3
votes
2answers
8k views

Could Nmap scan switches/routers

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
-1
votes
4answers
802 views

How to protect myself from cyberbullying?

I want to learn how can I protect my PC from getting hacked in order to protect myself from cyberbullying. There is an intruder who has hacked my system over the last 4 years. He has hacked my all ...
9
votes
2answers
1k views

The Dangers of Open Wi-Fi

I know that the first response to a question titled like so is "seriously?". I know the answers exists, but I am just trying to put everything together. Using and/or having an open Wi-Fi network is ...
0
votes
1answer
58 views

File directory deletion [closed]

So I heard this guy talkin about how one time he deleted someone's windows directory remotely. He claimed to have gotten into the system and deleted it such that the files are all still there, but the ...
4
votes
5answers
882 views

Do any organizations use Smart Cards other than the military?

The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why? UPDATE What are the pros/cons of smart cards, compared to other methods?
2
votes
2answers
509 views

How to investigate possible illegal access by a staff member to emails?

At work we use Outlook 2010 (I think) and an exchange server. The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on ...
1
vote
1answer
183 views

How to secure upload from desktop client to web application?

Let's say we have a desktop application and a web application. The desktop application uploads files to the server using POST requests to the web application. What are the possibilities (except using ...
3
votes
2answers
2k views

How to check for null byte injection in Java webapp

Looks like Null Byte Injection is possible in Java apps. see: Is null-byte injection possible in Java filenames? So how does one protect against it? Inspect all the bytes of the filename for a 0 ...
1
vote
1answer
228 views

Device authentication mechanism

I am doing a project that needs device authentication with a gateway. What are some of the best ways of doing that ? Whether a certificate based mechanism is feasible in this case ?
5
votes
1answer
453 views

Protection against a fired IT employee [duplicate]

Possible Duplicate: When a sysadmin leaves what extra precautions need to be taken? We have some servers on two sites. We use Puppet to allow only SSH key (root denied) and authorize users ...
8
votes
2answers
2k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
3
votes
3answers
325 views

“Doxing” users on Social Media

I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get. Suppose the following A user is posting libel and slander on social media (lets say Twitter ...
3
votes
2answers
2k views

Is leaving the root user enabled in Mac OS X a security risk?

To those unfamiliar, the Mac OSX has the root account disabled by default. In order to enable the root user you have to go deep into System Preferences and authenticate yourself with an administrator ...
1
vote
1answer
406 views

Metasploit Closing Connections?

Whenever I attempt to use an exploit (that I know will work) from Metasploit in Windows on a machine on my LAN, I always get the error Exploit exception: An established connection was aborted by ...
4
votes
1answer
639 views

CDNs used by Windows Update

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following. I'm noticing taffic from our network to the ...
1
vote
2answers
3k views

Anonymous FTP Risks

If my IIS 6.0 web server is disabled and the only other service running is FTP, what are the security risks of allowing anonymous FTP read/write, considering that a random person couldn't use any sort ...
3
votes
3answers
2k views

XSS : Content-type: application/json

Background information - Application responds to request to a particular URL with content-type: application/json JSON response contains a parameter from the request Escapes the quote with a slash ...
-2
votes
1answer
1k views

How to retrive domain account hashes from windows 2008 server? [closed]

I want to do password length audit of domain password using offline brute force analysis. I cannot find any domain hashes from local machines , I want an approach where i can retrieve these hashes ...
2
votes
3answers
958 views

How to do a virus scan before post attachments in asp.net application

How to do a virus scan before post attachments in asp.net application,when they find a virus on to give up post attachments,otherwise proceed to upload. I wonder if there are any APIs out there where ...
4
votes
2answers
4k views

Can I determine the cipher used to encrypt a file with OpenSSL?

I have two files which were encrypted using OpenSSL. I know that that first one was encrypted using bf-cbc, and I also know the password to decrypt it. The second file is likely to use the same ...
2
votes
3answers
219 views

How important is user acceptance when deciding whether to deploy biometric authentication?

I've been browsing through several studies on user acceptance of biometrics, and I've been noticing that they all focus on attitudes and beliefs about biometrics. While it's important to know a ...
15
votes
3answers
21k views

What is single sign on versus federated login?

What is the difference between Federated Login and Single Sign On authentication methods?
0
votes
2answers
126 views

Protecting LAN from remote controlled VMs

I am making a virtual network setup for my high school cybersecurity team to practice. I am connecting all the VMs together through a VPN and then people who are practicing will VPN in and ssh/remote ...
8
votes
2answers
2k views

Authenticated Encryption vs. contained and encrypted checksum/hash?

So I read through http://en.wikipedia.org/wiki/Authenticated_encryption and http://www.cryptopp.com/wiki/Authenticated_Encryption and I don't seem to be following the concept. From the simple ...
10
votes
4answers
7k views

Is WebGL a security concern?

Is WebGL a potential security problem due to the low level access it provides? For example, a web page can attempt to compile and run any shader source it wants. It seems that security would ...
1
vote
1answer
718 views

How to determine whether the redirect link is secure or not?

I am checking about the security of redirect link, For the below link , how to determine whether it is secure? For the first link, the users are not allowed to change the url in the browser, but they ...
4
votes
4answers
438 views

Security of Cloud Storage

What are the main security risks of popular cloud storage services such as Dropbox? I am torn between the convenience of cloud storage and the potential security risk of it. How can I evaluate whether ...
1
vote
3answers
1k views

How to set password on applications in Mac OS to prevent an administrator to start them?

Is there any program that can set password on the app like mail or browser? I know about parent control, but I doesn't work with administrator account. What I want is some program that blocks some ...
3
votes
3answers
439 views

If we cast a value is it still necessary to escape it with mysqli_real_escape_string()?

real_escape() is a function which needs memory for its functionality, so I was wondering that is there any necessity to do that if we've already cast it? $num = (int) $num; can we use real_escape() ...
7
votes
3answers
1k views

Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?

It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app: <VirtualHost ilia.ws> Include /home/ilia/sql.cnf ...
3
votes
3answers
1k views

How can I make it more difficult for a user to create multiple accounts?

I would like to know the best way to increase security on a website so that the a single user can't create multiple accounts. What all of a user can be traced? I'm thinking: IP address Mac address ...
1
vote
1answer
407 views

How am I able to use Input Director when one machine is VPN'd into work?

So - I don't actually have a problem, but I'm really curious, because apparently VPN's don't work the way I thought they did. It was my impression that when I VPN into my office, my computer is ...
3
votes
1answer
2k views

good product to physical lock down a mac mini server?

Since the recent theft of a mac mini and macbook pro Im looking into products to lock down the mac mini server 2011 model. There are many cable solutions out there like kensington but the mac mini has ...
1
vote
0answers
191 views

Entry-level jobs for IT risk management? [Security guard v. data entry?] [closed]

E IT Security community, I was wondering if you could offer me recommendations on kick-starting my career in IT and information security. As it stands, I'm more interested in the non-technical side ...
2
votes
1answer
613 views

Found huge bug, what should I do? [duplicate]

Possible Duplicate: How to disclose a security vulnerability in an ethical fashion? Reporting vulnerable sites I've found a huge bug which gives me the possibility to get (through ...
2
votes
3answers
1k views

discover virus or spyware under Linux

I suspect to be the target of very skilled hackers. 5 or 6 years ago I found spyware on my Linux webserver, it was lkm masked as ppp_deflate module with md5 hash hijacked. I mean with the same md5 ...
1
vote
1answer
1k views

IIS password protected website

I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows ...
5
votes
2answers
2k views

Fuzzing with SPIKE - the \r\n not being taken into account

I would like to fuzz FTP protocol, and currently I have the following: s_read_packet(); s_string("USER test\r\n"); s_read_packet(); s_string("PASS test\r\n"); s_read_packet(); I've also tried ...
0
votes
2answers
303 views

What are the pitfalls while generating a random number from a random data set?

I am relatively new to the GPG key system and I have been been learning about the system through experimentation. I now know that while generating a random seed for the key generation, the random ...
2
votes
2answers
1k views

Is traffic sent by Mouse Without Borders encrypted?

Some of our users have installed Mouse Without Borders and I wanted to know if it is possible to intercept the traffic being sent between the two computers and read it in some meaningful manner. I was ...
0
votes
1answer
5k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
0
votes
2answers
3k views

How to prevent file duplication/burning of a CD/DVD

I have HTML and SWF files that I want to put on a CD. How can I protect the contents on the CD, or make it difficult for someone to burn or duplicate them?
5
votes
3answers
19k views

What do the UDP entries in my netstat output stand for?

I ran netstat -a under windows. what is the meaning of this line UDP [::]:57427 *:* ? Proto Local Address Foreign Address State UDP [::]:5355 *:* UDP ...
3
votes
2answers
509 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
21
votes
4answers
8k views

Dangers of opening up a wide range of ports? (mosh)

Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not ...
2
votes
1answer
923 views

UDP Flood Attack false positive

Symantec keeps blocking traffic from the IP of my Comcast SMC Network gateway. It blocks traffic because it is detecting a UDP Flood Attack. According to the log the CPU usage is spiking to 100% when ...
7
votes
4answers
2k views

Security considerations in providing VPN access to non-company issued computers

There have been a few people at my office that have requested the installation of DropBox on their computers to synchronize files so they can work on them at home. I have always been wary about cloud ...
12
votes
6answers
1k views

Where to start with security testing?

Starting with a QA team that deals mainly with functional requirements testing and has little real security testing experience, what simple practical things should the QA team start doing to start ...
-1
votes
4answers
164 views

pesudo random password

I post a question before about one password repeating to make it longer, now its a new way want to ask about, if take the word 'secure' and instead of repeating it put somenumbers between it, exp: ...
3
votes
4answers
321 views

Is there a crypto system which detects decryption somewhere between sender and receiver?

I was wondering if there exists (or if it could be created) a cryptographic system in which a message is encrypted and sent from A to B, and some nodes in the middle could intercept and decrypt the ...

15 30 50 per page