine infected with a virus. My flash drive subsequently got infected with a virus that changes folders to executables. Research ...
-5
votes
0answers
25 views

How to become an exploit developer from scratch! [on hold]

Please I really need help on this topic... The thing is I don't just wana use tools, I just don't wana read compiled tutorial on how to use tool, I wana be a full-fledged exploit developer. So My ...
4
votes
1answer
35 views

How to prevent Fingerprinting via Font Enumeration

I don't mean using Noscript or just not installing fonts, I'm trying to find a way of outright denying Flash, Java, and JavaScript the ability to look at my fonts. I've checked the fonts folder and it ...
-2
votes
0answers
17 views

Signal strength constantly changing on Linksys WRT54G? [on hold]

Signal strength constantly changing on Linksys WRT54G???! Why is it doing this> Is this a security concern? I have been noticing weird behavior with some session handling occasionally while cloud ...
-3
votes
0answers
20 views

can you know the computer that an email came from? [duplicate]

can you know from which computer an email came from ?
1
vote
1answer
51 views

How to protect myself from keyloggers? [duplicate]

I've been hearing about keyloggers for the past two years, but never took them seriously. Now, as I've started net banking and managing social networking accounts, I'm very much concerned about ...
0
votes
0answers
31 views

Magic Bullet Application or Tool for the ITSec Pro [on hold]

I'm sure I'm not the only one out there, but at my current desk - I'm a 1 of 1. No senior security guys to learn from, and I'm not exactly entry-level but I'm "within budget". In fact, there are only ...
2
votes
1answer
33 views

Secure the config file of a service

I have a service running on a linux box, started with upstart, that runs as user "the_user", it has to read a config file. Having the file owned by root would make things more secure, but would ...
-2
votes
0answers
15 views

Event id list/documentation for juniper and stonegate devices? [on hold]

I was configuring my SIEM to generate alarm when configuration change in firewall is detected. I got the event id list for cisco devices at this link ...
0
votes
2answers
44 views

Security tips for online Debit/Credit Card Transactions? [on hold]

What security precautions should one keep while doing Online payment through Debit/Credit Cards using Web-based Browsers? Any tools that can keep online transactions safe?
3
votes
2answers
74 views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
1
vote
1answer
25 views

What protections are put in place to prevent ACH scams?

ACH (Automated Clearing House) is an electronic network for financial transactions in the United States. ACH is used by financial institutions to handle direct deposits, checks, bill payments ...
0
votes
1answer
67 views

Cannot turn off XSS filter in Chrome

I am using the following command to launch Chrome: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security to turn off XSS auditor in chrome in Windows 7, but ...
0
votes
0answers
46 views

Android: discover a backdoor

Which operations do I have to do to find out a backdoor on my android smartphone? I know that everything is recorded by log files, but I want to find out a clear way to discover unsolicited traffic ...
3
votes
1answer
221 views

Content not appear in body

I have a file a.html, which has the following content: <script> var x=document.URL.substring(document.URL.indexOf('#')+1); document.write(x); alert(document.body.innerHTML); </script> ...
0
votes
0answers
18 views

PKI - Open source or low cost solutions? [on hold]

Do someone know some PKI low cost solution ? When I say low cost, I mean solutions that are much cheaper than commercial solution like OpenTrust PKI (even if less secure solutions). Are there ...
14
votes
2answers
2k views

How to convince my management of a physical security risk?

While I do not claim to be an expert in all things security based, I'd think that I have a good grounded knowledge of what is acceptable and what is not in regards to digital security. After giving ...
3
votes
0answers
272 views

What are the vulnerabilities of this homemade encryption algorithm? [migrated]

I decided to program a relatively trivial encryption algorithm in my downtime. This algorithm takes a seed from a user (supports floating point seeds), and then adds 1 to the seed for every iteration ...
-1
votes
0answers
41 views

Are there any vulnerabilities specific to Kali Linux? [on hold]

While vulnerabilities exist for Debian and it's standard application set, my question is if there are any specific to Kali Linux and it's standard set of applications (including attack tools). For ...
-1
votes
0answers
21 views

What fields should appear in a certificate, and why? [on hold]

What fields do you think should appear in a certificate, and why?
1
vote
1answer
51 views

John the Ripper missing formats [on hold]

I have an sha256 hash that I am trying to crack with John the Ripper. However, it doesn't recognize raw-sha256, raw-md5, or any hash format other than descrypt, bsdicrypt, md5crypt, bcrypt, LM, AFS, ...
1
vote
1answer
18 views

Digital Certificate Repository Integrity

I am trying to figure out if there is an automatic way to determine if a digital certificate repository has been tampered with. Does anyone know of a way to do so?
0
votes
1answer
52 views

Why should I add a certificate to “Trusted Root Certification Authorities”?

I want to use a programm, which lets me modify touchpad gestures. http://www.multiswipe.com/faq But I need to add their certificate ( see in FAQ [ How to install MultiSwipe? ] ) to make it work. ...
3
votes
1answer
43 views

PGP key on smart card: why do I need a “secret key” on disk?

I have a YubiKey NEO on which I have the OpenPGP applet and I have a PGP key installed. I work on 3 different computers and I initialized the card on computer bob. I'm now at computer rob. Someone ...
0
votes
0answers
40 views

To who does Facebook sell your personal data [on hold]

I was wondering if there is a way to know to which company Facebook and others sell your personal data ? Is there some regulation somewhere that request data resellers to disclose their buyers, ...
0
votes
1answer
81 views

I just found many facebook entries on my registry? [on hold]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
3
votes
1answer
48 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
1
vote
1answer
147 views

Building a password recovery algorithm [on hold]

goals The password recovery procedure shouldn't significantly weaken the system's security policy. ie, Attacking this algorithm should be at least as difficult as attacking the login algorithm. ...
2
votes
1answer
49 views

Non-profit on limited budgets looking for safety with VPN/TOR etc [on hold]

First off, thank you ahead of time for your patience. We are a small non-profit with a 100% volunteer staff. We deal with children and some adults that suffer from Mitochondrial disease. So, I was ...
0
votes
0answers
30 views

Determine OS of the target using Greenbone Security Assistant [on hold]

I am running a scan in a specific target of the network with IP 192.168.1.51. As I am newbie in this field, I would like to ask you if or how can I figure out the operating system of the target? I ...
2
votes
1answer
46 views

Mitigating DDOS in P2P systems

In P2P systems where performance and response times are critical individual clients are susceptible to DDOS by publicly exposing their IPs. While there are various mitigation solutions available at ...
2
votes
2answers
23 views

Classifying Reflected and DOM-based XSS

Having referenced Difference between DOM & Reflected XSS , I observed that certain attacks could be both DOM-based and Reflected XSS. I wish to find out if my understand is accurate, or they ...
0
votes
1answer
35 views

What kind of security requirements are necessary to store/display SSN in a web app? [on hold]

I'm investigating a project that would be in the medical industry, essentially it would be a web application used by doctors offices only. In this application they can enter patient data and search ...
0
votes
1answer
29 views

UDP Traffic is blocked [on hold]

The firewall is blocking all UDP traffic i guess. All the udp supported apps are not working like torrents and certain games. I checked the open ports , port 443 is open. Any way to bypass this ...
0
votes
0answers
38 views

how can I apply the attack deauth a particular device out of my wireless network [on hold]

I have to make a python script that allows me to get a particular device of my wifi network if I specify the mac of this victim. I do not know how I can start or how the deauth attack victim can ...
-1
votes
2answers
49 views

FTPS vs SFTP on Windows server 2008 R2 [on hold]

I want to ask you guys. I'm an administrator of Windows Server 2008 R2.. We are using FTP for now.. But I think about our security, and maybe it's time to secure our file transfer. So I looked for ...
0
votes
0answers
36 views

Is it possible to re-install an operating system over an encrypted system? [migrated]

Scenario: I buy old PC/laptops, fix it and then resell them. I recently got a laptop at an auction with the whole system password encrypted McAfee Endpoint Encryption. Windows does not even load. I ...
-1
votes
1answer
118 views

What lasts 21 seconds at Google ? Pattern analysis

I'm kinda new in IT security and i'm analyzing some flows. The only informations i have are : *ip dst *timestamp *port dst *numbers of sources and flows. I noticed some suspicious flows coming from ...
1
vote
1answer
32 views

How Fast Flux technique works exactly?

I was reading about botnets and C&C servers and saw this term. I've read this Wikipedia article but I couldn't really understand what and how this is working. I think its some kind of proxy ...

15 30 50 per page