-1
votes
0answers
39 views

How to trace an active cell phone call? [duplicate]

I have searched many websites but found none that contains information on how to trace the location of an active cell phone call. I already know that the connecting cell site and signal strength ...
0
votes
1answer
36 views

Apache 2.2 mod_ssl configuration Forward Secrecy/BREACH/BEAST/CRIME

I am looking for mod_ssl configuration which protects against common attacks like Breach, Beast and Crime. I already disabled gzip to avoid Crime but I'm unsure about the others. RC4 should only be ...
5
votes
2answers
135 views

Can Heartbleed expose a TOR user's IP address?

It is interesting to observe, that TOR exit nodes with out-of-date OpenSSL implementations can themselves be affected by the Heartbleed bug. Can Heartbleed expose a TOR user's IP address merely by ...
0
votes
1answer
29 views

Allow loopback in Iptables?

I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary. ...
-2
votes
1answer
35 views

How to decrypt javascript code extracted from PDF

I analyzed PDF, and extract javascript code. But javascript code is encrypted. I can't decrypt it. Please advise me. javascript code ...
3
votes
0answers
31 views

How does BGP filtering work to prevent routing hijacking? [duplicate]

I've been reading for a while but yet do not properly understand how is BGP filtering used to prevent "attacks" such the recent Indosat's problem. Do not copy&paste Cisco's site, I have read all ...
-3
votes
1answer
118 views

Hack into a computer through MAC and IP address [on hold]

Can I hack into someone's computer if I know the MAC address of his modem and his public IP address? Is this possible? What kind of stuff would I be able to access?
1
vote
1answer
19 views

Encrypting multiple blocks with an asymmetric scheme

I have a general question how asymmetric schemes are usually implemented. Typically, there is a parameter in an asymmetric scheme which limits the message length. For example the modulus in RSA. I ...
2
votes
2answers
118 views

How to know what personal information companies know about myself

I've been learning about Cyber Security and how to protect myself online after reading some books on the subject and I want to know how much Information i've handed out to companies.
2
votes
3answers
50 views

Wipe free space or take image and wipe entire disk?

Read some of the stuff here regarding wiping disks and securely deleting files. From what I've understood, after deleting (not securely) files they become part of the unallocated(free) space of the ...
1
vote
0answers
40 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
-4
votes
2answers
75 views

Is it legal to hack forum bots? [on hold]

I have a standard forum, currently plagued with bots. In the registration agreement, I included the following text: SPAMBOT OWNERS, YOU HEREBY WAIVE ALL YOUR RIGHTS TO PRIVACY. ANY AND ALL ...
1
vote
1answer
56 views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
1
vote
0answers
11 views

How to Compile SSL onto Cygwin for windows? [migrated]

Below is what showed when i configured. I included all of the packages in the cygwin installer (it took me forever to tick off all the "skip" boxes) `$ ./configure Starting hydra auto configuration ...
1
vote
2answers
66 views

How to make an efficient bruteforce attack on Windows? [on hold]

I've been trying to figure out a way to efficiently bruteforce on Windows, but the method I currently have isn't very efficient. I did some profiling and found out that on average it can go through ...
1
vote
1answer
39 views

Storing encryption keys on a server using Node.js and MySQL

I am writing a web backend/api for an iOS application using Node.js and MySQL. In my database I have a table for posts. I would like the posts content to be encrypted. Let's say I'm using this AES for ...
1
vote
0answers
42 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
2
votes
1answer
63 views

How difficult it is to solve a salt if knowing the original data and the hash output that uses the SHA-2 algorithm

I am reading the documentation for Kentico where it describes using hashes to validate query strings ...
1
vote
1answer
35 views

Booting into Live USB Linux

If I have a Live USB Linux stick and I plug it into a computer which is not connected to the internet and boot the computer using the Live USB stick. How secure is this interms of not leaving any ...
0
votes
1answer
29 views

Downloading list of pinned certificates

I'm thinking about implementing certificate pinning in a mobile app. The app will need to connect to several secure sites. Rather than having to update the app every time one of their certificates ...
1
vote
1answer
31 views

What is the different between CMP and SCEP protocol?

What is the different between CMPV and SCEP protocol? Which one is better ?
1
vote
1answer
32 views

Is it bad to put a certificate as CA in Firefox?

I know I can add a self-signed certificate from a website to Firefox, but only in the CA list of it. Question: does this mean I have to ultimately trust that self-signed certificate? Can someone ...
1
vote
1answer
31 views

Is it safe to use localstorage to store session variables and user password? [on hold]

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
1
vote
1answer
50 views

Why an attacker would use a trojan over a spyware?

I'm trying to figure out some possible attack scenarios for a project I'm conducting. I've read plenty of material about malware and, in particular, spyware and trojans. While it's hard to find unique ...
1
vote
2answers
91 views

Sql injection is not working on my site?

I have set up a page and database so I can practice SQL injection. Ive tried some examples and it doesn't seem to work. It seems to add the username and password to that database, even though I input ...
1
vote
2answers
46 views

Hidding ip address in a peer to peer connection

I'm curious is it possible to hide the ip address in a peer to peer connection. Mainly considering you have 2 computer connected remotly in a browser session. I would like to know if it's possible to ...
2
votes
7answers
111 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
1
vote
2answers
26 views

openssl aes 256 cbc strange bug

This is extremely strange but I have already tried this twice and am completely sure it is openSSL and not me doing the bug. I am encrypting the data 'Hygiene' with the password '*' (sorry can't tell ...
1
vote
2answers
28 views

Is there any mail service accepting real id? [on hold]

Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address. If there is a security breach, user may lost important information on that address. They may add phone ...
0
votes
0answers
41 views

Client-server authentication protocol suggestion

I'm designing an authentication methods for my client/server system consisting of: a windows desktop client application (.NET) windows/linux servers (C++) one "security server" which authorizes the ...
2
votes
2answers
47 views

Risks associated with compiling open source projects

After reading this question about if it's safer to download and compile the source for an open source project or download and run the installer, I thought of another possible vulnerability: is it ...
1
vote
1answer
34 views

DHCP Exhaustion [closed]

I am trying to look for another tool to perform DHCP Exhaustion, I currently use metasploit, but I want to see what other open source are out there. Please let me know if you use something else.
18
votes
6answers
985 views

What needs to happen for email encryption to go mainstream? [on hold]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
2
votes
1answer
65 views

Is it secure to have two password managers?

For various reasons I use both Keepass 2 and Lastpass. They have 90% the same password database. Is it secure to be using and maintaining both of them? Is it secure if they both use the same password ...
1
vote
0answers
45 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
-4
votes
3answers
136 views

How do I hack this login page by using SQL injection? [on hold]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
0
votes
2answers
74 views

How do password suites store and encrypt their metadata and prevent attacks based on that knowledge?

If someone uses a password manager and tries to organize the credentials well, doesn't that make attacks easier? Let's assume an attacker has the encrypted credentials available for offline attacks, ...
0
votes
3answers
72 views

Are backups really secure?

In many places a common practice is to connect in a backup drive at the end of the day and let the computer do an automatic backup in case of an emergency. I have been doing that for the past 2 years ...
2
votes
2answers
46 views

How do two Tor relays communicate with one another?

Nodes don't know each other's IP address right? So how do they manage to address one another when it comes to sending data?
0
votes
1answer
48 views

Is a properly configured server secure against unauthorized data access?

Take for example a game. Typically, when you buy or download a game that can be played offline, all of the data required to run the game is shipped with the executable. In order to protect these ...
3
votes
1answer
72 views

WPA/WPA2 networks cracks methods

There are some software that states that can crack WPA networks, however that is not an easy task as the initialization code for WPA2 uses a four-way handshake to properly initialize all of the ...
3
votes
2answers
67 views

How can you detect an insecure, non-random token?

I know that some of PHP's random functions are insecure due to them not being completely random and are considered a bad practice. My question is how an attacker go about finding that the developer ...
0
votes
0answers
55 views

OpenSSL Code Review

Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
1
vote
1answer
91 views

How does the NSA restrict public access to cryptography?

In Bruce Schneier's book Applied Cryptography (1994?) he writes The NSA uses its power to restrict the public availability of cryptography, so as to prevent national enemies from employing ...
-2
votes
0answers
40 views

Exploiting CVE-2013-6282 vulnerability [on hold]

On October 25, 2013, a Linux kernel bug CVE-2013-6282 was published. It was largely exploited around that time to get root access on existing Android devices. After reading tons of user review, I also ...
2
votes
0answers
22 views

Is there a way to get msfpayload to generate a regular cmd.exe reverse tcp shell? [closed]

It looks like msfpayload now generates a powershell-based payload when you pass it windows/reverse_tcp_shell. Is there a way to generate a regular cmd.exe reverse shell instead? Thanks!
14
votes
4answers
342 views
+50

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the ...
3
votes
2answers
90 views

TrueCrypt vs “native” whole-disk encryption on Linux?

When preparing to encrypt an entire partition, is it better to rely on "native" whole-disk encryption (eg following this tutorial), or an external tool like TrueCrypt? The wikipedia article comparing ...
2
votes
2answers
94 views

What prevents me from using ARP poisoning to force a client to use HTTP?

So I was just thinking about how ARP poisoning can be used to intercept a clients request, forge an SSL cert, and send it back, with the caveat of not meeting certificate validation, but what if I ...
20
votes
1answer
824 views

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following Source IP Destination IP Source ...

15 30 50 per page