1
vote
0answers
96 views

problem with mdk3

I have a problem in using mdk3 on kali. I want to DOS my AP with deauthenticate packets. I use the command: Mdk3 mon0 d <AP mac address> I am sure that the command is true. It is not working ...
75
votes
2answers
12k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). ...
4
votes
1answer
153 views

Wi-Fi asks to accept (self-signed) certificate – What is it used for?

When I tried to connect to my University's Wi-Fi for the first time, it asked me to accept a (probably self-signed) certificate. Luckily they published the fingerprint so I was sure it is safe to ...
5
votes
1answer
170 views

What do malware authors using android root exploits go after?

I know there has been a lot of discussion on rooting on the internet and even on stack exchange. What I want to ask here is not how rooting works - assuming the root exploit as a black box, what ...
2
votes
0answers
39 views

Is it a good idea to use password safes such as KeePass? [duplicate]

I'm starting to use KeePass as a password manager but I was wondering if such password safes are a good way to store passwords. Could a malware dump my RAM when the safe is open and retrieve all the ...
1
vote
0answers
48 views

The process of using Metasploit to get in Systems [closed]

I am new in metasploit. I get the basic concept of exploiting a system or whatever your trying to do. You find a vulnerability in a system, you use an exploit or make one. Doing that on your local ...
3
votes
1answer
15k views

service metasploit start failed to start metasploit service [closed]

I am trying to setup Metasploit for penetration testing. However first of all I cannot get the database to connect. Also whenever I attempt to start the service using service metasploit start I get ...
4
votes
2answers
105 views

Managing the public keys and certifications of S/MIME protocol

I don’t have any experience in the security field, and I want your help. I want to ensure if the following suggestion is applicable and secure, if it’s not, please give me your suggestion to solve the ...
4
votes
1answer
68 views

SAML 2.0 Multiple AuthnStatements

If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.
0
votes
1answer
70 views

What does this snort rule mean?

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-BACKDOOR access remote pc runtime detection - init connection"; flow:to_server,established; content:"|99 F3 00 00 00 00 00 00 FF FF FF FF|"...
0
votes
1answer
302 views

Is it possible to recover a Diskcryptor volume password?

Must admit to being dumb: I have encrypted one partition from my external hard drive with the AES-Twofish-Serpent algorithm and used a key file with a password. My PC ran into a problem and now the ...
8
votes
1answer
396 views

Vulnerabilities of pure NAT without firewall

Following some of the comments on this question, I was curious about the security vulnerabilities of NAT. There are similar threads here and here but they discuss router vulnerabilities rather than ...
5
votes
6answers
2k views

Can one steal data using electric wire?

If I would like to keep my work secret in my computer and I don't use Internet, is it possible for a cracker to steal my data via electric wires or a wireless connection?
2
votes
1answer
3k views

msfvenom payload problem

This is for educational purposes only! I'm trying to generate android payload using msfconsole payload standalone generator: msfvenom with the command msfvenom -p android/shell/reverse_tcp LHOST=192....
2
votes
0answers
109 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
1
vote
1answer
172 views

Use HSPD-12 (PIV) Keys for SSH

Can I use the on-board key generated keys on the HSPD-12 card as openssh keys? If so, how?
1
vote
1answer
195 views

MUST Share Personal Info with Windows 10?

Just upgraded to windows 10. Had window open in Firefox when I upgraded. Should point out that for some reason Windows 10 would not upgrade on it's own, I went to Microsoft and they used remote ...
0
votes
0answers
71 views

Virtual Machine Introspection for VirtualBox

Is possible use Virtual Machine Introspection (VMI) for monitoring system calls and internal system operations in Oracle VirtualBox machine (if I use Linux as quest system) in this time? I have read ...
1
vote
1answer
140 views

What browsing history exactly would police have under proposed UK law change? Plain english

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser (...
3
votes
2answers
228 views

Does Visa Checkout have preventive measures against spoofing?

A few online merchants are offering special deals for using Visa Checkout, a payment service similar to PayPal, so I've been trying to learn something about it before signing up. When you are on a ...
2
votes
2answers
31 views

What constitutes submitting payment at a different address for PCI-DSS?

I am attempting to use TransArmor PCI Rapid Comply to verify compliance for my small business. At one point, I have two choices: 1) Customers submit payments at a different web address (i.e. ...
1
vote
2answers
109 views

Ettercap Remote Poisoning

I have a question about one parameter and that's it. When I'm doing DNS spoofing I have to use arp:remote. Can someone explain to me what arp:remote means? I read the man page, but did not ...
4
votes
3answers
180 views

Best way to check if your browser is secure

There is a lot of Malware checking software which seems is just a virus. How can you check for sure that your Windows 8 computer is uninfected with virus and malware? Is malwarebytes enough, or ...
0
votes
0answers
47 views

PKCS#11 check if slot function is busy

I would like to create something like load balancer on multiple PKCS#11 tokens. So for example if one token or slot would be busy, I would use another one connected. Is there a way how to chcek that ...
2
votes
1answer
79 views

WebRTC attack surface area?

I'm building an app for browser-to-browser communication. What is the attack surface area for WebRTC in 2015? What kinds of attacks could be done? And more importantly, how do I craft something ...
1
vote
1answer
114 views

Yersinia raw packet

I'm using Yersinia to pentest my network. There are two options send raw packet and creating DHCP rogue server I don't understand fully. Can someone explain the meaning of these options?
5
votes
1answer
490 views

Spoofing `localhost` to connect to a server that only accepts connections from localhost

I have been wondering whether it is possible or not to spoof localhost so that when a connection is made the remote server can be tricked into thinking the connections are coming from localhost. For ...
0
votes
1answer
114 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
3
votes
1answer
44 views

Authorizing a device to access user resources

Description: I am building an information display system. The system consists of the following: A Django Rest Framework based backend providing a low-level JSON API A single page application web ...
3
votes
1answer
153 views

Do major linux distributions differ with regard to releasing security patches? [closed]

For a non-commercial user, is there any difference between major distributions regarding the time needed for security patches to be available? Does the "enough eyeballs effect" takes places in this ...
4
votes
2answers
192 views

SSLStrip still HTTPS

I did all the configuration right. IPtables, port forwarding, ARPspoof, everything. However, in the browser websites like Facebook and Twitter are still HTTPS. What am I doing wrong?
0
votes
0answers
25 views

SCEP CertRep SUCCESS: how many certs are in the response?

I am working on an SCEP implementation (both requester and authority). The project uses JScep as a library. During the communication for a PKCSReq the client receives a CertRep SUCCESS. The draft ...
-1
votes
1answer
45 views

SSLStrip with autologin [closed]

What can I do to sniff the traffic by SSLStrip when the user has automatic login to the site?
1
vote
2answers
145 views

Does using NATO's phonetic alphabet increase password strength?

Given an alphanumeric password intended to be strong yet easy to remember, we change each alphabetic character by its NATO alphabet counterpart (e.g. 'cat' becomes 'charliealphatango'). I understand ...
2
votes
3answers
64 views

Stacking Encryptions (Stream over Block)

I am reviewing the code for a product our team developed where credit card information is stored in a local database in the event of no internet connection and came across the encryption methods. The ...
2
votes
1answer
136 views

SSL Client Authentication Failure

I have a setup where the client wants to make https call to the server. The client has a certificate installed on the machine The trust chain of the cert: Root CA      |----...
2
votes
1answer
66 views

Types of risks for my router

Recently I've read about viruses and worms that attack routers and do some nasty things, incl. DNS changes etc. In the beginning, I just read that some people have issues that their DNS server address ...
0
votes
1answer
35 views

Active Directory password complexity based onto entropy

I am evaluating the possibility to enable password complexity rules into my Active Directory, but the rules it offers are for me not good. So I would like to have a complexity rule based onto only two ...
1
vote
0answers
75 views

Secure Web app by user credential and secure REST API within app via best secure method in spring security [closed]

I have a web application which has a single page AngularJS and Spring Security.application going to login via HTTP basic and Hibernate. My application has a REST API. Now how do I secure my REST API ...
1
vote
2answers
132 views

sound card with BADUSB

Is it possible to prevent a USB sound card, that's infected with BADUSB, from damaging my computer? In particular, if I can limit the sound card to only act as a sound card, and not something else ...
4
votes
2answers
418 views

Docker X11 Forwarding Security

I am currently running a Docker container with a program with a GUI forwarded over SSH (using X forwarding over OpenSSH). The virtualized server has X11Forwarding enabled and I can connect to it from ...
4
votes
1answer
119 views

RSA fingerprint automatic change or have I been hacked?

today I tried to connect to my Digital Ocean VPS through Putty(kitty) as usual, but I got the message that the server's cached fingerprint had changed, and that it could be a security compromise. I ...
3
votes
1answer
156 views

How long is the information on Facebook stored? [closed]

I was wondering how long Facebook stores our photos and posts? I hear two theories, one saying it is around half a year, after which all the data centers are going to erase our data. The other one ...
1
vote
1answer
35 views

NMAP's explicitely closed ports

I'm working on a challenge and I notice this odd output for a full port scan? abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN Interesting ports on x.x.x.x: Not shown: 65533 filtered ports PORT ...
-1
votes
1answer
57 views

What if TLS is suddenly found to have a critical defect? [closed]

I know that we've already had some defects in SSL/TLS, like Heartbleed, POODLE, FREAK and others, but all of these were rather localized problems: Heartbleed was an easily exploitable bug in OpenSSL,...
4
votes
1answer
2k views

ssh signature question (no matching key exchange method found)

I recently followed the advice at this blog to tighten down my SSH security, which included restricting key exchange algorithms to ones not vulnerable to known (or assumed known) capabilities of Prime ...
6
votes
1answer
193 views

Database table name prefixes and security by obscurity

One of the most common pieces of advice with respect to securing WordPress, Magento, and other widely-used pieces of software is to add a prefix to database table names or change the default prefix. ...
0
votes
2answers
49 views

Emailing spoofing

I've got 2 macs on a home network, as well as an iphone. I've got my own domain on Godaddy set up with an SPF record. I've changed the password on my account. But emails are being sent using my ...
1
vote
2answers
50 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
3
votes
1answer
198 views

SSL session ID in TLS ticket based resumption

We have a server which supports TLS ticket based stateless session resumption. However, when I connect to the server using openssl s_client, I still see a session ID being generated along with the TLS ...

15 30 50 per page