3
votes
1answer
36 views

A certificate site name mismatch when using preinstalled Toshiba software? (Superfish?)

On my Toshiba laptop there are a variety of different Toshiba programs that came pre-installed. Many of them are some sort of utility, optimizer, checkup, and update kind of programs that I guess are ...
1
vote
1answer
32 views

Getting started with biometric locks?

I am not sure if this is the place to ask this question and if it is not, i would really appreciate it if you could direct me to the right place. I wanted to understand the functionality and the ...
30
votes
6answers
19k views

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET: ...
-1
votes
1answer
51 views

What encryption algorithm does CryptEncrypt in Crypto API use?

I am writing a code to perform encryption and decryption using CryptEncrypt and CryptDecrypt functions, a part of Windows' Crypto API. Can anyone tell me what kind of encryption these two function ...
4
votes
4answers
36k views

IP address of an iPhone

Recently I logged on to my bank account via the Chase app on my iPhone. I received a message that another device was currently logged on to my account and "would I like to end the session"? Of course, ...
0
votes
2answers
232 views

Will gmail close my well intentioned botnet account? [closed]

I'm part of a company that has at least 1000 PC's distributed in different buildings over a radius of 25 miles. I've been asked to make a program to survey technical information on each PC. Since ...
22
votes
2answers
3k views

Does browser 'view-source' mode avoid scripting attacks?

Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts. Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at ...
1
vote
1answer
31 views

Authenticity of PDF document printed from Word

My MS Word Add-In generates PDF preview of DOCX file on client PC and uploads both files to server. I cannot generate PDF on server. Is there any way to make sure that the PDF is the printed version ...
1
vote
1answer
403 views

Is there a secure way to share sessions in the same server with different sub domains?

I'm studing a case that I have a RESTful backend (php-based) and a hybrid HTML+JS+PHP front-end in different subdomains: backend.example.com <-- A RESTful API to provide some XHR requests. ...
-2
votes
1answer
37 views

Issue regarding vulnerability of cookies [on hold]

If someone somehow manage to copy all the cookies from my PC,can they be misused to get my private information or can information extracted through them? If yes,Please suggest some counter measures. I ...
25
votes
11answers
6k views

Can 'cracked' product keys harm the user in any way?

If a user download commercial software through the official, corresponding website, but use a product key which you did not legitimately purchase (e.g. websites that offer a list of product keys for ...
0
votes
2answers
115 views

intercepting AJAX request and response using BURP

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here. The ...
2
votes
1answer
53 views

Mysterious Incoming/Outgoing Packets on my Wireless Connection

Right now I am connecting to my work server as usual and during my connection through the VPN I always monitor the network ping through terminal and its always between 70-90. It usually never goes up ...
1
vote
2answers
74 views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
0
votes
0answers
21 views

Hack Laravel based website using sqlmap [on hold]

I am currently building a website using Laravel Framework (PHP). Using sqlmap to test the safety, however it seems that that Laravel has already covered this. Has anyone tried methods/parameters to ...
1
vote
1answer
49 views

Tracing stolen android tablet via MAC address [on hold]

I lost my tablet , but I can see that the tablet is connected to the network on my router: :So I know the MAC address but I am unable to trace my tablet using this information and I am running out of ...
1
vote
1answer
27 views

Difference between Architecture review and a Design review

As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a ...
-1
votes
0answers
26 views

Which version of OpenSSL i should upgrade? [closed]

we are having a Redhat linux server network proxy server [Apache http] with openssl version standing on [jae@myserver~]$ openssl version OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I am planning to ...
1
vote
0answers
66 views

BEAST some misunderstandings

I was reading this document about the BEAST attack discovered by Thai Duong & Juliano Rizzo, there is two points a cannot understand. At the section 5 - Application: Decrypting HTTPS Requests, ...
-1
votes
0answers
33 views

Computer Security [on hold]

In the ideal block cipher with 64-bit blocks, there are 2^64! possible keys. How many bits one needs in order to represent the keys in binary? Show your calculation steps.
1
vote
1answer
83 views

How can I tell if a user is access website with a forged IP?

there is a username (USERX). It's a suspended user. It it appearing in my user login files. It always appears in the middle of someone elses attempt (USERA) to reset their password, and WITH USERA's ...
0
votes
0answers
39 views

What is basic Digital Forensic Hardware? [on hold]

Last a few months, I wanna setup a small lab about Digital Forensic. So I searched which hardware device need for my small lab. I cannot imagine about that which device need for my digital lab and ...
0
votes
2answers
93 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
2
votes
2answers
88 views

Is VPN the best solution against man-in-the-middle attack? [on hold]

I'm looking for the best way to protect my enterprise against man in the middle attacks, because a lot of people connect to the same network. So I was thinking of creating a VPN. Is this really the ...
1
vote
2answers
185 views

haproxy with client certificate authentication signed by 'common' CA

Excuse me if I posted this here wrongly, I know the question is partly about haproxy itself. I am setting up haproxy as an SSL terminator/load balancer in front of an API that we need to expose over ...
14
votes
1answer
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
2
votes
1answer
66 views

What is a key-hardened hash?

I've seen the term 'key hardened hash' used to describe a recommended way to tighten up password hashing. What does this mean? Can it just mean to use a pepper?
0
votes
1answer
44 views

Android - recover encrypted images

I have nearly 0 understanding of encryption, I just want to recover my old photos. In my old Android phone I used a certain photo-video locking app to encrypt my images. Images were stored on SD ...
0
votes
1answer
140 views

Post from HTTPS to HTTP

If a server posts a message via HTTPS to another server that does not have HTTPS enabled, will that message still have been sent encrypted? For example, a message from https://example.com to ...
1
vote
1answer
189 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
0
votes
1answer
14 views

Double socket connection

I'm busy experimenting with TCP socket connnections. I have made a client SOCK_STREAM socket andi've got a few questions: Is there any way that a streaming(TCP) socket can get data from another ...
1
vote
5answers
121 views

How can I stop this remote attack?

Someone appears to be logging into my machine remotely, I am running Avast anti virus with Comodo Firewall both report no attacks.I only noticed this because on my router security logs I see the ...
47
votes
4answers
2k views

What is the point of gibberish spam

I fairly often happen across forums spammed with messages such as: Arugula (Eruca sativa) is an quarterly green, pretended or roquette. It's been Traditional times, overclever 20 flat has be ...
1
vote
1answer
2k views

any information about en.quiente.info who has visited your account website

I ran across this site http://en.quiente.info, my friends tried it and they say it worked for them. It asks for most of the privileges on facebook even sending messages on behalf of you. Any one has ...
5
votes
2answers
247 views

openssl enc uses md5 to hash the password and the salt

Wikipedia states that md5's collision resistance is 2^18 (https://en.wikipedia.org/wiki/MD5). I just found out that openssl enc uses md5 to hash the password and the salt. Let's assume that I want ...
2
votes
1answer
53 views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
0
votes
1answer
51 views

What these Wireshark screenshoots should demonstrate?

I'm reading an article about the recent Github DDoS with traffic comming from non-chinese Baidu users here. There are two Wireshark screenshoots in the middle of the article with arrows pointing to ...
0
votes
1answer
16 views

General concerns with cookies and privacy

The following post is in regards to headless *nix machines only... I know programs like wget allow options to control cookies. However if a program is not HTTP centric, has little or no options for ...
-5
votes
0answers
38 views

Is someone using my PHP script? [on hold]

Well I've made a forum in PHP from scratch and I'd like to share it online. I'd like to know if there's any way to figure out if someone's using my script.. Basically I'd like to know how many people ...
1
vote
1answer
132 views

Preventing CSRF attacks against websocket communications

I have read the thread about CSRF attacks in websockets (Do websocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket ...
0
votes
1answer
3k views

SSL mismatch error using ISP-provided IP address but not VPN IP address

I keep seeing error messages reporting issues with SSL (Chrome, IE, Mozilla) when clicking on links in the YAHOO homepage to stories from different YAHOO sites (screen, autos, movies, hsrd, etc.) ...
0
votes
0answers
10 views

How can i make Digital forensic Images with Vmware?

My tittle did not complete. I will explain as a wide view. How can i make Digital Forensic Images with V-mware, Virtual box, V-sphere for practice digital forensic. and then how can i add various ...
0
votes
1answer
24 views

What exactly is meant by serverAuth and clientAuth

I'm building a network that will allow employees and customers to access the company systems. To that end I'm using a Linux 7 server as a firewall/authentication server. Initially for test purposes ...
26
votes
3answers
6k views

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if ...
0
votes
2answers
320 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
1
vote
2answers
164 views

session security in php

This has been asked a bunch of times. I am just curious to see if the below code provides a fairly significant level of security. Are there any other cases I should consider? Below is just an ...
0
votes
1answer
50 views

Storage on Root CA and intermediate CA certificate on Embedded device

Regarding the storing of Root CA certificates on an Embedded device Setup Explaination: 1. An embedded device which is a CLIENT on the network 2. There is a SERVER which connects to the CLIENT on ...
0
votes
2answers
25 views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
0
votes
0answers
17 views

Wireshark TLS Handshake shows version as TLS 1.0 and TLS 1.2 both [duplicate]

As you see below in the image, wireshark screenshot shows TLSv1.2 Record Layer : Handshake Protocol, but version attribute's value is TLS 1.0 Why does wireshark shows version as TLS 1.0 and TLS ...
0
votes
2answers
49 views

Is End to End security possible without physical contact?

I noticed that a lot of messaging start to provide "End2End" security, but I wonder how this can be possible without a key exchange between the the two clients. To my understanding to provide real ...

15 30 50 per page