3
votes
4answers
1k views

How is this XSS attack working?

SPOILER ALERT: This question contains an answer to one of the problems from the Google's XSS Challenge! Please stop reading further if you're not interested in knowing the answer right now. I'm ...
2
votes
3answers
143 views

How are public key certificates updated securely?

Let's say I get a new computer that's never been connected to the internet before. The first time I connect it to the internet, is it susceptible to a mitm attack while downloading its public key ...
1
vote
4answers
2k views

How do exploits and payloads work together?

I knew about the metasploit framework since a few good years ago, but I never really got into it. I have some knowledge when it comes to networks, but I am not a PRO. I've tested some things with ...
0
votes
1answer
205 views

Is a PCI scan required for LAN outer firewall with no open ports?

I have recently been trying to get my company ip addresses scanned with Comodo HackerGuardian. My website needed some adjustments to ssl but after they were made it passed the scan. As we also have a ...
0
votes
2answers
1k views

Can't understand SNORT rule pcre option syntax “?P=name”

While trying to understand some SNORT rule lines, I came across the following syntax that I could not figure. Could not find any description in the manual (though admittedly I've not read it all ...
19
votes
4answers
2k views

Is this verbose error message on the DOT website a security issue?

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace. Hopefully, you can get the same result ...
-1
votes
1answer
703 views

How can I trace MAC address of not asosciated devices in my WiFi network?

I'm looking for hints to solve my problem. I would like to trace all devices that are in my surroundings. I know how do it when someone already access to my WiFi network, but I'm also interested to ...
0
votes
1answer
103 views

XSS vulnerabilities: how much are they dangerous?

Lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of a ...
1
vote
1answer
174 views

Github Pages Security, From .com to .io

Github pages is now using github.io domain instead of github.com I've read github explanation but it's still difficult for me to understand the root cause. Why would a domain become a security issue?
58
votes
6answers
16k views

Do actual penetration testers actually use tools like metasploit?

I've played around with metasploit simply as a hobby but am wondering if actual pentesters and/or hackers actually use metasploit to get into systems or do they write their own post exploitation ...
7
votes
3answers
82k views

How to monitor my home network traffic?

I have an ATT U-Verse Wireless router supplying 5 computers throughout my home. It is hardwired to my main computer. I have three children of all ages, one of which has had a tendency to make poor ...
0
votes
3answers
378 views

Practicing pentesting locally

After watching videos and downloading just about every possible pen-testing tool out there to play around with and learn. How do you setup test beds and practice scenarios to crack? With RE people ...
0
votes
1answer
336 views

Is it possible to avoid PHP string validation with malformed UTF-8 string?

Some of the old PHP string functions for example explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid ...
1
vote
1answer
95 views

Is it safe to put the output of 'strace' online?

For debugging purposes, one might be asked to put the output of strace for some process online, i.e. attached to a bug report. Is this safe in general? Under what circumstances is this safe or ...
0
votes
1answer
829 views

What shoud I do for solving this problem ? Problem is about SNORT [closed]

Snort, daq and WinPcap are installed. The rule files are located at a convenient place. How can I solve this problem? A clue is the ERROR line: Missing/incorrect dynamic engine lib specifier.
1
vote
3answers
2k views

How does a GSM triangulation work? [closed]

A have always been told that to get a geolocation of mobile phones there is the need 'ping' it with at least three cells. So actually, a standard and basic triangulation would just get from three ...
0
votes
1answer
33 views

PCI questions regarding software

As a software company who is looking at writing something that could handle debit cards can I self certify my software or do I have to have it tested by a 3rd party company?
1
vote
1answer
1k views

How to view WiFi traffic using Wireshark on a 3rd party?

I am trying to look at traffic between my phone and the outside world, and for whatever reason I can't see the outside world's traffic coming in. I am running Wireshark on a Kali box, I turned on the ...
-1
votes
2answers
267 views

If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?

I'm going to preface this by saying I have absolutely no clue when it comes to cryptography, but I'm posting this question because I'm very interested and I have no doubt there are some smart people ...
0
votes
2answers
173 views

For a computer client, is physical security the most important measure?

Is being online all the time the root of all evil, when it comes down to private computer clients security? Would a not-always-connected-to-the-internet system, solve most of our problems? In a ...
1
vote
1answer
897 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
0
votes
3answers
280 views

Next steps to get rid of malware? [duplicate]

My father in law just had a problem,He clicked on a link in an email (he was using gmail on the version 35.0.1916.114m of Chrome), and suddenly the computer sort of went black, and possibly something ...
1
vote
0answers
85 views

DLP for Phone calls [closed]

I would like to know if there is a DLP system that can monitor phone conversation, in order to search for sensitive data leakage by the company users to external users. We know NSA does that :) Is ...
5
votes
1answer
194 views

Fastest public-key algorithm for testing purposes

As part of an automated test suite I need to run a lot of gpg --encrypt and gpg --decrypt processes. In order to make each invocation of gpg --encrypt and gpg --decrypt faster, I would like to use a ...
2
votes
1answer
2k views

Are legal notices in a login banner legally significant in terms of computer misuse?

Is there any case-law where having or not having a legal notice (example here) in the login banner of a system of nay kind made a difference in prosecution? The question is in consideration both of "...
0
votes
2answers
683 views

Checking if a server is compromised

I do free/low-cost web/shell hosting as a non-profit organization (With a the same friend and co-founder) since 2007. We're on CentOS 6 + CPanel, and unfortunately we're still funding the ...
0
votes
1answer
144 views

How can I tell if my ISP account password is encrypted?

How can I be sure my ISP encrypts my account password? I found out accidentally that mine did not. I had called to report an interruption in service, and in the process of "troubleshooting", the ...
12
votes
5answers
10k views

How to safely store sensitive data like a social security number?

I am looking for a way to safely store personal information with low entropy safely. I have the following requirements for the data: Must be able to search (i.e. to look up an existing piece of ...
0
votes
2answers
502 views

Way to decode an encoded payload [closed]

I am facing an XSS vulnerability in my ASP.Net Web application where the malicious code may be encrypted and html encoded Bottomline: I am trying to prevent XSS via code obfuscation. Question: I ...
1
vote
1answer
65 views

How does OpenVPN handle previously established connections?

Started using OpenVPN on my desktop computer and monitored the traffic with Microsoft network monitor. What I noticed, is that when the openvpn session is initialized, only connections established ...
2
votes
1answer
600 views

How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw?

According to this post (and to my personal experience), installing the Skype app on Facebook and the Skype client on OSX Mavericks will result in you being logged out from Facebook every time you ...
9
votes
1answer
15k views

SSL certificate chain verification

After reading many articles and watching many tutorials I decided to be specific because there are some things about SSL certificate chain verification and SSL cetificate verification in general that ...
2
votes
2answers
623 views

How does Google track a user?

Some days ago, I was studying Web Programming for academic purposes. So I was learning SQL Injection by applying it on a sample website sqlzoo.net/hack/ But soon after it, in the Google ads on every ...
0
votes
1answer
213 views

Router level filtering on home network [closed]

I want to block some part of a website or some videos from dailymotion or other site video sites. Type of network I have 7-8 devices(PCs, Mobiles, iPhones & tablets) all connected to a router (...
1
vote
2answers
89 views

A manual function for hasing identity?

I hope you won't close the question. Even though there are no computers involved, it is still about information and security, and I think that security experts are the ones who will be able to help ...
2
votes
3answers
309 views

Are file attachments “unsafe”?

The management at work are asking, "How can we send files easily and safely to each other?", arguing that: Putting attachments in email is not safe. They want to send links instead They want to ...
0
votes
2answers
364 views

Why do file storage sites have a long unique id for their download links?

I'm creating a file storage site and what I would do is just have the download links format as: https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc. Dropbox and many others have ...
0
votes
1answer
1k views

copy protection (or licensing) mechanism for an android app

I am trying to implement a copy protection (or licensing) mechanism for an android app. The app is not distributed through Google Play or other online market and instead it is distributed through ...
1
vote
1answer
145 views

Are there any tools/methods to probe a web app from diffferent IPs?

I am currently reading "Metasploit: The Penetration Tester's Guide" and I came across the following paragraph in the book (in the 1st chapter) During intelligence gathering, you attempt to ...
0
votes
1answer
897 views

Resources for pentesting cloud based services/web-apps?

I want to know about some of the good resources for pen-testing cloud based services or web-apps (such as AWS). I googled for it but there are really few good resources out there. For example, I liked ...
3
votes
3answers
378 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
4
votes
2answers
676 views

Multiple gateways (Whonix with Tails)?

I've been reading Whonix's documentation and threads here to be more anonymous and secure. For the best anonymity Whonix recommends having two different computers, one being the gateway and the other ...
0
votes
1answer
183 views

Can a nessus scan running on top of a Windows OS do full internal scans of devices using ssh?

I am wondering if I did a Nessus scan using a Windows machine how it would log in to a Linux based device. Windows does not have a native ssh client. I am aware that Nessus will log into systems ...
0
votes
1answer
191 views

ChangeCipherSpec Authentication

According to RFC 5246, 7.1. Change Cipher Spec Protocol: The ChangeCipherSpec message is sent during the handshake after the security parameters have been agreed upon, but before the verifying ...
-2
votes
1answer
320 views

which antivirus is best for my laptop? [closed]

I want to buy a antivirus for my laptop.but I am in a fix.I want to buy such a antivirus that doesn't slow my laptop much.laptop configaration :processor core i5,Ram 4GB,operating system windows 7।...
31
votes
4answers
15k views

How to store credit card information for repeated transactions and still be PCI compliant?

I'm overhauling our absolute time-bomb of an order processing system that would put us out of business tomorrow were we audited for PCI compliance. It's so amateur it's scary. I'm planning on making ...
3
votes
7answers
842 views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
-1
votes
1answer
71 views

What are relation between security services? [closed]

message confidentiality message integrity message authentication non-repudiation The 4 services are related in the sense that one services often implies/provides another. Indicate for each service ...
1
vote
3answers
684 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
4
votes
5answers
4k views

Is MAC address filtering effective on a wifi router? [closed]

I want to improve the security of my home wifi. My neighbor wants to crack my Wi-Fi password with a nutcracker. I tried to activate the protection by MAC address, but now my laptop and smartphone ...

15 30 50 per page