-2
votes
1answer
630 views

What type of hash is that [closed]

Hey do you guys know the algorithm used to generate this hash? 6874747a3b202063733437373676342f766c2f6e6520753933313538343931206175646960732039‌​353861383a3a36663836392f6e7a3325313638 It's ...
26
votes
6answers
3k views

Are there secure alternatives to single-use password reset links?

We currently have what I believe to be a pretty standard scheme for dealing with password resets. Our reset links are single-use links: They expire immediately after they've been visited, even if the ...
0
votes
0answers
84 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
2
votes
1answer
105 views

Can Polygraphs be effectively 'beaten'? [closed]

This article suggests that polygraphs are rather rudimentary and thus very susceptible to being 'beaten'. In pop culture we see all the time movies where polygraphs are beaten -but with great ...
3
votes
3answers
2k views

Block Incoming-Teamviewer Connection

Is it possible using any open-source tool, Cisco IPS or Cisco ASA, to block incoming Teamviewer connection to specific internal IP blocks, while allowing the outgoing ones? I cannot find specific ...
1
vote
1answer
92 views

OAuth implicit flow and confused deputy problem

I'm reading about Google OAuth and implicit flow. In Google docs it says that the access token received using the implicit flow must be validated otherwise the application might be vulnerable to ...
1
vote
2answers
454 views

Testing XSS - how to validate manually?

I have Burp and Appscan telling me that Reflected XSS is possible due to a particular variable on a particular page. The following example is given of what Appscan injected ...
6
votes
4answers
3k views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
3
votes
2answers
279 views

How to get rid of an Ad bot?

The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by ...
-5
votes
1answer
139 views

Is www.cheap-lingerine.com safe to use my credit card on? [closed]

I want to make sure my information is safe. This website is openly china-oriented but says to secure card information with Secure Sockets Layer technology (SSL) on those pages that involve sensitive ...
2
votes
2answers
1k views

What happens when a spoofed source IP packet is dispatched out of a private network with NATing

Suppose as an attacker i want to carry out a Ping or SYN Flood attack.. I can change the source IP of the packets generated at my machine to a false/spoofed public IP address so that replies go to ...
2
votes
1answer
185 views

How does this website prevent directing away from it

I'm using the latest version of Firefox with Ghostery and Adblock plus installed. This website somehow prevents navigation away from it. How does it do this and how can it be protected against? I ...
0
votes
1answer
95 views

Encrypting folders with flash drive key?

Is there any way to have a flash drive encrypted and it will only open with one computer that has the key in it?
0
votes
2answers
428 views

Gmail spam from contacts. How does it work?

I don't know why it seems IMPOSSIBLE to find a blog or any security expert explaining the procedure of how this 'hack' works. My wife is receiving emails from people she's emailed through Gmail ...
1
vote
4answers
568 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
0
votes
0answers
25 views

Certificate Errors on Network and Desktop Icons Freeze

What causes a screen on all devices on the same network to temporarily lock up and display certificate errors? After accessing Facebook; I have received a certificate error on both the student laptop ...
0
votes
2answers
326 views

CEH training courses requirements

What are the requirements for studying CEH? Is there any requirements for the programming background? And can anyone apply for it or does he has to have a recommendation for both studying and taking ...
2
votes
2answers
176 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
-2
votes
2answers
164 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
1
vote
1answer
701 views

someone is trying to SQL injection me.. what are they trying to do?

I get a lot of logs saying someone is trying to reach ...
22
votes
3answers
8k views

Why is “www.” considered unsafe in this HTTPS URL?

I was doing some cross-origin requests to Soundcloud's oEmbed and I noticed some strange behaviour. When doing a request from my localhost, which is on a regular HTTP connection, everything worked ...
2
votes
2answers
597 views

How vulnerable am I on a unencrypted public WiFi network? [duplicate]

I am enrolling myself into a college. College provides a Public WiFi Access Point, to access internet through its network, which is unencrypted (No password). As being a programmer for last one and a ...
25
votes
3answers
13k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
0
votes
1answer
83 views

Unencrypted connections between 2 people who use the same ISP, what's the risk?

What is the risk, man-in-the-middle or otherwise, of unencrypted connections between 2 people who use the same ISP, in the same city? If we assume the ISP (and the copper wire that leads to them) is ...
0
votes
1answer
567 views

Someone is trying to hack my PHP server

Today, early in the morning. My dedicated server was slowing because there was numerous requests coming. One error I remember is some message from MYSQL, it said something similar to, ...
1
vote
1answer
102 views

Diffie Hellman Hash MITM

I've seen an application recently that used the Diffie Hellman algorithm. It is not a Ephemeral Diffie-Hellman implementation, but rather a Diffie Hellman one. After the secret keys have been ...
0
votes
1answer
102 views

Virtual Penetration Test Lab - Figuring Out Its Market Size

Is there any reliable data available based on which the Global Market Size of Virtual Pen Testing Labs ( or Cyber Ranges ) can be ascertained ? If NOT , is it possible to calculate it ?
1
vote
2answers
2k views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
6
votes
1answer
5k views

How exactly does 4-way handshake cracking work?

From my understanding this is how WPA2 works for home networks: PSK(Pre-Shared Key) is used to generate PMK(Pairwise Master Key), which is used together with ANonce(AP Nonce) to create PTK(Pairwise ...
0
votes
3answers
91 views

Locating a stolen device

Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download ...
2
votes
2answers
143 views

Reporting SQL Vulnerability

My first post here so i'll hopefully keep it simple. I have just finished building a CMS targeted at a certain industry and built a test site to see how everything works. Anyway I wrote a program ...
1
vote
0answers
60 views

use after free vulnerability [closed]

I am struggling trying to understand use after free vulnerabilities, can someone explain it for me with C language source code, and how it can be used to write to arbitary memory location or to cause ...
2
votes
3answers
305 views

What risks am I taking with a weak password on a laptop?

I'm setting up a Mac laptop for my wife. Mine has a ridiculously strong password, but she finds this annoying. If I give her a (relatively) weak password for convenience, what risks am I taking? A ...
1
vote
1answer
1k views

how long does it take to crack wpa or wpa2

I have a laptop with processor intel core i7 with turbo boost up to 2:7 ghz 8gb rams and gpu NVIDIA GeForce GT 740M (2 GB DDR3 dedicated) i want to know in approximation how fast ( in word/sec) can ...
4
votes
2answers
647 views

Are temporary files an issue when opening and editing an encrypted 7z file?

I am new to security and encryption. I want to store important information like passwords and pin codes so I don't forget them. So far I have been using LastPass but I would prefer a solution I ...
3
votes
2answers
514 views

Packet Checksums

I recently learned that every packet includes checksum bytes and that the computer will request the packet again if the checksums don't match. How do the following attacks defeat such a safeguard? ...
0
votes
1answer
140 views

How to detect suspicious activity on a web and mailserver?

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP). Question: What are the best practices to detect suspicious activity? Are there any scripts that shows ...
0
votes
1answer
120 views

Shared Memory expolit in smartphone OS

Today there is news about smartphone OS (Android, Windows and iOS) security hole using which some researchers have found a way to literally read all user activity from mobile screen. This is one of ...
1
vote
1answer
68 views

Acronym CSRF refer to token or the attack itself?

I am really confused of what CSRF is. I know it stands for Cross-site request forgery. http://en.wikipedia.org/wiki/Csrf When you read it here it talks about cross site request forgery attack. But ...
1
vote
1answer
41 views

Location Obfusication and Email/remote login

Would it be possible for a user of a 3rd party VNC software package and email client to obfusicate/spoof their location, so that an employer would be unable to determine the location from which the ...
1
vote
0answers
94 views

Data Security vs Information Security [closed]

Is Information Security field and Data Security field same? If not then, What is the basic difference between "Information" and "Data" in security field? Is Data Security a sub-category of ...
2
votes
1answer
220 views

Is this a safe way to identify users connecting to a chat server?

Before I start, all information will go over HTTPS. So, my website is basically like a forum with the authentication part finished and working. This forum has a real time chat application that sends ...
0
votes
2answers
235 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
5
votes
3answers
5k views

How trustable are third party root certificates?

I recently tried to use Fiddler2 from a third-party vendor Telerik. While decrypting the HTTPS traffic of my network, it asked me to install its own root certificate in my Windows operating system: ...
0
votes
1answer
73 views

How to maintain validity of user credentials?

In an example scenario consider that; I am a customer of organisation and I have two separate accounts with two different departments X and Y. I can login in to each department's website by using ...
1
vote
1answer
286 views

How to disable x-oracle-dms-ecid cookie

During a security audit, our cliente found that we are sending to the cliente a cookie called 'x-oracle-dms-ecid'. They asked to disable it or change its name. We have been reading all the Oracle ...
10
votes
2answers
380 views

Obfuscated php code found on the server

I found this piece of code hosted on my website I'm sure it's a malware. Any have an idea what this script does or how to deobfuscate? <?php ...
0
votes
1answer
959 views

How are TLSv1.0 ciphers negotiated as TLSv1.2?

I'm a little confused about something I am reading in Bulletproof SSL. "TLS 1.2 is the only protocol that allows suites to define their PRFs. This means that for the suites defined before TLS 1.2 ...
12
votes
4answers
1k views

Downsides to using HTTPS [duplicate]

Recently Google has indicated that a HTTPS certificate will be used as a positive signal in it's search rankings. This has caused some discussion within our company as to if we should apply a HTTPS ...
3
votes
1answer
630 views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...

15 30 50 per page