0
votes
1answer
414 views

Someone is trying to hack my PHP server

Today, early in the morning. My dedicated server was slowing because there was numerous requests coming. One error I remember is some message from MYSQL, it said something similar to, ...
0
votes
1answer
108 views

How to detect suspicious activity on a web and mailserver?

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP). Question: What are the best practices to detect suspicious activity? Are there any scripts that shows ...
0
votes
1answer
58 views

How to maintain validity of user credentials?

In an example scenario consider that; I am a customer of organisation and I have two separate accounts with two different departments X and Y. I can login in to each department's website by using ...
0
votes
1answer
623 views

How are TLSv1.0 ciphers negotiated as TLSv1.2?

I'm a little confused about something I am reading in Bulletproof SSL. "TLS 1.2 is the only protocol that allows suites to define their PRFs. This means that for the suites defined before TLS 1.2 ...
0
votes
3answers
212 views

How secure are sentence passwords? [duplicate]

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is ...
0
votes
1answer
86 views

Plausible deniability regarding KeepassX files

I recently installed Guest Additions in my Windows 7 Virtual Machine because I could not stand working without widescreen and high resolution. I have read somewhere that this could be a possible ...
0
votes
1answer
109 views

KDBG usage in volatility

I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block. Can someone explain in plain words what is it and why are we using it?
0
votes
1answer
355 views

How to delete YouTube zombie cookies

Some days ago I noticed that YouTube knows the videos I watched even though I deleted my cookies. I also was not using a YouTube-account. When I noticed I used IE 11. After some research I found out ...
0
votes
2answers
61 views

What's the inverse of sandbox security pattern?

I've been reading about the definition of the sandbox pattern and reading one answer given here. In the idea of a real world sandbox, it wasn't made only to prevent the children from leaving it, but ...
0
votes
1answer
110 views

Securing login form in a desktop app

I currently have a desktop application which requires the user to have a username and a password. These credentials are stored on a webserver (myserver.com), so when he types the username and the ...
0
votes
1answer
472 views

Getting a log of computers that have remotely accessed a Windows server

I have suspicions that someone other than people on my team have obtained the credentials to remotely access a Windows 2008 Server. I need to get some evidence before I start pointing fingers or get ...
0
votes
2answers
116 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
0
votes
2answers
121 views

Is it bad if one uses the same email address on different sites/forums?

Is it bad practice if one uses the same email address on different sites and forums?
0
votes
1answer
64 views

Authentication of temporary worker without a badge (physical security) [closed]

In our company we have a procedure to verify internal worker but we cannot use it for temporary worker. We cannot use badges and because of privacy reasons we cannot use any photos. Is there any other ...
0
votes
1answer
894 views

Strange flood of requests to my web server

About an hour ago, strange requests began showing up in my access logs. They are coming in at a rate of ca. 400 req/s and appear to come from IPs all over the place. It started out at a lover rate and ...
0
votes
2answers
461 views

Is possible to be hacked remotely? [closed]

I am a little bit afraid about remote hacking, since I'm using a Windows 7. I see what a hacker can do if he exploits the DCOM vulnerability in Windows XP, but does this sort of exploit exist on ...
0
votes
1answer
100 views

Smart Token Security Test [closed]

I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
0
votes
2answers
116 views

Suspicious 2 page, no image Word Docx has 1.7 MB

Can a word document contain virus or harm you in any way? Someone sent me a word docx that has only 2 pages, no image but it's 1.7 MB big. If I use save as to save it with a different name but still ...
0
votes
1answer
257 views

jquery $.post CSRF protection

How can I protect the following code from CSRF? $.post("lib/newEmployee.php",{employee_id: employee_id, employee_name: employee_name}, function (output){ //code }); ...
0
votes
1answer
274 views

Risk of using university Wi-Fi network [duplicate]

I have lost my modem to use the internet and I am starting university next week. There is Wi-Fi available to the students in the university, but I'm worried about the risk of using it. Can other ...
0
votes
1answer
2k views

sql injection vulnerability to codeigniter

Hello i want to know why this kind of example question never been asked before. i got this code from my college that they say this kind of code is able to prevent sql injection we use codeigniter to ...
0
votes
1answer
382 views

Why can Oauth2 redirect_uri be a non-https URI?

I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is ...
0
votes
2answers
124 views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...
0
votes
1answer
842 views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASPbwa document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. Any help on the issue will be appreciated. Thank you. ...
0
votes
1answer
327 views

THC Hydra 16 Valid Passwords? [duplicate]

So when i do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesnt work for me, it says all 16 passwords are valid, but none of them works, can anyone help me with this? I tried ...
0
votes
1answer
778 views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
0
votes
1answer
188 views

tcpdump filter expression POST packets

I'm trying to save only POST packets using tcpdump filter expressions. I started with 'tcp port 80' and I found on the web a specific expression to achieve that. tcpdump -i wlan0 -s 0 -A -vv ...
0
votes
2answers
190 views

Using different algorithms to slow down GPU password cracking [duplicate]

I have some job related files I have already compressed with 7Z. I have protected each with good 10 character passwords consisting of upper, and lower cases, numbers and special characters. And I ...
0
votes
1answer
114 views

Identifying attacks by network activity

Is it possible (and how) to tell from a network dump if there is a buffer overflow attack, DoS or brute force attack? A DDoS would be more obvious to identify, but those attacks mentioned above I ...
0
votes
4answers
337 views

How does a hashing function always return the same length hash?

I've been looking into what hashing functions are, what they do, &c. I was just wondering: how does a hashing function always return the same length hash? How does hashing work? does not explain ...
0
votes
3answers
972 views

How important it is to change password regularly? [duplicate]

A WWW-site guided me to change the password regularly. Should I believe what the say, if my current password is long enough random string?
0
votes
1answer
50 views

Throttle network based on OS [closed]

What do I need to learn/know to throttle a clients network based on his/her operating system. For example: Someone in my network using Kali Linux... I would like to throttle their traffic to ...
0
votes
2answers
283 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
0
votes
2answers
131 views

Typical mistakes when implementing digital signatures?

I am looking for a list of typical mistakes someone can make when implementing digital signatures for a software. And of course why they are mistakes and how an attacker could take advantage of them. ...
0
votes
1answer
666 views

How can I detect whether a webshell exploit has been run?

My forum was running MyBB 1.6.10 and maldet found a JPG file with the webshell by Orb malware code at the end (php.cmdshell.unclassed.352). I'm using nginx and had secured against arbitrary files ...
0
votes
2answers
584 views

What kind of attacks can happen on port 80

I am a novice to network security domain. For one of our clients, we are trying propose a network model where an Apache proxy/web-server which will be the only one that is exposed into the ...
0
votes
1answer
48 views

May I write the CSRF token to a script

The django docs tell us that our AJAX scripts should acquire the token from the designated cookie as in get_cookie('_csrf_token'). Can I rather print it to the HTML source, so that it's available to ...
0
votes
1answer
42 views

NAT separate firewall or other security tools

It's a conceptual question: Suppose i want to separate NAT and firewall, can it help to my security? INTERNET >>>> NAT >>>> Firewall >>> MyNetwork
0
votes
1answer
245 views

How to stop gmail spam after connecting to public wifi without VPN on Android?

About two weeks ago, I had to reply to an urgent email (gmail) on my Android phone with the Gmail app. Unfortunately, my VPN client refused to work that day (Private Internet Access Android Client), ...
0
votes
2answers
112 views

PCI compliance and external resources http/https

Firstly, if a site is PCI compliant, and new references to a 3rd-party file (e.g. image, Javascript, CSS, etc…) via http:// instead of https:// are added, does it violate PCI compliance? Secondly, ...
0
votes
2answers
101 views

Share passwords between developers [duplicate]

We have a project with 3 remote developers and myself, at the moment passwords (server logins, db passwords etc) are being shared via emails which are cc'ed to everyone, Is there a normal workflow ...
0
votes
1answer
184 views

Is my understanding about how SSL works correct?

I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far: Mutual auth is a way for the client to authenticate itself to the server, just like the server does to ...
0
votes
1answer
80 views

Does openssl store the certificate of the server after verification is done?

As per my understanding , openssl will verify the certificate of the server during ssl handshake , using the trusted CAs present in the CA certificate dir in the context. After the server certificate ...
0
votes
1answer
579 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
0
votes
2answers
124 views

How to combine a key and a password in practice

Alice wants to encrypt her data. She is not comfortable with using only a password. While she prefers to use a properly random crypto key, she isn't confident she can protect the key file from theft ...
0
votes
2answers
152 views

How does Matrix SSL perform certificate validation?

We use a custom app which uses Matrix SSL (client side) to perform certificate validation on MAC and Linux systems. My question is, does Matrix SSL keep a cert store cache of intermediate and trusted ...
0
votes
2answers
134 views

Is server-side access control sufficient or should I encrypt querystrings

I've got an ASP Classic system that passes around sequential ids corresponding to keys in the database. I had gotten an encryption module (chilkat, an activex control) that I was using to encrypt and ...
0
votes
1answer
77 views

Google safe browsing vs traditional anti-malware scanners

What is the difference between using Google Safe Browsing and using other traditional anti-webmalware tools ? Which one is more efficient to protect against malicious web content ?
0
votes
3answers
55 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
0
votes
4answers
428 views

What are JS malware attack techniques?

Malicious JavaScript (generated by malicious hosted PHP code for example) can lead to attacks. What are the types of attack that malicious javascript could perform? Are the drive-by download attacks ...

15 30 50 per page