1
vote
0answers
16 views

How to generate ECC (160 bits) Keys with OpenSSL? [on hold]

I have this problem: I want generate RSA Keys at 1024 bits with OpenSSL. I do this with this commands: For generate RSA Key at 1024 bits: openssl genrsa -out rsa.key 1024 For view the content of ...
1
vote
2answers
31 views

Can I change the CSR of my SSL certificate?

I have 2 SSL certificates that are generated and being used for our staging and development server. However, we wish to change the roles of these two servers. currently the staging server is using ...
-1
votes
1answer
98 views

Strange name on “shared”, was I hacked?

I use a Macbook Air 2013 and I recently noticed a very strange and long line of digits and letters under my "shared" category in finder. When I click on the name, it just says "failed to connect." It ...
1
vote
2answers
81 views

File SHA256 checksum failed, but OK on reboot

I downloaded the Windows installer (.exe) for ImageMagick via http (both http and ftp downloads are provided at http://www.imagemagick.org/script/binary-releases.php#windows). Upon executing the ...
0
votes
0answers
31 views

What are empty requests in web server log?

In enginx access.log I have plenty of request logs like this: 1.2.3.4 - - [18/Aug/2014:12:09:33 +0200] "-" 400 0 "-" "-" As you see there is neither browser specification nor any target url. I am ...
0
votes
2answers
61 views

Penetration testing preventive or detective control?

I have always wondered if penetration testing is a preventive or detective control. My view is that it is both preventive (preventive as it scans for vulnerabilities, which can be fixed to prevent ...
0
votes
1answer
49 views

blacklisted URLs: what to trust?

This website blacklists URLs: http://hosts-file.net/?s=54.244&view=history&direct=1 Its last database update has been today. When I check the last 5 URLs it published Firefox tells me they are ...
1
vote
1answer
36 views

Can location.pathname lead to XSS?

<div id="cat"></div> <script> $("#cat").html(location.pathname); </script> I think that example would work, but anyway, if location.pathname has to be a valid page, can this ...
3
votes
2answers
501 views

What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]

Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots: ...
4
votes
2answers
935 views

Extract AES key by comparing plaintext and encrypted data

Is there a kind of analysis which would enable me to get AES key which was used for encrypting arbitrary data while I have both original and encrypted version of data ? The problem is that the AES ...
-2
votes
0answers
49 views

how to tell if a user has a certain product [on hold]

I'm trying to figure out how to code a function, in which, if a user has a certain online product they can gain access to an area inside my android app. All help is appreciated, Jordan
1
vote
1answer
32 views

ECDSA/RSA certifcates and cipher selection

In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR? Also I am fairly ...
1
vote
2answers
48 views

Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)

I opened a web page using https. When I looked at the page info provided by my browser (Firefox) I saw following: Connection encrypted: High-grade Encryption ...
0
votes
1answer
23 views

Why does OpenVAS report CVE-2003-0042 when my server isn't running Tomcat?

OpenVAS reports that an Apache virtual host is vulnerable to CVE-2003-0042, which is a vulnerability in versions of Tomcat prior to 3.3.1a. The host is not running Tomcat. The detection OID is ...
0
votes
1answer
71 views

This certificate has an invalid digital signature

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. ...
0
votes
2answers
80 views

Is it bad if one uses the same email address on different sites/forums?

Is it bad practice if one uses the same email address on different sites and forums?
0
votes
1answer
48 views

Authentication of temporary worker without a badge (physical security) [on hold]

In our company we have a procedure to verify internal worker but we cannot use it for temporary worker. We cannot use badges and because of privacy reasons we cannot use any photos. Is there any other ...
0
votes
1answer
57 views

Linux file information leakage

What information is kept in a linux file about the user and/or system that created it? I want to make some files publicly available, posted on another server such as GitHub or FTP, but I'd rather the ...
0
votes
1answer
32 views

Does routing/proxying through a mobile-broadband gateway provide anonymity? [on hold]

I'm wondering if it would be possible to route your internet traffic through a mobile broadband provider gateway ( e.g. t-mobile, O2 etc ) given that you don't have any contract with them just like ...
0
votes
1answer
76 views

Strange flood of requests to my web server

About an hour ago, strange requests began showing up in my access logs. They are coming in at a rate of ca. 400 req/s and appear to come from IPs all over the place. It started out at a lover rate and ...
1
vote
1answer
44 views

Drawbacks to only using TLS 1.2 ciphers in OpenSSL

I understand you would not want to do this as it would limit compatibility for older devices and platforms. However if someone were in an all TLS1.2 environment, say a very well managed internal ...
0
votes
0answers
26 views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: ...
-1
votes
0answers
28 views

bypassing same origin policy for xss [on hold]

while looking for a vulnerability in website i found a webapp poorly coded with unfiltered user input but while creating a POC i found that any thing mentioned between angle bracket "<>" is ...
0
votes
1answer
35 views

Metcalfe's law: infuence on security of software [on hold]

One of my exam questions for the course security of network and computerinfrastructure was: What is the influence of Metcalfe's law on the security of software? I understand Metcalfe's law but I had ...
0
votes
1answer
35 views

Does Ettercap exploit the Hole196 vulnerability?

If not, how is an ARP attack possible on a WPA2 secured network?
0
votes
3answers
76 views

Why do we use such a redundant language (English) for network communication? [on hold]

I have heard throughout the internet that English is incredibly redundant. So why do we turn English messages in to a cipher which is then, from my understanding more vulnerable to letter frequency ...
0
votes
2answers
112 views

Is possible to be hacked remotely?

I little bit afraid about remote hacking, since i'm using a windows 7.i see what a hacker can do if he exploit the Dcom vulnerability in windows XP. But is this sort of exploits exist on windows 7 or ...
-1
votes
0answers
35 views

Has anyone implemented secure practices with Docker and Vagrant? [on hold]

I work in Application Security at my company, and have noticed that unfortunately, the development of applications in my company is very decentralized. Users stand up their own systems at times ...
0
votes
1answer
47 views

Smart Token Security Test

I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
0
votes
1answer
51 views

Credit card fraud preventions [duplicate]

Ok lets say some one have clone my debit card here in Greece all debit cards have and stripe and chip and lets say in a way he knows my pin and all my information and he put the info on a blank card ...
1
vote
3answers
109 views

Where can I find a list of frowned upon usernames for web sites?

There are some usernames that shouldn't be allowed to register on online services, for example: administrator, admin, root, system, owner, hostmaster, webmaster, sitename or sitenameadmin As far as ...
-1
votes
0answers
20 views

Page Access Authorization [on hold]

I'm trying to figure out how to give users access to a certain web pages based on the user having ownership of a certain file and file type. For instance, The user can't have access to the page unless ...
1
vote
3answers
105 views

BadUSB exploit - can it be prevented?

Over the past weeks I have become a fan of this stackexchange and started to get interested in computer security. First of all a big thank-you to all of you guys, I learned a lot from reading tons of ...
0
votes
1answer
40 views

How can I decode/find the file type if there is no file extension (e.g. only binary data )? [on hold]

I have a file on my computer. I remember that I've changed its format and did some security through obscurity stuff (e.g. perhaps I've added some extra bits on to corupt the header ) but now I don't ...
0
votes
2answers
103 views

Where are passwords hashed? [duplicate]

The way I understand password security is that the user enters a password, which is then converted using a hash function. The website then compares it to the stored hash to see if it is correct. That ...
-5
votes
0answers
29 views

What are security used in Office 2010 [on hold]

Note: I don't ask for serial or cracks!!! Until now I haven't seen a software that we couldn't break the security used to protect it. All the securities I have seen are based at serial key that we ...
0
votes
1answer
105 views

Why doesn't the OS give every application a secret password?

As far as I understand if Dropbox wants to automatically run in the background without asking the user for a password it has to store the password somewhere on the harddrive and has currently no way ...
0
votes
2answers
33 views

Browser logs into forum with completely unknown credentials [on hold]

The weirdest thing is happening to me today. I visited a forum for the first time ever and browsed some posts - WITHOUT REGISTERING. A few hours later, I reopened the page (wanting to register) and ...
0
votes
2answers
49 views

Suspicious 2 page, no image Word Docx has 1.7 MB

Can a word document contain virus or harm you in any way? Someone sent me a word docx that has only 2 pages, no image but it's 1.7 MB big. If I use save as to save it with a different name but still ...
0
votes
1answer
23 views

jquery $.post CSRF protection

How can I protect the following code from CSRF? $.post("lib/newEmployee.php",{employee_id: employee_id, employee_name: employee_name}, function (output){ //code }); ...
0
votes
2answers
69 views

Where to find such URLs that attack their visitors? [closed]

Where can I find websites that perform drive-by dowload attacks ? I need such websites in order to test a software that prevents such attacks. I am in the testing phase but I do not see where I could ...
4
votes
5answers
223 views
+50

Is a biometric eye scan more secure than a multi-factor authentication

I have come across the following question in a Security+ exam guide You are tasked with creating a high-security authentication system for physical access control to a military installation. Which ...
4
votes
2answers
72 views

Why was LibreSSL PRNG unsafe on Linux?

From the source: https://www.agwa.name/blog/post/libressls_prng_is_unsafe_on_linux The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1). Despite ...
2
votes
1answer
50 views

LibreSSL 2.0.5 - Why wasn't it fully affected by secadv_20140806.txt?

From: https://marc.info/?l=openbsd-announce&m=140752800525709 The announcement: We have released LibreSSL 2.0.5, which should be arriving in the LibreSSL directory of an OpenBSD mirror near ...
2
votes
2answers
76 views

How do you find out if a phone is secretly sending private data to a remote server?

I read a recent article on a Chinese phone manufacturer on Wall Street Journal that says: The rumors had begun when a user posted online in mid-July that his RedMi Note smartphone was ...
1
vote
2answers
104 views

Using + for email addresses to find out who is selling your data: is it naive or is it effective?

It's pretty common among security-minded folks to fill in addresses using e.g. foo+company@gmail.com when disclosing their email address to company so that they can tell if company has sold their ...
0
votes
1answer
83 views

Risk of using university Wi-Fi network [duplicate]

I have lost my modem to use the internet and I am starting university next week. There is Wi-Fi available to the students in the university, but I'm worried about the risk of using it. Can other ...
0
votes
0answers
21 views

How does Spideroak manage encryption keys

I'm trying to understand the following from SpiderOak's engineering page (sorry I'm on a mobile phone so have no access to formatting functions like quote blocks): "SpiderOak uses a nested series of ...
1
vote
2answers
51 views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
2
votes
3answers
66 views

Claims based vs Permission based authorization

So I understand roles vs permissions. I also understand roles vs claims. In both cases claims and permissions are granular, usually per feature or business operation such as AddPerson permission. ...

15 30 50 per page