5
votes
1answer
2k views

XSS inside CSS when " is encoded?

I'm trying to make XSS work on one site.It allows me to edit CSS which is then included inside web page source , but it won't allow me to use " , only ' . Source is like this: body { margin: 0; ...
4
votes
3answers
301 views

Are there any known botnets targetting smartphones?

Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled? What are they used for?
5
votes
2answers
5k views

iPhone full disk encryption and theft protection?

Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses? How can I protect my valuable data, such as email, when my iPhone gets stolen?
28
votes
1answer
2k views

How does a new SMS message overwrite a previous one?

During a talk from a vendor, the speaker mentioned that their product used a "little known feature" of SMS in order to overwrite the last text message received from them. This feature was being used ...
9
votes
4answers
12k views

How can SMS spoofing be detected?

SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as ...
5
votes
1answer
285 views

Android, how to protect in case of theft

What are some steps to take into account to protect an Android phone in case of theft? Smartphones are everywhere now, before the market was dominated by Blackberry and Windows Mobile. These days ...
5
votes
2answers
2k views

How to harden my Buffalo LinkStation Pro?

The Buffalo LinkStation Pro Duo that we use can be pretty easily hacked into. The good thing about this is that this NAS runs Linux and can therby be improved in features, e.g. running an NFS or LDAP ...
5
votes
1answer
62 views

Should different web apps running on VDS each have their own user account?

I deployed my second rails app on my VDS with capistrano. Should I configure that application server to run as a different user, or the same as the first application? If I run applications as ...
7
votes
2answers
161 views

Is there any security benefit to separating an RFID chip from an ID badge?

This seems to be a question that blurs the line between physical and IT security, but I'm hoping it's relevant enough! In order to meet with PCI standards, our company recently switched from an open ...
6
votes
1answer
1k views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
2
votes
2answers
6k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
21
votes
2answers
1k views

Cohen's problem

Fred Cohen determined theoritically that viral detetction is an undecidable problem. Can anyone provide an intuitive reasoning for that? Background Fred Cohen experimented with computer viruses ...
8
votes
6answers
1k views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
36
votes
3answers
76k views

Is SHA1 better than md5 only because it generates a hash of 160 bits?

It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
9
votes
4answers
4k views

mitigating anonymous DOS (tor combined with pyloris)

I found this rather scary video in youtube, that takes DOS to a whole new level, by making it look like coming from multiple sources. As a counter measure to Rsnake (Robert Hansen) slowloris.py ...
14
votes
4answers
2k views

Tools to help test the security of Android applications

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
10
votes
1answer
2k views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
12
votes
6answers
17k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
8
votes
3answers
3k views

SOCKS proxy security concerns

As claimed, "A socks proxy simply transfers data from a client to a server, not penetrating into this data contents (therefore it can work with HTTP, FTP, SMTP, POP3, NNTP, etc.)", I really can't buy ...
55
votes
3answers
69k views

Token-based authentication - Securing the token

I have developed a backend REST API for a mobile app and I am now looking to implement token-based authentication for it to avoid having to prompt the user to login on every run of the app. What I ...
2
votes
1answer
208 views

Safe User Login Questions

I need help determining how safe the login is. First of all, I have been reading this: The Definitive Guide To Forms based Website Authentication It's really well written, great information most of ...
17
votes
8answers
6k views

Is TrueCrypt safe enough to store clear-text-passwords?

The reason: I want to be able to use a portable USB drive to access my passwords on any machine and OS. TrueCrypt seems to be the only program that has sufficient support on all major platforms. So I ...
12
votes
2answers
7k views

Bypassing the BIOS password

Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password? A few ideas come to mind: The old battery trick (remove ...
6
votes
3answers
859 views

Why is tunneling so important in pen testing?

I am curious why tunneling is so important in pen testing. If one has control of one machine in a network, then using that machine, one can run nmap and web apps and try to find out vulnerabilities.. ...
4
votes
3answers
743 views

Tracking stolen laptop which has a login password

I have been reading about solutions that track your computer in case of missing. Since I'm using Ubuntu 12.04, the best option would be prey for me, but I'm open to other suggestions. The question is ...
0
votes
0answers
65 views

Can you port-scan a LAN, from outside the LAN? [duplicate]

Possible Duplicate: Scanning A Subnet Externaly Is it possible to scan ports on machines in a LAN, from outside that LAN? For example, I've got machines in my LAN network and want to check ...
6
votes
2answers
2k views

Can remote LogMeIn Hamachi users access our local LAN?

Unknown to me, one of the kids has installed LogMeIn Hamachi on his PC so that he can access and play on his pal's Minecraft server, and vice versa. However, my lack of fu when it comes to these ...
3
votes
0answers
107 views

How should I manage my passwords? [duplicate]

Possible Duplicate: What is a good practical (and sane) way to manage all your passwords for online sites? So even if I come up with memorable passwords like "correct horse battery staple," ...
4
votes
1answer
281 views

Reverse Engineering for .rtf files

I've received lately a .rtf attachment on my work email from an untrusted email account. I suspect the attacker is exploiting "Microsoft Security Bulletin MS12-029" vulnerability. What are the ...
5
votes
2answers
170 views

Upgrading to latest software version for security reasons

I have some software that I want to upgrade to improve security. The current version I'm on is 2.6.2. Is it better to upgrade to the latest version of the entire product line which is 2.8 or should I ...
13
votes
6answers
6k views

Why is ARP poisoning killing all network activity?

Using ettercap and ARP poisoning, I was able to eavesdrop on other connections, but suddenly I was unable to make any connection to the Internet. To restore Internet connectivity, I had to restart my ...
2
votes
2answers
136 views

Is this login authentication safe?

I have been thinking of a way to authenticate users so as to pick out the users using cracked versions of my game from the people who have actually bought it. I came up with this idea: The client ...
3
votes
2answers
1k views

Shellcode that is smaller than 295 bytes that spawns a shell [closed]

Metasploit payloads produce more than 300-byte shellcodes. But I want my shell-spawning shellcodes to be less than 295 bytes. Can anyone show me the links to these shellcodes? Thanks.
5
votes
1answer
3k views

What can I do to make sure my computer isn't infected with FinSpy?

What steps have been taken by common free software OS distributions to protect against it? What can Windows users do? What ways are there to rid a system of it?
4
votes
2answers
774 views

Webservices exploitation / axis/services/AdminService?Method=AdminService

I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services. I have a sandbox (can't post live URLs...) I'm trying some stuff to try to ...
52
votes
3answers
30k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
1
vote
0answers
35 views

What is the smallest possible Windows shellcode? [duplicate]

Possible Duplicate: Are there any tools that focus on shellcode analysis? Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
9
votes
6answers
7k views

Why is php not used for banking sites or for a banking transaction?

Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site. ...
29
votes
2answers
24k views

Why is it possible to sniff an HTTPS / SSL request?

I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
9
votes
4answers
693 views

Why don't computers check whether there are memory contents in some memory space?

Buffer overflow occurs because it writes to memory spaces that are used by, or will be used by other parts of the program. Computer programs usually write to the memorylocation that has been ...
2
votes
1answer
2k views

Should we block all plaintext authentication and require authentication over an encrypted channel?

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over? I recently configured my servers to ...
3
votes
2answers
2k views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
2answers
969 views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
2
votes
1answer
93 views

What is this hardened computer called? [closed]

After undergoing a security audit, it was suggested that a hardened computer be placed in the DMZ to run firewall software. What is this hardened computer called?
5
votes
4answers
3k views

what scanning tools are unlikely to set off network IDS?

What network scanning tools have a stealth option to avoid detection?
-3
votes
2answers
202 views

Why would you want to initiate a DoS attack on a system you are testing?

What is the value of a DoS attack as part of a security assessment? this is the question asked to me in EC council's exam preparation, so need to know. not intending any attack
3
votes
2answers
154 views

What information will dig leak to an attacker?

What information will the axfr and ixfr commands in DIG provide to an attacker?
11
votes
2answers
2k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
6
votes
3answers
797 views

Is it proper to be prompted that I entered an old password

I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt: Sorry! You Entered An Old Password And even shows the date&time when I ...
7
votes
1answer
1k views

OpenSSL fails NIST AES-128-ECB test vectors?

I'm having trouble getting OpenSSL's ciphertext to match the NIST test vectors. Example : in "ecb_e_m.txt" from http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip, the first test is (in hex) ...

15 30 50 per page