0
votes
0answers
38 views

I may have been compromised, now what?

How to trace and single out this Malware in Browser Extensions? Chrome/ Opera? I had installed the extension mentioned in the thread above. It contained Malware the redirected Java functions mainly. ...
0
votes
0answers
16 views

Is it possible to hijack any cookie based session by sending the PHPSESSID cookie of a user in a request?

Assuming that someone - gets the PHPSESSID (session cookie of a PHP based application) of a user for a web application. and tries to hijack within the expiry time of a cookie (Goes to any ...
0
votes
0answers
10 views

How does XAdES-X-L compare to RFC4998 Evidence Record Syntax

This SE question describes a scenario I don't fully understand the use case or how 4998 can help correct the issue. How and when should XAdES-X-L be used, and where should RFC4998 be used?
2
votes
2answers
57 views

How can I search for registered domains, but not unregistered domains?

There are many many services available to "search for domain names", but every one I have found returns results for unregistered domains; whereas I would like to a wildcard search for registered ...
1
vote
1answer
37 views

How to use TPM to identify a computer for licensing purposes

I've been comissioned to use TPM to add a licensing system to an existing software project. The idea is to use TPM to uniquely identify the computer (that runs GNU/Linux, probably CentOS/RHEL/Fedora) ...
0
votes
0answers
19 views

Level of security TPM2.0

How secure is it to seal only to PCRs 0 and PCRs 2-7 with fTPM 2.0? My device does not support Intel TXT, so I am unable to extend the chain of trust to implement DRTM, and thus cannot use PCRs 17-22....
0
votes
1answer
84 views

What are the advantages of cloud-based firewalls? [on hold]

What are the advantages of firewall based on cloud? Does it cause heavy traffic and make it slower? If it does, is the impact significant? A firewall based on a cloud, as I understand it, will ...
2
votes
2answers
108 views

What is the meaning of this possible malware?

My hosting service was helping me to identify a problem, and we found the following possible malware (which, of course, we have removed). Unfortunately, I'm not terribly technical, and so I am ...
1
vote
1answer
21 views

Instant signin links for users from trusted third party sites

I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
1
vote
0answers
46 views

Employee home OSX laptop was stolen. How can I determine if the laptop was encrypted?

A non technical employee has had an OSX laptop stolen. 1) What technical approaches (iCloud verification) 2) What Questions should I ask the user to determine if the laptop was encrypted. (boot up ...
0
votes
1answer
35 views

Is there a method to decrypt *.p7m file without key?

I need open .p7m message from my old PC, but I lost my old certs. Is there any method how to decrypt it without key?
0
votes
0answers
12 views

Backup and restore SRK from/into TPM device

Is it possible to store SRK (Storage Root Key) into the file (blob) and restore it from the blob back into the TPM? The question assumes that this operation must be performed on the same TPM device. ...
1
vote
0answers
41 views

How secure is the native browser password autofill?

Safari, Chrome, Firefox, Edge, and IE all either have a suggest-password feature, or password archival feature. How secure are these passwords when stored on a computer? If replicated, how secure ...
0
votes
0answers
12 views

How to enumerate smartcard logon attempts in Windows?

I need to provide my users with feedback when they log on at their workstations. This feedback needs to include: Date/time and workstation id of last successful login Number of unsuccessful login ...
0
votes
0answers
10 views

How can I decrypt data stored using the android KeyChain API? [migrated]

I have an android application that stores secrets using the KeyChain API. I have root access, and I know all of the credentials for the device. I should theoretically be able to decrypt the files ...
1
vote
3answers
56 views

Is it secure to have only https binding in IIS?

I have an API that I want to be accessible only by HTTPS. I know I can use URL-rewrite to force a redirect, but don't want to install additional modules. I was wondering whether only providing an ...
0
votes
0answers
17 views

Risk from browser add-ons?, from external sources [duplicate]

Can a user agent switcher read my passwords? what if it is not mallicious but weak, could it be a faultline for others to hack me?
2
votes
0answers
21 views

Restricted bash circumvention via SSH command execution [migrated]

There seems to be a trivial rbash circumvention, whereby an SSH user can simply request that bash be executed. The environment consists of a restricted $PATH, with a tiny subset of commands available....
0
votes
0answers
20 views

Mobile access is blocked on wireless router [on hold]

My corporate wireless router has blocked mobile devices to connect to it and access internet. I can connect my laptop to the wireless and get internet access. But I want to use internet on my mobile ...
0
votes
0answers
19 views

sql - Select boolean strictly true [on hold]

I want to select a row Ad as boolean which is strictly true. I am using the following SQL statement. SELECT 'user' AS username, 'pass' AS password, true AS Ad FROM users LIMIT 1; However the above ...
3
votes
4answers
944 views

Convert SHA-256 to SHA-1 and MD5 - Increase bit length/entropy? [duplicate]

I know this is a real dumb question and I am certainly talking complete rubbish, but let me explain: We have a long SHA-256 hash, e.g.: ...
1
vote
0answers
36 views

AES256 key exchange

I'm trying to get a secure way of exchanging keys between my client application and the server. The goal is to encrypt all XML messages with AES256. These XML's will be transferred to the server ...
0
votes
0answers
13 views

DNSSEC implementation questions (BIND 9.10)

I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual. How can I use the same ZSK with ...
0
votes
0answers
18 views

viewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem

I am facing the problem "MyViewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem"- i have successfully completed my task and all are working fine. Issue ...
0
votes
4answers
159 views

How to block all porn websites from firewall?

I want to block all porn websites and similar contents in my Windows 7 PC using Windows firewall. Till now I can block it by inserting sites one by one. Is there any category defined for such sites or ...
1
vote
2answers
79 views

SQL injection to login when there's no record in the database

I have a question to solve. Well there's no records of username and password in the database and so one cannot Log in without inserting any records. Is there anyway to exploit the following code and ...
0
votes
0answers
13 views

How to tell whether a 802.11 DATA packet uses WEP or WPA?

i am playing with the 802.11 header, trying to figure out the encryption type of incoming 0x08(DATA) packets. 1) I capture the 0x08 type packet (DATA). 2) I find out that a WEP bit is set (2nd ...
1
vote
2answers
48 views

Does PCI-DSS require that the telnet client be uninstalled from a server

Often(not always) I see with my clients' PCI vulnerability assessments the telnet client being installed coming up as flagged, for both Windows and Linux based servers. I understand why a telnet ...
0
votes
1answer
70 views

How can I trust a mobile app? [on hold]

Nowadays we are putting a lot of trust in mobile apps in order to survive in a globalized society. We are even under a kind of peer pressure which madly drives us to use these new applications. One ...
3
votes
1answer
285 views

How to trace and single out this Malware in Browser Extensions? Chrome/ Opera?

There have been lot of articles about legitimate chrome/ opera extensions that get sold out to malicious parties that end up pushing the wrong kind of code down the pipe, since by default these ...
0
votes
0answers
16 views

Log access to one specific file [migrated]

Newbie here, so apologies in advance if my ignorance outshines your brilliance. In my small business, we have a very basic network (4 PC's running Win7). We have a virtual drive on one system that ...
0
votes
0answers
7 views

Sending Probe Request Frames | Receving Probe Response — Scapy

OBJECTIVE Send probe request frame subtype=4 and receive probe response subtype=5 with Scapy Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames ) The object ...
-3
votes
1answer
67 views

Logging into another another person's account [on hold]

There were instances in the past where I logged in with my own credentials, but it showed me as a different user after logging in. How does this usually happen?
-3
votes
1answer
45 views

Which WYSIWYG editor has the best security reputation? [on hold]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
4
votes
1answer
46 views

If my company receives credit card statements showing credit card number, does it have to be PCI compliant?

I understand PCI requirements on the storing, processing and transmitting of credit card information (PAN, expiration date, no on CVV, etc.). However, I found nothing about receiving PAN (no ...
0
votes
0answers
24 views

Authentication in WPA from a user's perspective

I have read several articles that discuss the differences between WEP and WPA but I haven't seen an answer to my question, which is : How is the authentication used in WPA different from that used ...
3
votes
1answer
35 views

Security of “secure messaging” services

There are multiple vendors that offer so-called "secure messaging" services, designed to allow secure e-mail without the need for technology such as PGP, S/MIME or strict TLS between mail servers. The ...
0
votes
2answers
40 views

session credentials on the client

I am developing an IE11 based application running on a web server inside our corporate network The application makes calls to a 3rd party API which requires client certificates and username/password ...
0
votes
1answer
75 views

View the access code, access token, and id token from Google during an OpenID Connect flow

Situation We're wanting to use an HTTP logger/proxy/analyzer to inspect the access code, access token, and id token that are part of the code flow. The flow is happening among Google (the ...
0
votes
0answers
4 views

Can I wipe a password reset disk? [migrated]

Say I made a password reset disk. However, I found it best not to exist, I remember my password quite well. Now, how do I make sure that Windows doesn't prompt "Reset password", make the disk blank, ...
28
votes
5answers
5k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
2
votes
3answers
75 views

Can attackers leverage a sites SSL to “hide” attacks from a IPS?

I am running an IDS on the outside of my firewall (I know not ideal) and an IDS on the inside of my LAN running the same detection algorithms and definitions. My website auto redirects all HTTP ...
1
vote
1answer
32 views

Is Telegram E2E Still Insecure?

This was already asked here, but I have questions about the answer. http://security.stackexchange.com/a/49802/118071 I'm not sure if that answer applies to the full E2E mode. Another answer states: ...
1
vote
2answers
39 views

HTTP session fixation

According to wikipedia, Mallory the attacker gets her own SID and then forces Alice to visit a site with the SID. Why wouldn't Mallory just take Alice's SID, if she could MITM Mallory? Also, is this ...
0
votes
1answer
69 views

How to create a server certificate from a letsencrypt.org certificate?

I have created a letscrypt.org certificate using letsencrypt run which works fine as a SSL certificate on apache2. How can I create another server certificate signed (and thus trusted) by the ...
0
votes
0answers
8 views

How should I manage the output of Scallion?

Scallion outputs a large XML file (depending on your regex settings). What is the most sensible way to sort, and prioritize the best names for the public key? For example, I would need to convert ...
1
vote
2answers
70 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
3
votes
3answers
115 views

What can be done to secure passwords that might be stored in plain text or hashed inside a git repository?

I've heard a lot lately about coders being really bad at security. For one they store passwords and sensitive information inside Git repos which are often not secured well enough. Someone then comes ...
0
votes
0answers
37 views

How do I decrypt Facebook's Messenger SSL traffic on Android?

I would like to investigate the Messenger chat protocol, and to do so i need to see it in clear... I've been able to successfully sniff the (not encrypted) traffic with the 'Shark for Root' but it ...
-4
votes
0answers
13 views

How do provide the android sandbox security to application? [on hold]

I want to know what is android sandbox security and how implement it in application? I want to provide the internal security to application so no other application can check the memory status and ...

15 30 50 per page