1
vote
0answers
6 views

How to make the most secure text editor in Django?

As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app? I'm not asking ...
0
votes
0answers
5 views

Is is possible to configure IE to automatically run an EXE? [migrated]

I have a Cuckoo sandbox. When it's pointed to the URL of an EXE, a IE security dialog comes up, and asks weather to run, save, or cancel the download. Cuckoo clicks cancel because it is the button ...
0
votes
1answer
24 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: ...
-4
votes
0answers
26 views

What infrastructure is there to attack in Lynnwood, WA? [on hold]

I've been watching this live attack site for some hours, and find it strange that Lynnwood is getting massive attention from (mostly) Chinese attacks. What's there to attack? Yes, it's in Washington, ...
-1
votes
0answers
33 views

Siri DDoS over FM Radio

A few days ago i was driving home and suddenly Siri started to talk by her self in reply to a command i never gave... as you can imagine i have the "hey siri..." feature active, so i can make calls ...
0
votes
0answers
6 views

qkd - Does BB84 rely on a prearranged code? [migrated]

First of all, sorry if the title is not that clear, I'll provide an in-depth explanation behind my question. So, basically I was reading about quantum cryptography and came across BB84. The protocol ...
0
votes
0answers
20 views

Does the server certificate control the cipher suites available to secure the communications?

If a CA signs a certificate with a SHA1 signature hash algorithm, does that mean a client would be unable to communicate with the server if TLS 1.0 and below is disabled? I think what I'm asking is ...
0
votes
2answers
294 views

What current algorithms are considered (un)secure?

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...
1
vote
0answers
17 views

msfvenom doesn’t generate raw shellcode output properly

I'm doing the Windows Buffer Overflow Exploitation section of the OSCP course, and the author uses a combination of msfpayload and msfencode to generate a windows/shell_reverse_tcp payload encoded ...
3
votes
1answer
42 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
0
votes
0answers
3 views

Firewall Throughputs [migrated]

I am looking at purchasing a new UTM/Firewall device for the sole purpose of bandwidth control/utilization and guest modes. I have the following terms that are troubling and I would like someone to ...
1
vote
1answer
28 views

EMET disable DEP on IE for specific site

I'm a new user of EMET. I wanted to know if there is anyway to avoid DEP on IE for a specific site. I want to do this because I use VMware remote server and when I start a remote console, EMET starts ...
0
votes
0answers
27 views

Vecracrypt Outer Layer shows incorrect free space thus giving away the hidden layer? [on hold]

I just tried the veracrypt hidden volume for fun today, I was interested in how it works. I used the encryption on an old 2TB HDD, copied some files on the outer layer and then mounted both volumes. ...
-3
votes
0answers
11 views

/bin/bash is gone? [migrated]

I typed the following command, and now bash isn't working. $ sudo chmod a-x /bin/bash_old /bin/sh_old It just says: login: /bin/bash: No such file or directory.
-3
votes
1answer
54 views

Google News, unencrypted by default- unless logged in? [on hold]

http://news.google.com Of course, if you are logged into a Google account, it is encrypted. Otherwise, unencrypted by default.. Even when visiting Google News via a Google search result page ...
1
vote
1answer
57 views

How can storing a userId as client-side-sessions be safe?

The documentation for session handling in ninjaFramework states: [...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. ...
13
votes
5answers
1k views

Is sha1sum still secure?

We use sha1sum to calculate SHA-1 hash value of our packages. The SHA-1 cryptographic hash algorithm has been replaced by SHA-2 by all browsers (certificate signatures) since SHA-1 is known to be ...
1
vote
1answer
38 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
0
votes
0answers
14 views

Disguising as another computer using SMB Relay?

I've got a server that constantly checks for the existence of certain parameters on every PC in the web using SMB, if it fails to find those parameters it marks it as a rogue PC. I've understood that ...
5
votes
1answer
39 views

(proper) way to inform TLS server to drop TLS session with clientAuth

Is there a way for a TLS client to inform the server that it doesn't intend to resume its authenticated session(s) anymore? Example: A client established authenticated session with the server ...
0
votes
1answer
34 views

Scope for information security in 2yrs down the lane? [on hold]

I'm a fresher. Very recently I started doing Java course because of the wide opportunities we get to enter into an IT industry. Now, I've got an opportunity to work for a project that's related to ...
1
vote
3answers
376 views

Securing REST API with HMAC and basic auth

I was wondering if giving users choice of a method for securing their access to API would be a good idea. Background: We are creating and deploying applications for our customers, which help them do ...
3
votes
3answers
97 views

How to spoof my IP address to JavaScript and other security concerns

Many websites require JavaScript. However, enabling JS means that a website can run a JS snippet to retrieve the user's IP address (even if they are behind a proxy or VPN). So, how can I (the user) ...
-3
votes
3answers
42 views

Reverse Engineer and Exploits researching [on hold]

Can some one give me a start point for finding exploits in software and reverse engineering? I need some kind of a book or a site... I have background with programming with high and low level such ...
0
votes
0answers
10 views

Maths for the Diffie Hellman [migrated]

With respect to the maths behind the Diffie Hellman Key exchange algorithm. Why does: (ga mod p)b mod p = gab mod p It might be fairly obvious, but what basic maths guarantees this? Why does the ...
2
votes
0answers
133 views

What is the state of cryptographic obfuscation in 2015? [migrated]

Cryptographic Obfuscation is a technique that allows one to obfuscate source code in a secure way (as opposed to insecurely mangling it into spaghetti code.) For example, here is a way to protect a ...
6
votes
2answers
55 views

Using smart cards for email encryption and SSH

Suppose I have a small organization, every user has a recent Macbook Pro, can buy a ~$25 smart card reader on Amazon, and I want to use keypairs where the private keys are on personal smartcards to do ...
2
votes
2answers
40 views

Assuring Client is Authorized to use JSON Web Token

JSON Web Tokens ( JWT ) are server-signed objects that the issuing server uses to identify a user, track session data and authorize requests. The fact that JWT are server-signed gives assurance that ...
2
votes
1answer
28 views

Public Key Pinning and subdomains

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
1
vote
0answers
19 views

SSH: Only allow known IPs [migrated]

I want to allow only a known IP address block to SSH into our servers. I have Windows Server 2012, R2, CentOS 7 and Ubuntu 12 and 14. What is the best practice for each OS to accomplish this?
5
votes
2answers
208 views

FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers

Some vendors appear to advertise their products as using "FIPS 140-2 compliant algorithms & ciphers". However, some of these products cannot be found on the NIST website that lists validated ...
4
votes
1answer
53 views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
2
votes
0answers
33 views

NX + ASLR bypass - troubles with return address of .bss

I have one problem, while doing NX + ASLR bypass. I'm going through this tutorial step-by-step. Everything is going well, I have prepared my exploit, just with another address and some small ...
1
vote
0answers
34 views

What information can be gained given only a phone number? [on hold]

What personal information can be obtained given only a phone number? What information is your phone number publicly (or privately, but with easy access) linked to? Here is the way I am looking at ...
1
vote
1answer
33 views

Problems executing shellcode via nop-sled

My shellcode instructions are changing during execution. I'm not sure why. Here is what my shellcode looks like: => 0xbffff0b3: nop 0xbffff0b4: nop 0xbffff0b5: xor eax,eax ...
2
votes
2answers
253 views

Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
-4
votes
0answers
47 views

File Deletion & Recovery [on hold]

Picture number 1 and 2 is an example, of what I need to complete for picture number 3. I attached an image to this, because I thought it would be easier then explaining it out myself. Basically, ...
0
votes
1answer
48 views

How to secure a websocket connection with challenge-response?

TL;DR Given that all of the state information for a web browser is accessible to a (potentially hostile) user, how can challenge-response authentication between the browser and the server be ...
4
votes
1answer
533 views

download file/folder anonymously on a ssh session

I rent a paid VPS hosted online and want to transform it to a sort of treasure chest where I can upload and download files privately. For this purpose I want to do this operation over the Tor network. ...
2
votes
3answers
71 views

Difference between OpenSSL and keytool

I was wondering about differences between using OpenSSl or Keytool and generating certificates by them. I think Keytool is used by Java community but for someone who is not remotely connected to Java ...
0
votes
0answers
77 views

CryptWall virus attack [on hold]

Is there something new about any solution to decrypt all my files that are infected with the CryptWall virus? All my files have extension *.abc.
1
vote
3answers
51 views

Addons in Chrome

When installing any add on in Chrome, a set of permissions is needed to be granted to the add on. Many addons(including popular ones like Pocket and Adblock) have Read and change all the data on the ...
1
vote
1answer
44 views

Antivirus monitoring activity: why do they not have an internal firewall to prevent processes' access to user's documents?

A question that arises after an updated and licensed version of Norton Internet Security has detected a trojan installed in my new laptop (Win7 installed on 26 Aug'15 and fully updated). Trojan ...
-3
votes
2answers
39 views

Data to be Logged in a Web Application [on hold]

What data should be logged in a web application? From all the perspective such as security, user access, data modification, path traveled by a user in application and anything that matters.
0
votes
0answers
16 views

How to establish previous modification dates of a file? [migrated]

I've got some files (.ini and .lnk) and would like to establish their previous modification dates. Unfortunately no shadow copies are present. Is there any way to do that? I run Windows Vista. Thanks ...
-1
votes
1answer
26 views

Integrate POS client with HSM Luna

I want to integrate and test a terminal device (PED) with HSM Luna. But I'm not able to understand steps clearly, as to what is done when a new device is integrated. Can anyone please help with this. ...
1
vote
0answers
27 views

verifying digest signed with private key using a C program

I'll explain all the steps I've done so far and conclude with my question. using OpenSSL 1.0.1e-fips 11 Feb 2013 Generating a private and public key openssl genrsa -des3 -out private.pem 2048 ...
1
vote
1answer
65 views

Purpose of client and server random numbers in SSL Handshake [duplicate]

I could not understand why in the Client hello and Server hello in SSL Handshake client needs to send to server (publicly) a random number and vice versa. From these numbers a Pre-Master secret will ...
2
votes
2answers
59 views

Is encryption application credentials using certificate encryption good practice?

I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password. The application runs in an environment ...
3
votes
2answers
109 views

End-to-End (Point-to-Point?) Email encryption

I'm looking into providing security for the email server I recently deployed, however the subject matter is a touch more complex than I anticipated and I would appreciate confirmation or correction of ...

15 30 50 per page