All Questions

0
votes
0answers
73 views

Example websites that have invalid certificates [on hold]

I am looking for websites that have invalid HTTPS certificates. I did a search but found few examples. I am wondering if anyone knows any HTTPS website with invalid or broken certificates, for ...
-3
votes
0answers
38 views

What encryption or hashing algorithm is likely to be used here? [on hold]

I want to use the USERS table of a proprietary 3-rd party tool for user authentication. The column PASSWORD is of type VARCHAR(35). It holds the following data: 64783641124722847161648230000000000 ...
-1
votes
1answer
18 views

getting an error in aireplay-ng in kali linux

When I was testing penetration testing on my router using kali linux, I followed all the steps from this link. In the step where you have to enter the router's bssid and client's bssid in aireplay-ng ...
-2
votes
1answer
95 views

What kind of encryption is this? [on hold]

I'm trying to discover what type of encryption was used to generate this strings: Qo94v0JpPaL59LS6U3xfEB4nVgc= +3ZaEliGZ7DWte+LaviHvOlcg9A= v44x/KnS/JyOVDtbmbkFkJEgkWs= y75nHoG/yXwutlixBX7/jRXsv+o= ...
0
votes
2answers
71 views

Will an ISP give out network/traffic info upon request?

Nothing big, just a fear of embarrassment. I use my mom's (she pays for it) internet service to connect online and stuff. The thing is, I am nervous that she may possibly ask the ISP for some traffic ...
3
votes
1answer
21 views

Clarification on the -h Flag for Makecert.exe

When using Microsoft's Makecert.exe to generate a certificate (and key), there is the option to allegedly "specify the maximum height of the tree below that certificate", using the -h flag (see MSDN). ...
-4
votes
1answer
48 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
2
votes
1answer
39 views

Masking traffic in another protocol

I remember reading a couple of years ago (I believe it was during the Egyptian Revolution) that hackers managed to bypass government filters by making their traffic appear as another protocol. If ...
5
votes
0answers
52 views

Cordova/Phonegap: RefreshToken in localstorage

I'm following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on that same ...
2
votes
0answers
31 views

Why should I persist OAuth 2 access tokens along with refresh token

That's something I've came across in a couple articles about OAuth 2: when it comes to persisting refresh tokens to database some authors prefer to store access token as well, or at least mention it ...
4
votes
2answers
276 views

Disable SSLv3 in Dovecot --> TLS handshaking failed: no shared cipher?

Ubuntu 12.04 OpenSSL 1.0.1-4ubuntu5.20 14 Mar 2012 Dovecot 2.0.19 The situation is I'm trying to disable SSLv3 in Dovecot by adding !SSLv3 to the ssl_cipher_list: ssl_cipher_list = ...
1
vote
1answer
30 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.
-1
votes
2answers
36 views

Tools to check the firewall Configurations as per PCI standards [on hold]

How do you audit the Firewall rules and configuration policies as per PCI standard. What are the tools used for it.
0
votes
1answer
51 views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
2
votes
2answers
81 views

Decrypting TLS Traffic

Context: I want to reverse engineer a protocol in place for the Nintendo 3DS. The implementation however, uses TLS, which makes it difficult to reverse engineer. I'm currently able to sniff packets ...
0
votes
1answer
140 views

CloudFlare - prompted for “attention required”

I am getting a CloudFlare - attention required / security check prompt on most of the sites I visit through my Macbook running OS X Yosemite, these sites work perfectly on other devices (such as iPad, ...
0
votes
0answers
23 views

Rooted android cached password

Assume you could exploit a vulnerability on an old Android 2.2, the questions are: 1- Is there anyway you could see stored passwords on that operating system, specially Facebook password. 2- Can you ...
1
vote
1answer
35 views

Client Hello message suggests cipher suite which is not in the list specified by setEnabledCipherSuites() method

In my code, I use JSSE6 API to specify a list of enabled cipher suites. I aimed to only allow 168 bits or higher encryption cipher suites, below is a part of my code: /** List of 168 bits encryption ...
2
votes
1answer
25 views

PCI - prohibiting direct connections to the Cardholder Data Environment

In PCI 1.3.3 it states: Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment? A Cardholder Data Environment (CDE) ...
0
votes
1answer
85 views

Why is not safe to use the same public key in RSA?

In the RSA context, why is not safe to use the same n (public key)for different people?
0
votes
0answers
73 views

How to decrypt crypt7 files from whatsapp [on hold]

I copied my entire Whatsapp folder from my Android phone onto my computer but I can't figure out how to decrypt the msgstore.db.crypt7 file to just msgstore.db
-1
votes
0answers
18 views

snort per packet content whitelisting how?

What would a snort content whitelisting rule look like? I want to allow a packet as long as its content contains only a certain approved text string and nothing else. Another orthogonal question: ...
0
votes
3answers
71 views

What is same site scripting and what are some exploit scenarios?

I know it is an issue with how DNS is configured , but is it really dangerous if the attacker couldn't access your network?
-2
votes
2answers
52 views

Find DES encryption key having input and encrypted output

Having the source string: kenanfx And the generated encrypted string: csund6XMTudO6 Using this script, it identified the algorithm used to encrypt as DES(Unix) I wonder if it is possible (in ...
9
votes
2answers
691 views

ISPs are now adding unique header identifiers to web traffic. Can this be avoided? If so, how?

I'm a security-conscious Verizon user, and it has recently come to light that Verizon is now serving up my web traffic to ad partners while en route. I understand that once my data has left the ...
-1
votes
1answer
67 views

Home PC has been compromised remotely and even after cleaning my PC repeatedly, the problem still comes back, help please? [on hold]

I'm a regular guy running two small franchise businesses with a basic understanding of computers etc, (very basic really), but I am certain my home network has been hacked and I am finding lots of new ...
0
votes
3answers
73 views

CSRF Token Strategy

I'm trying to learn more about website security, but it's confusing. I often feel like I need to be an attacker in order to understand how to defend against one, since I don't know what they are ...
1
vote
1answer
129 views

Where does /dev/random get its entropy?

I read over and over about how /dev/random gets its entropy from "hardware events." What exactly are these hardware events and how can we be sure that it is random enough?
1
vote
1answer
61 views

How to cryptoanalyze a one time pad that uses a plain text document as the pad?

I have read that in order for a one time pad to be truly secure, the pad itself must be random data. Given the practical difficulty of sharing a secure random pad, I was wondering what would be the ...
3
votes
1answer
70 views

SSD Self Encrypting Drives - Setup / warm boot bypass

I've seen folks deploying the SED on laptops recently. I've discovered that there is a setting in which you can do a warm boot and NOT require the bootup password to be put in again. Which makes ...
4
votes
1answer
82 views

When does an Apple Pay token get converted to a real credit-card

Apple Pay says they store a Token on the phone and use it for transactions. Who issues this token? Who then converts this token to a real credit-card. Where is the mapping from token to real card ...
1
vote
1answer
40 views

Is selecting trusted computer in 2-step verification less secure?

In using 2-step verification, does selecting 'Trusted Computer' a less secure options? https://support.google.com/accounts/answer/2544838?hl=en If so, is it still a reasonably secure option?
2
votes
1answer
29 views

ecryptfs - relationship between passphrase and sig-cache.txt

I have previously used TrueCrypt for creating encrypted directories on servers. I am now trying ecryptfs due to the end of development announcement in May. I see that when I encrypt a directory and ...
16
votes
3answers
2k views

Is my phone carrier monitoring my traffic?

Today I started using a VPN on my phone (nexus 5), and after I switched on mobile data and turned off my WiFi, I received a text message from my carrier offering me roaming packages for Europe (which ...
20
votes
2answers
3k views

Why do I need to hide my phone's IMEI

If it is a secret then why is it visible on the box, invoice and the back of the phone? If it is not a secret then why does it have to be blurred when it gets posted online?
-2
votes
0answers
38 views

What can i do after this step [on hold]

one of my friends gave his site for auditing and lately i found that in his search box i can insert javascript and html tags which will show me the expected results, ex: if i insert <h1> tag it ...
-1
votes
0answers
34 views

How can I modify traffic realtime using MITM technique? [on hold]

I want to create an MITM which parses traffic, but can identify certain packets and trigger a response. I want to be able to toggle the trigger on/off, so that if the client sends a request to the ...
-2
votes
0answers
34 views

What happens behind the screens during an HTTPS connection? [duplicate]

How HTTPS(SSL communication) actually works? I have been reading many questions and answers on this topic but some basic question come up to my mind. 1) When I https to any site say ...
2
votes
2answers
72 views

What are the insecure Protocols in terms of PCI DSS

What are the insecure protocols which should be disabled according to PCI DSS standard. How to check those are disabled in Firewalls and Servers.
1
vote
1answer
119 views

Browser gives access to root directory through “/” [on hold]

If I put a '/' on my browser I have full access of my root directory. I have tried the same thing on another computer and it didn't work. So, I'm trying not to be paranoid but this is too strange. I ...
2
votes
1answer
72 views

How can I detect a VPN connection (even just in some cases) to get the real location of the user

I'm creating a web site, I would like to allow people to sign-up only from their "real" physical location (not using a VPN). I was thinking maybe comparing local and server time... what else...? I ...
5
votes
2answers
667 views

Can the IV + Salt be the same?

During my encryption app i've got the password creation bit: PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 10000, keyLength); and later on the actual encryption part: ...
31
votes
8answers
6k views

Do bad passwords produce bad salted hashes?

When you have a password stored in a database that has been strongly hashed and salted does it really matter if the underlying user password is weak? If you setup features like limiting login ...
0
votes
1answer
34 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
9
votes
8answers
1k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
0
votes
2answers
55 views

Stateless session cookie and logout

I have implemented stateless session cookie, something along the lines of this article: Demystifying Web Authentication (Stateless Session Cookies) The cookie contain an expiry time within the ...
2
votes
1answer
74 views

Assuming malicious admin, what threats does a dedicated server mitigate vs VPS?

We host several dedicated servers and VPS instances containing sensitive data with 3rd party hosting providers. We understand we have to trust the providers as they have full control of the hardware, ...
1
vote
2answers
42 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
0
votes
1answer
39 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
0
votes
1answer
90 views

Isn't this a broken certificate chain?

My certificate provider responded to my CSR with four certificates, the first being "ours", and the remaining three presumably to build a chain of trust. I've never had to investigate (and prove to ...

15 30 50 per page