1
vote
2answers
50 views

Open Source Security Dashboard? [on hold]

I'm looking for an open source security dashboard that gives a basic overview of security warnings. Google has pointed me in a few directions but nothing promising. I need something to deal w/ selinux ...
2
votes
1answer
119 views

What are the security implications of pairwise master key caching in Wireless Networks?

I'm currently investigating WPA2 enterprise security options, and I'm curious about PMK Caching. I've found lots of vendor information about it, and understand that the client does not need to ...
2
votes
1answer
57 views

How to establish a random OTR remote party as a specific individual?

In reading Glenn Greenwald's 2014 book No place to hide, one thing stood out to me as a bit odd. Greenwald details how Edward Snowden was insistent that Greenwald install PGP in order to communicate ...
1
vote
3answers
121 views

Replacement for DVL (Damn Vulnerable Linux)?

I've recently spotted that DVL (Damn Vulnerable Linux) has gone inactive. My first question is what happened to cause them to stop releasing it? Secondly, I have found some references to other ...
16
votes
4answers
2k views

Should I use own constants when using well known hashing algorithms?

I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the ...
2
votes
1answer
40 views

Security of PDF reader software

Are there any studies regarding the security of PDF viewer software from different vendors? I try to find the most secure reader.
1
vote
2answers
119 views

So, how dead is antivirus exactly? [on hold]

Symantec recently made a loud statement that antivirus is dead (http://online.wsj.com/news/article_email/SB10001424052702303417104579542140235850578-lMyQjAxMTA0MDAwNTEwNDUyWj ) and that they don’t ...
0
votes
2answers
40 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
11
votes
4answers
3k views

Processor microcode manipulation to change opcodes?

I had recently thought of an extreme way of implementing security by obscurity and wanted to ask you guys if it's possible. Would a person with no access to special processor documentation be able ...
1
vote
0answers
34 views

Squid proxy and VPN software

I have some questions about squid proxies, in my office , IT guys set a squid proxy server to block certain web sites for users. and some users only can access one website that related to our work. ...
0
votes
1answer
67 views

How to delete YouTube zombie cookies

Some days ago I noticed that YouTube knows the videos I watched even though I deleted my cookies. I also was not using a YouTube-account. When I noticed I used IE 11. After some research I found out ...
1
vote
2answers
71 views

Are input fields that don’t have name=“” sent via the browser [on hold]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
15
votes
3answers
66k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
0
votes
0answers
28 views

Is threr any artifacts for filesystem forensics in memory?

I have a memory dump I know it is infected by a rootkit use its own filesystem installed at the end of the disk, is there ny artifacts in dmp file to show this? thanks
0
votes
0answers
10 views

security issues with OOXML of POI

I read the announcement today related to security issues with OOXML. These issues are fixed as part of 3.10.1 version (issue : CVE-2014-3574 and CVE-2014-3529). However it does not list which all ...
0
votes
1answer
25 views

Does Kismac work on MacOSX 10.9+? [on hold]

Hi I am trying to get Kismac working. I downloaded the r407 version from here (http://trac.kismac-ng.org/wiki/Downloads) but when I scan for networks I get a never ending sceen saying "Loading Apple ...
4
votes
3answers
1k views

Is this an attack and how can I fix it?

I don't know where to start in searching the forum for existing threads that might cover my issues. I recently received a spoof email pretending to be from a client for whom I've just started to do ...
-5
votes
1answer
77 views

How to decrypt the encrypted data, in SHA256, of mysql database? [on hold]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
0
votes
1answer
25 views

Limiting account access based upon NIC used to connect on Linux

I have a server which has multiple NICs (ignoring redundant pairs): 'inward' facing production (connects to other servers); 'outward' external facing production (connects out to the internet via a ...
0
votes
1answer
123 views

UAC bypass approaches

I am looking for a technique for bypassing UAC. Here are two solutions that I found on Google, but I need a different solution: Bypassing UAC with User Privilege under Windows Vista/7 Advantages ...
0
votes
2answers
93 views

Blocking access to social media on Windows

I would like to block websites like Facebook, YouTube and other social sites as part of my job and would need your advice on how to manage that. There are about 120 PCs in the building. Is something ...
0
votes
2answers
70 views

What would cause a server to only send over 1 SSL certificate to a client?

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
2
votes
1answer
65 views

My Lantern cloud server has a domain name that looks like typo-squatting, should I be worried?

Lantern is an app to avoid censorship. It is hosted at getlantern.org. I just noticed that the cloud server my client is using is actually roundrobin.getiantern.org Notice the i in getiantern ...
-3
votes
0answers
33 views

how to restrictions and Admin/Users right on PC? [on hold]

Hello Dear IT Friends, I would like to create a restriction and admin users rights on PC's for everyone. Because they are making some changes in the system, installing a softwares and PC's has always ...
0
votes
2answers
104 views

how to null out a insert statement?

I am doing a SQLi-Quiz. Below is the orignal statement. insert into users(name,pass) values('bob', [injection point here]) The statement is heavily filterd because the website which supplys the ...
0
votes
0answers
25 views

How to build the End-to-End GPG extension for Chrome [on hold]

In June 2014, Google announced work on a Chrome extension for Gmail to provide End-to-End email encryption using GPG. Has anyone managed to build this extension? I've followed the build instructions ...
-5
votes
0answers
30 views

BARCODES modern web injection payloads [on hold]

I was searching for advance XSS attack payloads and I found that we can use barcodes for xss and sql injection payloads... may have some information from this link ...
2
votes
3answers
120 views

Free second-level domain SSL certificate [on hold]

With CAcert.org losing trust in browsers and OSs and StartSSL providing only top-level domain certificates, are there any free SSL certificates providers for second-level domains?
5
votes
3answers
93 views

Is SESAME really used in Europe?

I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
2
votes
1answer
138 views

Is encrypting something more than once safer than hashing more than once?

I am aware of the implications that hashing something more than once correctly will increase the security of a system, but doing it incorrectly will decrease it, as noted here and on various other ...
1
vote
2answers
45 views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
11
votes
7answers
2k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
5
votes
3answers
328 views

What exactly determines what version of SSL/TLS is used when accessing a site?

If I click on the little lock icon in Chrome it says that the site in question is using TLS v1. I also checked using openssl and was able to hit the site using TLS1, SSL2 and SSL3. From what I ...
2
votes
1answer
38 views

Possibility of using CA as an attack point by governmental organizations under their pressure

I was always concerned about the model of trust behind CA stuff we use . Well, for most of us, it is OK to trust them, since they are reliable organizations with a bunch of solid experience. ...
1
vote
1answer
51 views

How to tell computer of origin sending email messages? [duplicate]

I’m not a security expert. I wasn't sure if I should post this question here or in "exploit". I have searched for answers before posting.... Could anyone tell me how I can determine if emails are ...
1
vote
0answers
34 views

Shared clipboard on Linux without keylogging, etc. vulnerabilities?

X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using ...
-1
votes
0answers
25 views

Considerations for distributed authentication with online/offline app?

I am developing an application that will exist across three groups of machines: 1) A central web server. This is a publicly available site accessible via http. 2) Browser-based clients. Any number ...
1
vote
2answers
46 views

What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?

Do these 2 terminologies refer to the same thing? https://www.owasp.org/index.php/Source_Code_Analysis_Tools http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET Some of the ...
1
vote
4answers
186 views

Protecting Password in Code

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, ...
1
vote
1answer
40 views

Could I counter SiteKey MitM attack with user-agent identification?

I find it very strange that bank use service like SiteKey without user-agent identification. This still makes them very vulnerable to MitM attack which is exactly what they are trying to protect ...
-1
votes
2answers
76 views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
2
votes
0answers
24 views

SAML 2.0 IdP metadata security

Identity Providers (IdP) often provide a metadata file that is used when setting up SAML. This file needs to be entered into a Service Provider (SP). Do we need to keep this metadata file private and ...
0
votes
1answer
27 views

Is PHP FILTER_VALIDATE_IP secure enough to $_GET an IP address?

I need to pass an IP to a PHP page, and it would be convenient to be able to use GET, but I know that's sort of asking for trouble, so I want to triple-check that I'm handling it securely. ...
1
vote
2answers
81 views

File SHA256 checksum failed, but OK on reboot

I downloaded the Windows installer (.exe) for ImageMagick via http (both http and ftp downloads are provided at http://www.imagemagick.org/script/binary-releases.php#windows). Upon executing the ...
-5
votes
0answers
60 views

i am using college lan. What can i do to ensure maximum lan security? [on hold]

What softwares should i use? What are the best 5 methods to implement lan network security?
3
votes
4answers
2k views

How can I generate custom brute-force dictionaries?

I have found during testing that companies often use variations of their names for critical passwords (for example Microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc). So if I gave it the ...
1
vote
4answers
152 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
0
votes
1answer
54 views

XSS echoed in pages html code but no pop up window

So i have a https login page with standard username and password inputs. I put in simple xss test such as, alert(‘XSS attack’) the page displays a "credentials you have supplied are incorrect" ...
1
vote
1answer
36 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
0
votes
0answers
19 views

Which OWASP modsecurity crs version to install on apache 2.2.22

Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7 First I ...

15 30 50 per page