0
votes
0answers
3 views

Decypher Malicious Payload

I've received some SPAM e-mail that led to a JS file which I assume is malicious. My curiosity got the best of me so I opened the file in notepad and I'm trying to make sense of the code but I cannot ...
0
votes
1answer
11 views

Encrypt data on mobile device by retrieving keys from server using PIN

I need to securely encrypt persistent data on a mobile device, hiding it from hacking tools. What vulnerabilities are there in this method? Encryption: user sets 4 digit PIN to "protect" data on ...
-1
votes
1answer
24 views

How to avoid WiFi attackers

I am connecting to a WiFi network, but the signal strength is too weak and sometimes it disconnects automatically. My brother's WiFi signal is very good and the connection is fast, and he just happens ...
0
votes
1answer
17 views

Qubes OS more secure than any VM options in Windows?

I'd like to skip the argument about Linux being more secure than windows, and purely focus on the security boundaries between Host OS and VM's. Is Qubes OS theoretically more secure than say - ...
4
votes
2answers
19 views

Implications of leaving admin UI accessible to non-admin users

I am developing a system to be used internally within a company, but possibly also externally at some point in the future. From the standpoint of the system's initial users - staff, the program is ...
0
votes
0answers
19 views

Why can i login in my Facebook account with an email not the main one?

My Facebook account was registered with an Hotmail e-mail. My secondary e-mail is an ISP e-mail. Since i remember i never had other secundary e-mail added. However today, in my laptop, i ...
-6
votes
2answers
18 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...
0
votes
2answers
21 views

How would I brute-force a Bitlocker recovery key?

I have imaged a hard disk and used passware, but to no avail - it says Encryption key External key, and not the actual key. How do you think I would go about brute forcing it? Lets assume I had ...
5
votes
0answers
13 views

List of visually similar characters, for detecting spoofing and social engineering attacks

I'm trying to detect homograph attacks and other attacks where an attacker uses a spoof domain name that looks visually similar to a trusted domain name (e.g., bankofthevvest.com instead of ...
1
vote
3answers
17 views

Building an info sec VM lab - safe to keep on my home network?

I'm a new member making my first post here. I had a very quick, and admittedly basic, question. I'm setting up an info sec lab for the first time at home. I'm trying to build some more technical ...
0
votes
1answer
15 views

Scan detection Tool better than Snort Portscan Preprocessor

Background I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor,to detect ...
1
vote
0answers
18 views

Laptop Encryption variables

If you are running such an operating system as Ubuntu among others, you would of seen that it gives you the polite option to encrypt your Home directory OR Whole hard drive with a robust AES 256bit ...
0
votes
0answers
26 views

HOSTINGER users, BE AWARE!

i know it maybe a bit different subject, but as i work for security issues, recently, i have found HIGH critical security issue over whole HOSTINGER company, and have notified them immediately. the ...
3
votes
2answers
308 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
-1
votes
0answers
9 views

Secure masking of properties

I am writing a logging framework and want to be able to mask certain information, for example: passwords. Ideally, I would like to preserve whether two passwords are the same, even though I don't ...
1
vote
0answers
29 views

Can you prove that the OS loaded by your BIOS is really your OS?

Assume you are a paranoic that have a 100% open source OS with drivers etc, but you don't have an alternative to your closed source BIOS. How can you sure the BIOS didn't insert malicious code in e.g ...
-2
votes
3answers
38 views

Can Google's employee or Microsoft employee see the files in the cloud?

I want to know if someone working at these companies has access to the files people upload to the cloud. In other words, do these companies encrypt the files in the cloud?
6
votes
5answers
1k views

Facebook tricked me into downloading an obfuscated script

I got a notification on Facebook: "(a friend of mine) mentioned you in a comment". However, when I clicked it, Firefox tried to download the following file: comment_24016875.jse This is an ...
0
votes
2answers
29 views

OSCP(Offensive Security's PWK) Requirements - Specific questions =)

I wanted to ask a few questions, mainly referred to those who completed OSCP/ know about it. I want to take the course, I know that understanding of TCP/IP, IP subnetting and addressing and routing ...
-4
votes
2answers
37 views

Find admin login of webpages

I'm not able to find admin login page while pentest. How to find admin login of webpages? http://example.com/admin, http://example.com/wp-admin returns 403 forbidden or 404 errors. What to do in ...
1
vote
0answers
4 views

GEA3 direction clarification

GEA3 (and 4) stands for GPRS Encryption Algorithm. It's specified in 3GPP TS 55.216 (at least used to, until some idiot forced them to hide it because of "export restrictions" or some crap like that). ...
0
votes
1answer
26 views

How to propely secure a webapplication in development

A little context: I'm developing a webapplication working with PHP, SQL DB and other technologies. I'm looking for a partner to join me in the adventure I believe really well in this idea that I'm ...
0
votes
1answer
18 views

What does it mean when airodump-ng shows 0 beacons?

I have one particular AP that shows 0 Beacons in airodump. I can see the beacons in all the other AP without a problem. So is it even possible for AP to not send beacon frames?
-1
votes
0answers
54 views

Why does Mark Zuckerberg cover his headphone jack with tape?

I can understand covering the camera or microphone but why the audio jack? Mark Zuckerberg have shared a photo to his Facebook account and celebrating the growing user base of Instagram which is ...
0
votes
1answer
31 views

Which of AES modes are safer and faster for transferring data over the network?

I have using Crypto++ in Qt and use of AES Algorithm for encrypting files. I know about AES modes and their applications. I have use of StreamTransformation method for encrypting files in CBC and EAX ...
0
votes
0answers
7 views

Right mechanism & workflow for repeated replication of passwords from LastPass to KeePass?

A lot of us currently use LastPass for the easy management, access and input of passwords for applications and websites. Now, there are some people who are obsessive about not leaving it out to a ...
0
votes
0answers
6 views

Where partially homomorphic encryption schemes like BGN are used?

Schemes like Boneh, Goh, and Nissim are interesting, because of support of polynomially many additions and one multiplication. The algorithms are indeed simple https://eprint.iacr.org/2010/182.pdf ...
-1
votes
1answer
22 views

Are B. Schneier's passwordsafe and passwordsafe.de related?

Is the (commercial) product at https://www.passwordsafe.de/ in any way related to Bruce Schneier's passwordsafe ? Same Algorithm ? Compatible file-formats? Or do they only share the name? I did some ...
0
votes
0answers
8 views

Going from an EC Private Key to Decrypting Traffic

At the moment I have an EC private key in my possession and also some traffic that was encrypted using the aforementioned private key. I have been trying to use OpenSSL to turn the private key into ...
0
votes
0answers
15 views

Identify malicous hosts in our network by sending valid domain credentials

We are currently whitelisting the hosts owned by our company on our Cisco switches to prevent private hosts in our network. This works pretty well but someone can still spoof the MAC address of his ...
0
votes
2answers
45 views

How am I being scammed?

I have received an email, claiming to be from Microsoft. Here is a snapshot of it: Google marked this email as spam with the following notice: These are some header details: Now, the text of ...
-1
votes
4answers
59 views

Can duct tape prevent hackers from watching me?

Since hackers can hack into my mobile phone/computer and use its camera to watch over me, Q1: Can I know if my mobile phone/computer camera has been hacked? Q2: If I was hacked, does putting duct ...
1
vote
1answer
32 views

Why aren't there FIPS level 4 devices on the market?

While searching for a secure USB to use, I came across the Aegis secure key, which has FIPS Level 3 (140-2) security. I believe that it's the securest flash drive on the market. I found that the ...
1
vote
1answer
25 views

How to verify personal information (identity)?

I've been trying to find this information but all I can find are answers saying to use a credit card for verification, not real answers. I am trying to figure out how/where companies get information ...
2
votes
0answers
7 views

Is it better to have a secure channel or secure PIN entry for Smartcards?

Assume I do own a computer, a USB-connected keyboard and a USB-connected contact-based (trusted) chipcard reader with a hardware pinpad. There are now two types of smartcards relevant to this ...
0
votes
1answer
40 views

How to check how I was hacked? [duplicate]

Today I was notified by DigitalOcean that my droplet was hacked and a DDOS attack was generated from it. It was a droplet I used as a staging server for a webapp I will send to production later, and I ...
0
votes
1answer
19 views

Firefox refuses to use X509 certificate, complaining “Cound not verify this certificate for unknown reasons”

I stumbled upon this question and answer. I have the same problem as the OP, and am sorry to report that the proposed answer does not resolve it. Certificate in question has been verified by OpenSSL-1....
-1
votes
1answer
23 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
1
vote
1answer
21 views

Dealing with a misconfigured corporate SSL certificate

I work at an organization that inspects all HTTPS traffic by injecting its own SSL certificates. It wasn't configured properly though, so Firefox always shows a "Your connection is not secure" error ...
0
votes
0answers
9 views

How do I perform output encoding on text boxes having limited sizes? [on hold]

How do I apply output encoding for a text box which only allows a limited size? I cannot perform input validation for that text box because it expects '<' and '>' symbols. While I was trying to ...
-1
votes
4answers
48 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
0
votes
1answer
17 views

How robust is a VeraCrypt Container against disk errors?

I am planning to encrypt backup data using VeraCrypt. How safe are the generated containers? My worries is not so much the encryption, but potential data loss due to degrading harddisk media over time....
7
votes
2answers
387 views

What's the advantage of sending an RST packet after getting a response in a SYN scan?

I'm reading about nmap's SYN scan, and it says Nmap sends an RST immediately after the server tries to establish the handshake. My question is - why bother with the RST? Is it to prevent the server ...
1
vote
0answers
24 views

Allow users to download files from outside of webroot [migrated]

I've got a folder where I'm storing a bunch of confidential documents and I authenticate the user when they log in, but I only want them to be able to download a specific file. How can I retrieve ...
1
vote
1answer
27 views

Hops encountered More for spam Mails than Legitimate Mails

Background I am working with email headers for spam detection. Each E-Mail header contains many "Received:" headers fields. Each "Received:" header is added by an intermediate Smtp/Mail server in the ...

15 30 50 per page