-1
votes
0answers
29 views

Monitoring what is being done on your PC when TeamViewer is used? [on hold]

How can I watch what someone is doing on my PC while they are logged in on TeamViewer?
1
vote
0answers
18 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. ...
0
votes
0answers
38 views

Best way to store SQLite password offline?

I'm developing a Windows application that uses SQLite, and I want to encrypt it (there is some sensitive information). The trouble is that one of the application requirements is that it must work ...
0
votes
1answer
28 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
0
votes
0answers
13 views

accessing file through an RDC or sharing across network more secure?

Question: Which is more secure? The Goal: Billy works in an office that is setup on a domain and needs to create files then have a different department access them. Option 1: Billy rdp's into a ...
0
votes
0answers
20 views

Privacy concerns for personal data shared between Facebook and Amazon

I was looking for a tablet from my home PC on Amazon and sometimes I find Amazon ads on Facebook which contain suggestions related to my search criteria; I never worried too much as I thought the ...
0
votes
0answers
23 views

Attaching orphaned/stageless session meterpreter

I have problems with meterpreter reverse_https. In my engagement, I saw this message in console; "Attaching orphaned/stageless session meterpreter" But after I lose connection, and victim connects ...
1
vote
0answers
14 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
1
vote
0answers
31 views

How can I authenticate securely to an internal website from an iPad without an strong password?

I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities: Credentials stored in the iPad (like Gmail credentials). Using ...
3
votes
1answer
41 views

May HSTS block access to your site when you renew your SSL certificate?

I've thinking in using HSTS in my sites but I don't understand if I need to sync the HSTS timing with the time when the certificate is going to be renewed or not. Can I use safely a static time for ...
3
votes
1answer
40 views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

Chrome on Windows and Linux and Firefox on Windows are executed in a sandbox. On Linux, is the Chrome sandbox enough or would we gain security if we use SELinux to protect the Chrome execution? I ...
2
votes
1answer
58 views

Strange CA certificate prompt

My network went down for a minute today, then this window popped up: Can someone here clarify this for me? I was using firefox. I had google, youtube and outlook open. My name isn't even close to ...
0
votes
1answer
32 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
0
votes
2answers
56 views

Nmap says host down, but host is up

I am using nmap 7.12 on Mac OS X. I haven’t been able to find a solution to my issue. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP ...
1
vote
1answer
39 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
2
votes
1answer
37 views

What are the security implications of enabling CORS for images?

The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the ...
2
votes
1answer
26 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
0
votes
0answers
21 views

OpenSSH password based authentication in the enterprise?

TL;DR How common is.. Using password based authentication on servers to login over SSH reusing the same password other places. Even if this is an unprivileged user it is still valuable I think. ...
-5
votes
0answers
55 views

What kind of encryption/encoding is this? [duplicate]

Unknown encryption/encoding: ...
1
vote
1answer
24 views

What protects HDCP keys in software?

I (somewhat) recently stumbled across HDCP (high-bandwidth digital content protection), a protocol that encrypts movies and other media "on the wire". Now there are of course tools to play blu-rays ...
0
votes
0answers
15 views

How can I test my SSO connection without having access to the Identity Provider?

I'm trying to set up an SSO connection using Auth0. My app is set up as the Service Provider (SP), and it needs to work with PingFederate as the Identity Provider (IdP). I don't have access to an ...
1
vote
3answers
64 views

Storing two copies of data, encrypted in different ways

Our website has some personal data that needs to be visible to both the user it belongs to and the administrators. It also needs to be encrypted. As we want to maintain a simple system, just username ...
0
votes
0answers
24 views

Are there security concerns with Bluetooth low energy?

In the first versions of BLE specifications, there was a huge security flaw during the pairing allowing an attacker to perform a MITM attack. Since Bluetooth 4.2, the pairing use ECDH, so there isn't ...
0
votes
2answers
50 views

Is JQuery 2.1.1 vulnerable to OS command injection?

Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the JQuery plugin itself (version 2.1.1). Barracuda rates ...
-2
votes
3answers
57 views

Email from supposedly Apple (mycloud.ssl.com)

I got an email where it says that Apple recently failed to validate my payment information and therefore they need to ask me to complete a short verification process in order to verify my account. At ...
1
vote
1answer
47 views

What is a device that scans the network it is connected to called?

Are there any devices (computer, switch, router, etc.) witch integrate licensed software like Nessus or Nexpose in a way that you can just drop them in a network and scan that network remote? If so, ...
1
vote
3answers
71 views

Is there now an increased risk of ransomware in pirated software?

Ransomware is on the rise, much due to new ransom-paying opportunities via Bitcoin. Has there been a reported increased risk of ransomware in pirated software (i.e. so called “warez”) – outside of ...
0
votes
1answer
15 views

How server knows about the client_write_key to decrypt the client message?

I have a question regarding the TLS handshake. As of my reading I came to know that master_secret will be derived from pre_master_secret shared by client as follows: master_secret = ...
-1
votes
0answers
22 views

About Arp attack

we have the suspect of MITM attack but we are not sure. So I install XARP on the computer. The log is clean but one computer of the net have a very higth value in the coloumn how often seen. It's ...
0
votes
1answer
33 views

Connected to my server through VPN. Should I change my key?

I am using an SSH key to connect to my server (I've got Pageant to authenticate my key) and I forgot that I had the VPN on so I connected to the server (SFTP) while I was on it. Should I change my ...
0
votes
0answers
27 views

Unable to view USB Hard drive contents after lock(read-only access)

My work laptop has PGP Desktop 10.3 and when I connected my USB flashdrive it prompted me to Encrypt or Lock. Given the information on both of these options the only choice I had in order to access ...
0
votes
0answers
45 views

What is the right strategy for me to develop a paid public wifi?

I want to establish a paid public WiFi system. Here is my model of how it will work: I will install a public WiFi in my apartment. Using the WiFi system is paid but, voluntary. Those who pay me a ...
2
votes
0answers
31 views
+100

Right way to use the TPM for full disk encryption

I'm currently setting up a BitLocker equivalent using a TPM and LUKS. I've got the basics right and I'm able to measure the boot process and seal the FDE key using the TPM. Every time the sensitive ...
-7
votes
0answers
51 views

How to spoof browser fingerprint? [on hold]

I need some JavaScript code to spoof the following browser information to make a fake fingerprint: Limited supercookie test Hash of canvas fingerprint Screen Size and Color Depth Browser ...
1
vote
1answer
43 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
1
vote
0answers
24 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
0
votes
1answer
96 views

Is this company's claim to have solved MITM attacks true?

The Daily Mail reported in Dec 2014 about a company that claimed to have solved the MITM attack. Can someone explain how this is possible or what the difference is from TLS?
0
votes
0answers
24 views

InitializeSecurityContext takes 45 seconds to come out

For an expired certificate sent by a server, the InitializeSecurityContext function takes more than 45 seconds to come out with SEC_E_CERT_EXPIRED. Is there any configuration to avoid this much ...
0
votes
1answer
13 views

How can I check the integrity of a file with GPG?

I plan on running several servers with bitcoind and other things. How can I do file check with GPG key? I did the following: first I downloaded the file I want to check over a secure connection: ...
-1
votes
0answers
20 views

Recover encryption key from Windows

Ok, So last night my Windows 10 Laptop crashed and was stuck in a repair boot loop and after troubleshooting and restarting and so on, the best course of action was to reset my PC. So as I was in ...
0
votes
1answer
52 views

Strange symbols in Firefox address bar with https

Why are there dash marks through the https portion of this address? Is this a feature that's supposed to further accentuate that this is unsecured https? I just thought it was a graphical glitch ...
0
votes
0answers
18 views

AES256 nopadding vs PKCS7Padding

I was looking over AES Crypt's Java lib which seems like a secure AES encryption software and I noticed that they are using nopadding. Can somebody explain to me what the benefit of using nopadding as ...
-3
votes
1answer
73 views

Is it possible for a school to see what you're doing when connected to their WiFi?

Let's say I connect to my schools WiFi, and I log into Facebook. Could they see my login information, my messages and what not? I know they could see what applications you are using, but I'm still not ...
0
votes
1answer
42 views

Decrypting binary code from a base64 string

So, this online discussion function use decoded account names in every post, along with that they call "logging data", an example of this can be: Loggin data: 10878 Encoded account info: ...
3
votes
1answer
63 views

Fear regarding session tokens

I have read recently that sessions work as follows: Your credentials are checked. A token is generated and stored on server side, eg UUID, and this token is given to the client where it is stored ...
2
votes
0answers
18 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
0
votes
2answers
58 views

Setting up a secure VM and protecting host network

I'm an intern doing research on different honeypots, and I'm planning to test a few on a VM. However, I'm on a company network and would like to have my VM as secure as possible. I've read that VMs ...
-4
votes
0answers
24 views

“DNS not found” when connecting to a public wi-fi spot [on hold]

Trying to connect to a public free wifi spot (eg. in Starbucks) on my os x and on my Win10 laptops, after I click "connect" on the appropriate wifi network name, the "connected" icon appears, which is ...
0
votes
0answers
17 views

Virtualbox wipe drive on exit

In Virtualbox, is there a way to wipe the virtual drive of a Guest OS upon exiting/shutting down that OS? If not, is there any other way to reaching that goal without doing it manually?
57
votes
4answers
6k views

Does Microsoft's “Password Ban” list insecurely store user passwords?

Supposedly, Microsoft is banning common passwords, and their list will dynamically update: Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. ...

15 30 50 per page