2
votes
1answer
76 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
-5
votes
2answers
39k views

Can you get someone's IP address using Skype? [closed]

If you're chatting with them via Skype, how can you get their IP address? Do you need some kind of program or is there a simple, obvious way? Is it illegal?
6
votes
6answers
6k views

What can my university see if they have my MAC address?

when i first got to my university i had to provide my MAC address to get access to the internet. What i want to know is what information can they get from having my MAC address linked to my name. i ...
1
vote
1answer
331 views

How do you identify a website's form-type?

How do you know which attack method to use when using software like thc hydra, brutus, etc? e.g. http-get, https-get, http-form-get, http-form-post, etc? For example, for sites like Yahoo, Gmail, and ...
1
vote
1answer
6k views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
2
votes
3answers
11k views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
2
votes
2answers
307 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
1
vote
1answer
124 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
2
votes
1answer
1k views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
1
vote
1answer
214 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
2
votes
3answers
10k views

Go through proxy server to Find an original IP Address [closed]

I work for a small company who has troubles with third parties selling our products on Amazon. Sometimes those third parties have websites and when I use an IP address finder online it gives me ...
1
vote
2answers
997 views

Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?

Put simply, CSRF tokens can be sniffed out of responses from the server unless the request/response are transmitted using encryption. Is this enough of a concern to worry about, or is it reasonable ...
1
vote
0answers
151 views

How to generate a CAPTCHA? [closed]

I want to generate my own CAPTCHA. I am using PIL library of Python to generate an image. I would like to know how should the image be (i.e. numbers with weird font style or some mathematical ...
6
votes
3answers
2k views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
2
votes
2answers
452 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
1
vote
0answers
42 views

Pattern extraction [closed]

I got a DB (152.4 million users) (My own fake one).I did not hash the passwords, but encrypted them. So anyone that uses the same password, lets say, "123456", will have the same encryption/cipherkey. ...
0
votes
3answers
6k views

Can you write OS-related virus using high level languages like Python

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible ...
1
vote
0answers
63 views

Kohnfelder Certificate [closed]

The Kohnfelder certificate standard is very similar to that of X.509 certificate standard. Comparing the two standards, does one have an advantage edge over the other? or what are the pros and cons of ...
7
votes
2answers
631 views

How are two systems able to set up a secure SSH tunnel over a public connection?

As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
5
votes
3answers
15k views

How does SFTP function without a manually generated public/private key pair

I am learning about SSH and how to use it to secure file transfers and commands between a windows machine and a Linux server. Everything that I have read so far indicates that I need to use an SFTP ...
2
votes
2answers
1k views

Hacked HTML page - what's in the comment following the obfuscated code?

Chrome just warned me about malicious content when visiting a site - so I visited it. The source code is like the following: <html> <head> <link href="images/DPT2.ico" title="Dynamic ...
24
votes
1answer
4k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
4
votes
1answer
476 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, paramArrayList....
1
vote
2answers
96 views

Is it possible to sign/verify a key-pair?

We currently have the need to authenticate and verify generated keypairs. Our system allows users to register for our service which generates them a key-pair for use on our network. We are in need of ...
0
votes
1answer
58 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
4
votes
4answers
1k views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
1
vote
1answer
2k views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
1
vote
1answer
2k views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
1
vote
1answer
834 views

Is a VirtualBox Host-only Adapter safe?

I have a VM in VirtualBox with two network adapters: a Host-only adapter and a NAT adapter; I was wondering if the VM gets compromised, is my Host-only adapter putting my host in danger? --- ...
8
votes
1answer
495 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
4
votes
3answers
271 views

Why do some websites need time to log you in securely, while others can do it instantly?

I noted that on a lot of money-related websites (banks, paypal, etc), you are brought to a page that "logs you in securely". This is an example of one: Meanwhile, websites that also store very ...
2
votes
3answers
3k views

Can an attacker sniff physical network traffic through WiFi?

So, I am wondering - is it possible for an attacker to sniff traffic on an Ethernet connection if they are not physically plugged into the modem/router hardware but they are connected through wifi? In ...
1
vote
0answers
38 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
6
votes
1answer
708 views

What happens if biometric data is stolen?

As we move toward a future where fingerprints might possibly replace passwords, I see one issue. While passwords can be stolen, they can be changed by the owner after being notified of the security ...
2
votes
3answers
198 views

Is there any point to connecting to a VPN server while on the local network?

I plan on installing a VPN server on one of my computers that is running Ubuntu for purposes of connecting to my local network while I am not at home. At home I also have a desktop computer (separate ...
3
votes
1answer
103 views

Is it possible to slow down the Blue Midnight Wish cryptographic hash function?

In the Blue Midnight Wish (BMW) cryptographic hash function, is there a variable I can use to increase memory/CPU resource consumption to slow down the password hashing process? Call me crazy, but I ...
9
votes
1answer
3k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § 2....
3
votes
2answers
377 views

I believe my Domain has been hijacked I am not receiving in sales in shopping cart

My IP address is 181.224.153.95 Domain: www.ashaybythebay.com FTP Hostname: m23.siteground.biz I added private domain servers to my domain name ashaybythebay.com and I see the two IP server ...
3
votes
1answer
916 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
6
votes
1answer
157 views

Why does a web site operator need to trust an openid provider?

I am working on a web site and am considering using OpenID for authentication. The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, ...
2
votes
1answer
610 views

what are the current best practices for key generation

What is the difference between these openssl commands: "openssl genrsa" "openssl genpkey" "openssl req -newkey rsa:bits [everything else]" Which one should I be using when preparing a new CSR?
3
votes
4answers
279 views

One computer with multiple OSs in different drives

I use my personal computer for both programming work and gaming at my free time(and sometimes penetration testing) all these in different operating systems each. The problem is that I dont really ...
1
vote
1answer
109 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
3
votes
1answer
1k views

TestSSLServer Results

I ran TestSSLServer.exe (from http://www.bolet.org/TestSSLServer/) against a web server in my organization. The results seemed self explanatory save for one section I'm not sure how to interpret. ...
6
votes
2answers
1k views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
1
vote
1answer
2k views

Explain the Heartbleed Python code [closed]

first post here so be gentle please! I understand the Heartbleed vulnerability concept, and I have a general grasp of Python. I'm struggling to understand the PoC Python code though, so was after a ...
3
votes
1answer
142 views

BYOD - Looking for Secure means of Wiping Data Remotely

We are in the process of implementing a Bring Your Own Device policy to allow our many employees to use their personal laptops and desktops (Windows platform) to VPN into our company's network. These ...
0
votes
1answer
1k views

Using Proxy Server, can gateway know which URL i am trying to open

I am using a Proxy for example UltraSurf, if I try to open a URL in my web browser, obviously web browser is going to send this information to my Proxy, then Proxy is going to communicate my Gateway. ...
2
votes
2answers
165 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
3
votes
1answer
343 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...

15 30 50 per page