3
votes
0answers
104 views

Calling methods with Expression Language Injection in Spring Framework?

I'm currently on a pentest and I've come across a URL parameter which is vulnerable to Expression Language (EL) injection and I can prove that by accessing properties such as ${pageContext}. However, ...
3
votes
0answers
40 views

What vulnerabilities are associated with port triggering?

Background To address a VoIP voice lag issue, my provider added port triggering rules for over 42,000 ports on my router, which seemed sloppy. And as I understand it, port triggering should only be ...
3
votes
0answers
31 views

In mobile, can “Early Media” be sent from the phone?

Early Media, aka in-band information, is sent from the network to the calling phone in some circumstances, to provide alternative tones or extra information about the status of the call. In GSM this ...
3
votes
0answers
38 views

Protocols for transfering access control data

The company I am working for has decided to create an API for a few of the products we create here (we create physical access control solutions, card readers, key storage, intelligent door locks and ...
3
votes
0answers
37 views

How to mitigate risk of X11 buffer ghosting on window resize and X server shutdown

The Buffer "Ghosting" Phenomenon It is possible to observe contents of (old and currently used) graphics buffers on a monitor under certain circumstances, posing an information disclosure risk, when ...
3
votes
0answers
62 views

How to use openssl ca with prime256v1?

I am new on encryptation world, and reading about this, mostly websites say to use the prime256v1 for better performance and security. After some days testing, finally I get my openssl CA structure ...
3
votes
0answers
43 views

What is the current state of RFID / NFC security?

I'm attempting to do some RFID and NFC cloning and replaying research, as I'm hoping to be able to demo physical security as an attack vector to a few of out clients and prospects. The downside (...
3
votes
0answers
71 views

What can be derived from someone else's Google Analytics id?

A web page, which I'd expect to respect users' privacy, contains Google Analytics tracker. I consider it to be a wrong thing; before raising this to the site owner, I'd like to do minimal "research". ...
3
votes
0answers
56 views

Is Thunderbolt still insecure?

Has Apple fixed the Thunderbolt DMA attack when the computer is unlocked or is it unfixable since DMA is built into Thunderbolt? I don't want to get hacked simply by plugging my Mac into a modified ...
3
votes
0answers
69 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
3
votes
0answers
71 views

Secure a server on `localhost` such that only the authorized users can connect

Consider an application (such as an IPython notebook) that runs an HTTP server, and that (by design!) allows arbitrary code execution by authenticated users (this is the entire point of IPython, ...
3
votes
0answers
108 views

Modifying shell code to bypass Windows Firewall

As part of my OSCP's training, I'm supposed to get a shell on a Win7 machine using browser's exploit (MS12-037) with Windows firewall on. I have an idea but I'm having hard time applying it. What I'...
3
votes
0answers
117 views

Thoughts on my JWT implementation

So I've been trying to learn as much as I can about JWT tokenisation, and auth0 seems to be the defacto JWT information hub. However, the more I read about refresh tokens, the more I cringe - the ...
3
votes
0answers
126 views

Modify Certificate Subject using OpenSSL x509 Command

I'm building a CA based on the OpenSSL command line tools. I don't want to use the openssl ca tool and its file based database though, instead I create certificates using the openssl x509 tool ...
3
votes
0answers
64 views

How safe is WebCryptoAPI these days?

The 1Password Tool (software) introduced the 1Password for Teams. Now I thought this is a great peace of Software. But now they can show Passwords in the Browser. They do say: We encrypt ...
3
votes
0answers
99 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
3
votes
0answers
97 views

How to extract windows event logs from a hard disk forensic image?

I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
3
votes
0answers
27 views

Online votes where two-part codes are sent together

A lot of societies that I am a member of allow online voting for their AGMs (to elect members, approve minutes, etc). To vote in these all members are sent out a two part code - however the two codes ...
3
votes
0answers
70 views

Reverse Proxy + WAF

AS part of network design, I am implementing a HTTP Reverse proxy as well as a WAF. The HTTP Proxy, I am thinking about terminating SSL, on either the outer firewall - so the WAF can insect the layer ...
3
votes
0answers
80 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
3
votes
0answers
14 views

How can I improve and secure automated signing?

Automated signing of files, such as software packages or file backups, is inherently risky if a certain level of trust is given to it. Having signing be an automated process means that there's no user ...
3
votes
0answers
46 views

Bypass Stack Canary by going past the return address

I was testing a simple C program with stack canary protection. I attempted to bypass the protection by overwriting past the function's return address and overwriting main's address. I am overwriting ...
3
votes
0answers
34 views

NMAP host discovery reporting discrepant results between NAT and Bridged mode

I figured this would be the most relevant place to ask this question. I'm using a Kali VM to run some network scans. The results are different depending on whether my network interface is bridged or ...
3
votes
0answers
32 views

What if the voting machine is the adversary (Distributed Knowledge/Trust)

I read some e-voting questions here, but most deal with simple things like securing the connection from external attackers. But they usually put implicit trust on the central voting authority to be ...
3
votes
0answers
89 views

C program - exploit program (after seg fault)

The program below takes three parameters - Base to convert from, base to convert to and the number to convert in binary As part of learning security - I am trying to buffer overflow this program. I ...
3
votes
0answers
137 views

Different IPv4 numbers from different browsers, same computer

If I search on Google the words "my ip" using Firefox, Google returns a IP that belongs to my ISP: About 447,000,000 results (0.46 seconds) 200.x.x.x Your public IP address But, if I made the ...
3
votes
0answers
92 views

What is the best way to lock down web service access permissions?

After everything what I did in order to protect my server, i have uploaded webshell (WSO 2.1 Web Shell) , to see how far can hacker go and gues what, I was shocked, because I was able to read very ...
3
votes
0answers
70 views

Broadcasting 10k SSIDs

How hard would it be, and or is it possible, to configure a router or PC to broadcast ten thousand SSIDs. If it is possible what repercussions would it have? Would this be a form of DOSing or is there ...
3
votes
0answers
24 views

using “mount -o bind” in chroot

I have to provide a few, reasonably complete, chrooted ssh accesses to a very small system where disk space is at a premium. I was considering doing something along the lines: mkdir -p newroot/usr ...
3
votes
0answers
50 views

Are there any C++ STL alternatives which is bulletproof against timing attack?

Just out of curiosity, I wonder if there are any packages of popular algorithm/data structures which are secure against timing attack. I think GNU libstdc++ std::string::compare(), std::unordered_map ...
3
votes
0answers
28 views

Is there a term for the combination of principal and credential?

In an API that needs to take a principal and a credential as arguments, what is the pair of those two pieces of information commonly called? FFW Apache Shiro seems to call this an AuthenticationToken....
3
votes
0answers
34 views

Does using the client keep the Keybase server honest even if you also use the web interface?

According to Keybase's documentation: [The] keybase clients in the wild play a crucial role in keeping the Keybase server honest. They check the integrity of user signature chains, and can find ...
3
votes
0answers
136 views

How do i know when IPSEC Phase 2 Has completed with Openswan?

When I bring up a connection using openswan I get the following output but I don't see any ESP traffic through ports 50, 500 or 4500. # ipsec auto --up globacom-vpn 104 "globacom-vpn" #44: ...
3
votes
0answers
58 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
3
votes
0answers
118 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
3
votes
0answers
223 views

ADFS 3.0 OAuth2.0 against client applications

ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets. Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a ...
3
votes
0answers
37 views

How to check if redirected site like OAuth is genuine?

One common security advise is to open sites only from bookmarks (see also Explain to non tech savvy person how to check that your connection to mybank.com is safe? ). This approach fails if a site ...
3
votes
0answers
37 views

Where could the iOS security key be stored on the hard drive, *if printed* when enabling 2 Factor?

Apple allows people to print out their recovery key when enabling two factor. Taking the assumption that the local spooler may not do a great job of protecting, secure erasing, and eliminating traces ...
3
votes
0answers
232 views

Security for Hospital IT

I'm developing a program in Java intended to be utilized in a hospital. The system uses RMI internally between workstations and the server program. The program would be installed on the hospital's ...
3
votes
0answers
77 views

LUKS key not available immediately after 'cryptsetup luksFormat'

I'm trying to create a file that will serve as a LUKS filesystem, with cryptsetup 1.6.1 under Ubuntu 14.04 LTS. This is what I'm doing: $ dd if=/dev/zero of=rfs bs=1048576 count=4 $ sudo cryptsetup ...
3
votes
0answers
266 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
3
votes
0answers
76 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
3
votes
0answers
38 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from aerodump-ng). I'm ...
3
votes
0answers
53 views

ASCII Armoring in a little endian system

With regard to the question: How does ASCII-Armoring help to prevent buffer-overflow attacks?: How the armored region prevents the attack? If the most significant byte of the return address is 0x00 ...
3
votes
0answers
60 views

Can I do an enveloping XAdES signature on binary content?

I need to sign some binary content (scanned documents) with a digital signature compliant with European norms, CAdES - XAdES. One option would be to use this library to do a XAdES signature. Is there ...
3
votes
0answers
52 views

Certificate and Path validation for S/MIME

I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My ...
3
votes
0answers
262 views

How is PasswordSafe different from KeePass/OtpKeyProv?

Over at Does adding two-factor authentication by OTP really make KeePass more secure the top answer unmistakably states that KeePass is not made more secure by using an OTP. I told a friend I was ...
3
votes
0answers
72 views

Security risks with iframe widget for different tools

We are building user profiles which can be embedded in client's websites. We are embedding those as iframe in client's web with user's id as parameter to iframe URL. We have authentication token to ...
3
votes
0answers
78 views

How does a Sign tool work?

My basic understanding of how a sign tool works is: Load the zip-file (may be exe, jar, ddl, apk, etc.) which has to be signed to its memory (cache memory of the sign tool). Verify it and unzip the ...
3
votes
0answers
31 views

Secure IIS website from unauthorized writes

I am setting up windows EC2 server. I have created a website in that server using IIS. After creation IIS, assign them pool by default whose identity is ApplicationPoolIdentity. Website works fine. ...

15 30 50 per page