3
votes
2answers
673 views

How can I recover from a hacked WordPress site and prevent future attacks?

I have a dedicated server running WordPress and have recently noticed that its been hacked and PHPShell a remote web server controller has been uploaded. This has let the hacker view and edit files ...
2
votes
3answers
199 views

Protecting wireless network

My wireless network protected under WPA-PSK/WPA2-PSK protocol. Is there a good reason to change the default user/password for the router management interface? What would it take for an hacker to ...
0
votes
1answer
196 views

MSSQL injection help [closed]

If information_schema is not allowed in MSSQL , what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema? ...
3
votes
1answer
2k views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ...
4
votes
3answers
856 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
1
vote
0answers
775 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
5
votes
2answers
15k views

Why are DSA keys referred to as DSS keys when used with SSH?

When I generate a DSA key with ssh-keygen -t dsa, the resulting public key will begin with ssh-dss. How come? Why not ssh-dsa?
4
votes
3answers
277 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...
-1
votes
2answers
4k views

How are client side hacks created? [closed]

Many games today are prereleased in an alpha/beta state and instantly overwhelmed by "hackers" downloading programs manipulating the game itself to become overpowered. I guess they make injections ...
7
votes
1answer
7k views

What is a Certification Path in SSL certificate?

I've been trying to learn more about Digital certificates for the past few days and I'm struggling in order to understand how actually this concept is applied in the real world. Anyways, as I visited ...
1
vote
2answers
158 views

Is Temporary XSS a Problem?

I use a site on a regular basis so I wanted to make sure it was secure. One of the things I checked was that when I changed my first name to <img src="http://blah.blah/blah/blah.notanextension" ...
13
votes
4answers
17k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
0
votes
1answer
2k views

How to use an OR condition with the content of a snort rule

I understand that if you specify multiple contents then the rule triggers only if ALL the content conditions are satisfied. But I want to create a rule that will trigger even if any one of the ...
3
votes
2answers
293 views

Why would an attacker try to guess random email usernames on a small domain?

My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, ...
5
votes
2answers
976 views

Should IBAN and bank details be considered private data and encrypted?

To pay off our users, they are asked to enter their IBAN and bank name and bank address. The users are mostly based in Europe. As far as I know (see also this question) these details can not be used ...
0
votes
1answer
298 views

How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?

was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
10
votes
1answer
443 views

Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?

According to findings by the EFF's SSL observatory, there are "tens of thousands of keys that offer effectively no security due to weak random number generation algorithm." My understanding of that ...
3
votes
2answers
132 views

Legacy system PCI Compliance

I have a legacy system that collects and stores credit card numbers ( BAD! ). We are in the process of replacing that system in phases. We are going to integrate with a credit card processing system ...
9
votes
1answer
3k views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
0
votes
2answers
72 views

Should a user be able to change another user's role to match their own?

Lets say a web application has four user roles. Standard, Supervisor, Manager and Administrator. Should a manager be able to promote someone else to a Manager, or only to a supervisor? I realize in ...
2
votes
1answer
8k views

How do I use nmap to scan a range of IPv6 addresses? [closed]

I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this: nmap -sP 192.168.*.* or nmap -sP 192.168.1.* but if ...
1
vote
0answers
2k views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
2
votes
1answer
210 views

How to configure Kismet to redetect same BSSIDs in a loop?

So I am working on a tool to detect any wifi device using Kismet. When I use Kismet, it works fine, but my problem is, it detects a device once, and until the MAC changes, it wont detect it again. ...
1
vote
1answer
990 views

Pgp Private key storage on windows server advice

Looking for a bit of advice really, here's the situation: I currently have a security minded client who will be sending PGP encrypted files. I have to decrypt the files on my server before ...
0
votes
1answer
139 views

Is it useful to use 'dot' and 'at' in email addresses in documents on the web? [duplicate]

My question seems to be a mash up of two questions. The first is that over at TeX.SE there is a question about creating PDFs with crawler resistant email addresses. There are some good answers about ...
1
vote
4answers
147 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
-2
votes
2answers
344 views

Trojan TCP and UDP ports removal solution?

After a nmap scan on my local host on my Windows 7 machine results showed a vast list of open ports. I'm using Windows Firewall. This machine was given to me by a friend. I've had my network crash ...
2
votes
0answers
471 views

What causes wifi network connections to timeout? [closed]

i was wondering what actually causes wifi network connections to timeout. for instance, say my laptop is connected to my wifi and i yank the battery out such that my laptop can't send any proper ...
0
votes
1answer
226 views

Key Management in Interception Proxies?

I'm reading Jarmoc's Black Hat presentation on SSL/TLS Interception Proxies and Transitive Trust. I have a few questions on some of the key management practices. In the paper, Jarmoc states: To ...
-1
votes
4answers
635 views

what will happen if us government shutdown Tier-1 internet backbone?

what will happen if us government shutdown Tier-1 internet backbone? Although Internet is designed to be quite resilient: Internet BackBone The Internet, and consequently its backbone networks, ...
0
votes
3answers
248 views

role based access control - same role, different departments

This question about RBAC implementation. Can a subject have a role in a certain realm? Suppose a university is made up of departments. Departments have courses. Courses have students. Students have ...
0
votes
1answer
635 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
2
votes
2answers
239 views

Appropriate way to encrypt passwords/financial info?

I am in the process of creating a file/files containing all of my logins/password info for various accounts. In the event of my untimely demise this file would be sent to the appropriate party(s). ...
1
vote
0answers
63 views

Is there a theorem that states “whatever can be done with trust can be done without”?

I remember hearing something like this when I first learned the protocols that removed the need of a trusted third party, but I can't find this theorem or "law" anywhere. Any pointers?
5
votes
1answer
2k views

Is 'Forge' Javascript crypto library secure? [closed]

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
2
votes
3answers
680 views

Why can't someone break email or https encryption by somehow getting access to the encryption key?

To repeat, "Why can't someone break email or https encryption by somehow getting access to the encryption key?" In other words, why can't someone intercept the key, or the algorithm to create the ...
3
votes
3answers
5k views

What does Windows's built-in encryption do, if I can seemingly always read my encrypted files?

I'm playing around with certificates and encryption on a Windows system, but either it isn't working or I don't know how it should works. When I encrypt a file its name changes to green. But then, I ...
3
votes
1answer
393 views

What is the definition of “multi-failure” disaster recovery?

There are several compliance and certification criteria that mention "multi-failure" disaster recovery. What exactly is the definition of this? A google search did not turn up a clear answer for me.
0
votes
1answer
152 views

manually approach to check vulnerabilities?

How to check for different vulnerabilities mainly XSS, SQL Injection, CSRF manually??? We are not supposed to use any interceptor tool to read request and all. Is there any other way by which we can ...
3
votes
1answer
173 views

What Information is Exposed When I Send A Message From My Mobile Device

When I send a text message and/or an email, with or without location services turned on, what information is available to the recipient of that message if they know how to read the data behind the ...
2
votes
1answer
72 views

How to calculate CVSS of an attack so that it matches those in CVEs?

I have drawn an attack graph for a file-sharing application (eg. Dropbox) where a database stores details of virtual machines Eg. memory space left, etc. I've listed some possible attacks: The ...
0
votes
2answers
68 views

Prevention from cross site scripting in different scenerio?

I could not validate malicious characters like ' .< > etc because these characters are required in my application. Also I could not encode characters because user supposed to enter HTML tags in my ...
11
votes
6answers
784 views

Security of carrying passwords on person

While in college I decided to have a randomly generated 16 character password. I used parts of that password in various sites. However, one of the sites was compromised so I had to change my password. ...
1
vote
1answer
386 views

Uploading Disabled for executable file during change of Extension

As we know, uploading of executable file is not safe. But if we change extension of file exe to txt, then file get uploaded. How to prevent this??
1
vote
3answers
47 views

Splitting IP suite?

Is it possible to split the TCP/IP suite layers? I mean to get the original data packet with its all headers & trailers out of the Link Layer before delivering them to the physical medium, and ...
6
votes
3answers
937 views

Is the connection to Tor hidden services encrypted?

It's possible for Tor exit nodes to sniff traffic on normal websites, unless you connect via SSL/HTTPS. But what about hidden services, they don't seem to support the HTTPS protocol. Can the exit ...
1
vote
1answer
81 views

Home banking site request, it possible for a small web agency?

I'm working in a web agency, i have a request to made an home banking system for a little bank. I'm searching in internet for some information about security and a good pattern to start, but naturally ...
1
vote
3answers
131 views

Make firewall management public?

A friend of mine installed a new firewall software at his company. Sometimes he works from home, and also has to maintain the firewall. The firewall management software is a web site. My friend made ...
3
votes
3answers
207 views

How to simply and efficiently generate different keys from one password?

I saw here that using the same key to encrypt and mac (in that order) a message could eventually be unsafe. What is the best way to generate two different keys from the same password (using a PBKDF ...
1
vote
0answers
956 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...

15 30 50 per page