-5
votes
0answers
40 views

What are some good Books on Web Application Security Testing? [on hold]

I am a black-box tester. I primarily test functionality of Web applications/sites. I want to move into the Security testing domain. Please suggest some practical and useful Books/Tutorials and free ...
22
votes
2answers
2k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
5
votes
4answers
500 views

What is the role of RSA in ECDHE-RSA? [duplicate]

I have read some textbooks and not found a convincing explanation. In the cipher suite ECDHE-RSA-AES128-GCM-SHA256, what is the role of RSA in the first part (ECDHE-RSA)? This part of the cipher ...
0
votes
0answers
25 views

Is jasypt safe to use for two way encryption?

This question here suggests using jasypt as a two way encryption for passing a password through a webapp to a database. The question is - I guess absent of modifying your source code (ie. because ...
1
vote
2answers
26 views

IPSEC - Remote Access Clients, Tunnel or Transport Mode?

I understand that transport mode encrypts only the payload. Do IPSec clients such as Cisco's AnyConnect and/or Cisco VPN Client use transport mode? Or do these clients and others like them use ...
0
votes
0answers
54 views

GoDaddy website hacked via PHP? [on hold]

So recently I opened the FTP account for a GoDaddy shared hosting website to find a few unusual PHP files scattered throughout various folders. The PHP code (which was highly obfuscated) eval'd code ...
1
vote
1answer
49 views

SSH Key: Ed25519 vs RSA

A lot of people recommend using Ed25519 instead of RSA keys for SSH. The introduction page of Ed25519 (http://ed25519.cr.yp.to/) says: [..] breaking it has similar difficulty to breaking [..] RSA ...
4
votes
1answer
337 views

Responsibilities as a Junior Information Security Analyst? [on hold]

Tomorrow will be my first day as a new Junior Information Security Analyst, and I'm nervous and excited at the same time. I want to apologize if this is the wrong place to ask such questions, but I ...
0
votes
1answer
31 views

Metasploit oci8 problem [on hold]

I have troubles while installing oci8 libraries to use metasploit modules. First, I've followed the steps in here; http://ruby-oci8.rubyforge.org/en/file.install-instant-client.html Then I've run ...
1
vote
1answer
112 views

Is This DIY Password Authentication Scheme Acceptable?

This is mostly a thought experiment for client/server communication, and I want to know the flaws. When a user account is created (with U as the username and P as the password,) I generate a random ...
1
vote
0answers
30 views

Cryptographic enforcement schemes using Diffie-Hellman [migrated]

If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ...
1
vote
1answer
21 views

Centralized authorization with distributed service providers

I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization). The ...
10
votes
3answers
675 views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
0
votes
2answers
51 views

ENCASE Forensic: Detect if someone ran CCleaner or CleanUp software

I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.
3
votes
0answers
36 views

How to encrypt and authenticate large amounts of data with NaCl

In a current project the NaCl-library crypto_box function has been used to encode and crypto_box_open to authenticate and decode data. However the library does not seem to support de- / encoding of ...
8
votes
2answers
1k views

Man in the middle attack theory [duplicate]

Me and my colleague are trying to come up with a way around preventing a theoretical man in the middle attack. The scenario is: Communication is only through one channel and either sides isn't ...
1
vote
1answer
22 views

AES subkey generation operations order

I am preparing for my Information Security state exam. There is a question in preparation sheet that asks about order of operations to generate subkey for AES algorithm. Operations listed: XOR with ...
-1
votes
0answers
28 views

Multiple Clients sharing a single firewall

I'm thinking about using a Virtual firewall for the connections between my two machines. This lead me to think what are the security implications of multiple clients using the same Virtual Appliance ...
4
votes
1answer
364 views

Securing Chrome against Logjam on Windows

Is there a way to fix Chrome against the Logjam TLS exploit on Windows? I have updated my Chrome to the latest version yet the https://weakdh.org/ website warns me that "web browser is vulnerable to ...
1
vote
0answers
44 views

How can a remote attacker find a user UID via Samba?

Is there a way to remotely retrieve the UID of a user via a Samba share? I can get the user list with: rpcclient -W 'WORKGROUP' -c querydispinfo -U''%'' '192.168.21.129' 2>&1 index: 0xa RID: ...
0
votes
4answers
270 views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
0
votes
1answer
14 views

Is it safe to mount luks over cifs?

I have a server with a .img file this is encrypted with luks(aes-256,plain64,xts,sha512) Is it safe to mount this image over cifs(samba), or does doing so risk exposing the volume password or master ...
0
votes
0answers
8 views

OpenAM 12.0 IDP SOAP based SLO not working on https [migrated]

I am trying to configure OpenAM with my own certificate having alias other than "test" as per the document http://docs.forgerock.org/en/openam/12.0.0/admin-guide/index/chap-certs-keystores.html over ...
-3
votes
1answer
54 views

How can I access a site using a VPN, without them knowing that I am using one? [on hold]

I'd like to register for a website that offers services that aren't available in my location. I signed in using the VPN a few times but then they banned me. Any way around this problem?
2
votes
3answers
224 views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
0
votes
1answer
24 views

Why Use IPSEC AH vs ESP?

I am refreshing my understanding of IPSEC. IPSec is an IETF defined set of security services that use open standards to provide data confidentiality, integrity, and authentication between peers. ...
0
votes
1answer
36 views

Disable a specific services in Windows 7 [on hold]

I am using a Windows 7 and I want to Disable some Services, How can I do this? For my machine only? For some machines inside the Active Directory I can control? For all machines inside the Active ...
1
vote
1answer
50 views

RC4 encryption of torrents safety

Torrent clients offer encryption of traffic using RC4, and people consider this, like, very safe to hide traffic information from ISP. Now since I have a website with SSL encryption, I know that RC4 ...
0
votes
2answers
51 views

Is TLS v1 really secure for VOIP and video calling?

Many applications are still using TLS v1 for video conferencing and VOIP calls. Is TLS v1 really secure for video and voice & video calling? or can some one can easily snoop your sessions with ...
0
votes
0answers
6 views

Can you find the search space? [migrated]

Let A is a random number and has 512 bits.we make B from A and B has 1024 bits.Process of B is following: C=f(A) that f is hash and C has 160 bits.Then C pass in a parallel manner 7 different hash ...
3
votes
0answers
96 views

How does torrent poisoning work?

Can someone explain how torrent poisoning attacks work? I am looking for some tutorials on how to do it. What are the countermeasures that someone can use to defend themselves against it?
1
vote
1answer
54 views

Security concerns of browser injected JS

To employ end-to-end encryption, I am using a small tool that encrypts contents that is then posted and stored on our servers. While there are several concerns on client based encryption, I think it ...
0
votes
1answer
23 views

Guidelines for time for encryption key regeneration

I am looking at using a third party key distribution protocol. I do not have much details of the internals itself. However I am required to configure the time for regeneration of the (128 bit ...
0
votes
1answer
50 views

What items should be on a malware remediation checklist? [on hold]

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the ...
0
votes
2answers
95 views

LUKS HDD Encryption crack [on hold]

I need help. I actually encrypted two mouths ago my external HDD with LUKS but know i have lost my password. I am so depressed because, all of my life is on this HDD. Is there any possibility to get ...
17
votes
3answers
2k views

Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?

As far as I know, in order to securely delete the hard drive's contents, one should fill it with zeroes or, for added security and harder recoverability, random data first and then all zeroes. In ...
-1
votes
0answers
31 views

How can I debug a running process on my computer? [on hold]

Using GDB can I debug a process ID to see where a particular variable is stored in memory? Consider that: I'm running a javascript game which is running in my browser, and I'm on Kali Linux. Can I ...
2
votes
2answers
102 views

Are hashes of hashes used for password storage in practice? Why/why not? [duplicate]

A naive developers might store a password in the database directly, which would then be compared directly with the password sent from a client. A more security conscious developer might instead store ...
3
votes
2answers
305 views

What stops an SSH server from MITMing logins?

When I read this question about what gets signed with the private key by the client I wondered: What stops the following scenario from happening: A client connects to an SSH server. The SSH server ...
0
votes
0answers
14 views

Shouldn't DNSCurve be parallel to DNSSEC at root level for diversity?

As per the answer at If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?, it's been determined that one of the reasons that DNSCurve is behind DNSSEC is due to the nature of the ...
-1
votes
0answers
49 views

How does Facebook Lite send user and password when login? [on hold]

I've recently tried to sniff username and password from Facebook Lite app for Android. I checked HTTP POST packets but I didn't see any of them. It seemed like FB Lite app didn't send username and ...
0
votes
0answers
31 views

Weird drive popped up randomly [migrated]

I just had a random drive pop up as I was doing a defrag on my hard drives (windows 8.1) and I have no idea what it is or what it does. It's called: "\?\Volume{5a1f49..." what is it and is it harmful ...
4
votes
0answers
53 views

Why did browsers deprecate 1024-bit RSA, but retain SHA-1?

I was reading Mozilla's security blog Phasing out Certificates with 1024-bit RSA Keys. Effectively, some browsers are deprecating 1024-bit RSA for CAs and Subordinate CAs because the certificate must ...
5
votes
2answers
99 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
0
votes
0answers
40 views

Which remote/cloud backup solution is encrypted, works with network drives, and sends/receives data efficiently? [closed]

As the title suggests, the purpose of this thread is to find a backup/sync solution that meets several criteria related to security, efficiency, and reliability and is Windows-compatible. I've ...
1
vote
1answer
42 views

Who uses 1024-bit RSA?

I know they're deprecated, but does anyone still use 1024 bit RSA encryption or certificates? Do you know of any examples of systems that use it today? What would be the implication if someone ...
1
vote
1answer
33 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
1
vote
2answers
69 views

Rationale behind hiding originating IP address in emails?

Gmail has been hiding originating IP addresses for quite some time now. Hotmail and Yahoo have started doing this too. Apart from obvious privacy implications of revealing the sender's IP address, is ...
0
votes
0answers
33 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
0
votes
2answers
63 views

Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)

If I have the MAC address and S/N of a Lenovo 3000 Laptop, is there some way for me to find exact street location of this laptop ? This machine was stolen from me last year and was my back up machine ...

15 30 50 per page