All Questions

-1
votes
0answers
27 views

Configuration file with 12-character XML-encoded passwords

I have received a configuration file with 3 passwords I'm trying to crack. However, I'm having a hard time determining what hashing/encryption mechanisms are used for the passwords. The cipher ...
-3
votes
0answers
21 views

My site is being redirected to an app site when anyone tries to access site from an ipad [on hold]

My website is being redirected to this site: apps.rumobi.info
0
votes
1answer
54 views

Confirming a phone is still registered to someone [on hold]

My tenant s answering his phone pretending to be someone else and not paying his rent. I need to know the phone is still registered to him Is this possible ? Thank you I have tried a few times in the ...
2
votes
1answer
73 views

Do payload sizes reveal URLs when HTTPS is deployed on news, blogs, etc?

Even though HTTPS keeps HTTP paths private, is it not the case that the generally-unique payload sizes for particular URLs (on news articles, blogs, etc) provides a mechanism to reveal the URL anyhow ...
-1
votes
4answers
77 views

How and why does not having https allow people to trace my browsing habits if at home? [on hold]

How can my browsing habits be traced when I am at home on my own local network? Technically how is it done ?
0
votes
2answers
58 views

Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?

I recently set myself up with a VPS and have been hardening it to the greatest extent of my limited knowledge! I was configuring OpenSSH to use certificate based authentication when something did not ...
0
votes
1answer
32 views

How are SCrypt's memory-hard requirements substituted with more CPU?

I've implemented scrypt with two separate APIs and in both there existed no settings providing a way to substitute CPU for memory. Both were locked one-to-one with rounds and memory. However in ...
0
votes
0answers
12 views

Kerberos based infrastructure with artifactory repo for our java artifcts with Apache reverse proxy and mod auth kerb. how can I access with gradle? [on hold]

We recently migrated our company to a kerberos-based infrastructure. I successfully set up an Artifactory repo for our java artifacts, with Apache reverse proxy and mod_auth_kerb. How can I access ...
0
votes
1answer
26 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
0
votes
1answer
43 views

Should one worry about using an outdated version of Firefox? [duplicate]

I have access (and the general public) to a computer lab with many workstations. Each workstation is identical in terms of software, hardware and the version of firefox. The version that is installed ...
-1
votes
0answers
23 views

Can you tell me the best tool to reset PC window password? [on hold]

I forgot my PC windows password and want to reset it so can you tell me the best process or tool to reset PC windows forgotten password?
2
votes
0answers
29 views

Advice on if I should talk at my local user group about NIST, InfoSec etc [on hold]

I have been toying with the idea for a while now about doing my first talk, on my last project I was building a Risk Management portal for information security so I had to read all about Risk ...
1
vote
0answers
18 views

Cisco ASA acl deny hit rule but traffic permitted

interface "ldap" access-group ldap_access_in in interface ldap access-group ldap_access_out out interface ldap I had zero hits until I started to try ssh; access-list ldap_access_out line 1 ...
2
votes
1answer
46 views

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command ...
0
votes
0answers
9 views

ITR(Interactive TCP Relay) Configuration for penetration testing on Thick client Application [duplicate]

I am trying to do penetration testing on Thick client application. In some article I read like ITR(Interactive TCP Relay) will help in intercepting and modifying the traffic. I don't know how to ...
0
votes
0answers
43 views

Penetration Testing on Thick Client Application

I am trying to do penetration testing on thick client application. Is there any tool for intercepting the traffic from thick client application? I have tried with burp invisible proxy but it is not ...
2
votes
2answers
33 views

GPG Web-of-Trust Level

(and really sorry for my english) I have a question about Web-of-Trust of GPG. Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...
0
votes
1answer
14 views

Is openVZ patched against all exploits for its current kernel version?

I am looking for a container vitalization software that will allow me to create containers that will house specific software/jobs/tasks which I can start stop at will (and bind to interface aliases). ...
1
vote
1answer
77 views

How are SHA1 and MD5 considered to not protect against collisions?

SHA1 and MD5 hash functions are considered to not protect against collisions while SHA2 is. Is it the size of the message digest that makes this or the algorithm itself? If it is based on the message ...
15
votes
3answers
4k views

Is it possible to get the salt if I have the hash and original password?

Is it possible to get the salt if I have the hash and original password? My gut feeling is no, but would it be impossible or will it just take very long?
0
votes
1answer
44 views

Why do we encrypt ephemeral Public key in Encrypted Key Exchange

Encrypted Key Exchange can resist off-line dictionary attack Protocol : A ---> B : Ep (PK) B ---> A : Ep(Epk(K)) K is Session Key generated by B PK is an ephemeral public key ...
4
votes
3answers
547 views

Protected excel sheet is unprotected without permission in google spreadsheet [on hold]

I created an Excel spreadsheet using Microsoft Excel 2013 with password protected cells (only particular cells. Other cells can be edited). When I open this spreadsheet in Google spreadsheet, I am ...
0
votes
0answers
15 views

PC in VMWARE can ping Host computer but host computer can't ping the VMWARE machine [migrated]

I'm creating PFsense lab with this diagram The Webserver can ping the outside host (PC3) but the PC3 can't ping the webserver. The firewall i'm using is PFSense. I have disabled all Window ...
-2
votes
1answer
30 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
-2
votes
1answer
93 views

Who can help me decrypt [on hold]

There is a string: 51141010379856000173550010000111151512908026 which after encryption becomes: l4yAOVWeHlk4tnNu3HlJnxMUppeOWCpIqmRKkUPQHlgNawdYMDK2mnieDazPkJuI ...
2
votes
5answers
153 views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
1
vote
2answers
49 views

bscrypt,scrypt v/s iterative SHA-x [duplicate]

Both bcrypt and scrypt hashing algorithms are designed to increase the resources required during the computation. Hashing passwords with these algorithms can be beneficial as it makes the task of an ...
0
votes
2answers
42 views

Sign SSL certificate with root certificate using openssl

I have created a root certificate, My Root Certificate, with a private key, RSA Private Key 1, using the openssl terminal command. I would like to make a certificate chain such as the following: My ...
0
votes
2answers
82 views

Open email accounts on public computers

When I use a public computer at a certain location, logging into the workstation and going to a site like gmail.com (to check my email) I find that another user is already logged in. Same happens for ...
2
votes
1answer
19 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
-5
votes
0answers
50 views

Hacker uses my IP for cover [on hold]

Yesterday, my credit card got hacked and the bank won't allow me to use my Visa card.. When I checked the history I found out the hacker used my IP for cover as he was hacking me, and others, I am in ...
3
votes
4answers
167 views

How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.

I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students; It used to use EAP, allowing students to enter their ...
4
votes
2answers
97 views

In what situations does parameterizing a query NOT prevent SQL Injection?

While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic ...
26
votes
1answer
2k views

What questions should be asked when joining a new security team?

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
0
votes
0answers
36 views

Malware or exploit kit without escalation kit

Does anyone know of any malware or exploit kit that do not use a privilege escalation kit and just do malicious things with an unprivileged permission?
-4
votes
2answers
38 views

What is the best exploit of XSS within 100 characters? [on hold]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
-1
votes
0answers
35 views

I was hacked and know the ip address, what can I do? [duplicate]

My microsoft account was hacked and I know from a security page on their website the hackers ip address, or at least the 'zombies' ip address. I live in the USA and the hacker came from turkey, so I ...
1
vote
1answer
54 views

Safe to disable UAC?

I have programmed my own Windows kiosk application (.NET) which requires admin rights from the OS to ensure certain services are running (amongst other things). However, this causes the UAC prompt ...
0
votes
1answer
9 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
2
votes
1answer
29 views

Strange requests coming from EA4350 Linksys routers

I have had two Linksys EA4350 Routers for a week or so being used internal my network as wireless access points, and all of a sudden I started noticing requests from them once per minute (care of my ...
3
votes
1answer
120 views

XSS: terminology [on hold]

Where does the name XSS come from? Why "cross-site"? Also, the book "The Web Application Hacker's Handbook" says that the name XSS is a misnomer when talking about "stored XSS" or second-order XSS ...
0
votes
0answers
26 views

SSO which works well with build tools [on hold]

My company started growing rapidly recently, which means we have a increasing amount of internal services. Each of these service use a custom apache module for authentication/authorization purposes, ...
3
votes
2answers
133 views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
1
vote
2answers
37 views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
-1
votes
0answers
34 views

How do I get the IP address and location from an email

Good sirs of Security Stackexchange, I'm a bit in a pickle as I believe that I have become victim of computer fraud where some ruffian stole my ID. I was wondering if perchance there is a way of ...
1
vote
0answers
12 views

Ipsec connection fails

I have two system with fedora12 installed Host1 IP address - 10.1.0.1 Host2 IP address - 10.1.0.2 Then configured IPsec in both machines as below Host 1 config (/etc/ipsec-tools.conf) #Host 1 ...
2
votes
1answer
48 views

Is return oriented programming applicable to pure Java code?

I'm interested in ROP in the context of Java. For now, I don't consider the native code of the Java virtual machine. Is return oriented programming applicable to pure Java code?
0
votes
1answer
44 views

How come PBEWITHSHA256AND128BITAES-CBC-BC violates the 128bit key limit?

In my Java application (which use StandardPBEStringEncryptor by jasypt), when i use the PBEWITHSHA256AND128BITAES-CBC-BC algorithm instead of something weaker such as PBEWithMD5AndDES, i get an ...
14
votes
3answers
2k views

How does Bayesian poisoning work?

This answer mentions Bayesian poisoning in passing and I've read the wikipedia page but don't feel I've fully grasped it. The first case, where a spammer sends a spam with a payload (link, malicious ...
0
votes
0answers
58 views

sniff https traffic and grab credentials with ettercap [on hold]

how to access a website with the session id ? thanks very much!! I have the session id but I don't know how to use it

15 30 50 per page