1
vote
2answers
429 views

Seeking advice on how to build a box to brute force hashes? [closed]

I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
306 views

How does google docs know password for published googledocs document on a public site?

Google Docs documents can be published on public sites. How does Google know the password to use (to get the document) when all you specify in the HTML is a string like: ...
1
vote
3answers
561 views

Client side scripts through proxies

If you're trying to hide your IP address using VPN/proxies can a website using client side scripting record your real ip? If yes is there any alternative to blocking all scripts as that breaks ...
1
vote
3answers
726 views

Login System Security Suggestions

I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup: nonce to check if the login originated from our login form session and cookie auth mixed - in ...
1
vote
1answer
260 views

Limiting database security

A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
1
vote
3answers
1k views

Is it possible to use same certificate on several machines by exporting it?

My bank proposes certificate. They say I will be able to use it only on one computer. I don't understand: can't I use same certificate on several machines by exporting and reimporting it ?
1
vote
2answers
289 views

Which MTA don't have antivirus check for outbound emails? [closed]

I need to test whether MTA has antivirus check for inbound emails. To check this I need to send email with e.g. EICAR testfile from another MTA to this one. However, Gmail, Yahoo and other well-known ...
1
vote
2answers
42k views

WiFi WPA cracking with Reaver [closed]

This question is for anyone who has tried or succeeded to crack WiFi WPA/WPA2 keys with BackTrack Linux and Reaver. So, I wanted to test it on my WiFi router. I started everything as described here. ...
1
vote
2answers
2k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
1
vote
1answer
120 views

valid intermediate certs not in browser

Say an X.509 cert is signed by an intermediate cert that's not in your browser. Maybe the root certificate is but not the intermediate cert. At that point it seems like a valid certification path ...
1
vote
2answers
247 views

Why the servers stores hashed password instead of relaying on private/public key

I understand why the SSL client certificates are not widely used (need to install them, problems with shared machines etc.). On the other hand when I log into the server the password is send to it and ...
1
vote
3answers
187 views

How to reverse the communication for security

I have the following use case - There are two networks - internal network where the application server is deployed and has no internet access and external network that is accessible from internet but ...
1
vote
2answers
3k views

Find the hack in the Apache2 logs?

The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss). So I looked in the Apache2 logs and ...
1
vote
3answers
644 views

Install my own proxy

My school network has blocked a lot of webpages, including TeamViewer, which I need. The IT department told me to find a proxy, because it was their ISP who had blocked the sites. To connect to the ...
1
vote
2answers
925 views

How to react on a message about a pending account ban on Facebook? [closed]

Are you getting this message on chat? LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
1
vote
3answers
1k views

Java vulnerability applicability

On a server running Java, can a JRE vulnerability be exploited even in cases where the named subcomponent is not used by the application? See CVE-2011-3545, for which the vulnerable subcomponent is ...
1
vote
3answers
2k views

What devices support the permanent addition of an ARP table entry? What tools are available to manage this?

I would like to improve wireless security and certain other on-net security scenarios with a permanent ARP table entry. The idea being that someone on the same subnet or WiFi network will have a more ...
1
vote
4answers
242 views

Learning the role of intruder legally [duplicate]

Possible Duplicate: How can you become a competent web application security expert without breaking the law? I was reading this article earlier U.S. government hankers for hackers , and ...
1
vote
4answers
5k views

How To - Learn basic hacking skills? [closed]

I'm interested in learning some basic hacking; and I've read online that Linux is a good place to start. Although, I've been a Windows user for as long as I can remember. So I was hoping I could get a ...
1
vote
1answer
387 views

Is this enough to tackle script / malicious code insertion in GET, POST requests?

I've got legacy PHP code which attempts to prevent script/SQL injection with the following: if (!empty($_POST)) { reset($_POST); while (list($k,$v)=each($_POST)) { ...
1
vote
2answers
107 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
1
vote
2answers
67 views

How can the nmap tool be used to evade a firewall/IDS?

Some techniques are used to secure the operating system against network attacks e.g.: firewalls, antivirus software, an IDS like SNORT, etc. To take advantage of the nmap tool, is it possible to ...
1
vote
1answer
51 views

Can firewalls decrypt SSL packets?

I was wondering if the firewall has the ability to decrypt the SSL traffic. If so, the network admin is able to read the data in clear text at transit.
1
vote
1answer
98 views

Chrome 50: Where can I see the negotiated cipher suite?

This is about Chrome 50. When visiting an https site, where can I find the negotiated cipher suite? I know where to find this info in previous versions of Chrome but I'm not able to find it in the ...
1
vote
1answer
66 views

Is a reversible microphone kill switch in hardware plausible? [closed]

I'm forking this from this question, to which I gave a partial answer. These folks claim that their hardware includes a physical kill switch for the internal microphone that reversibly interrupts the ...
1
vote
1answer
52 views

Subject Alt Name certs

Is it ok to specify subdomains in certificates that support SAN. For example base domain is example.com and I want a.example.com, b.example.com, and c.example.com to be included? What is the primary ...
1
vote
1answer
79 views

How anonymous is this setup?

I've been fiddling around lately about my security as I'd like to stay completely anonymous on the Internet because we all deserve privacy, and I hope this setup will at least make it hard to find out ...
1
vote
2answers
523 views

Why do porn websies not use HTTPS? [closed]

It seems that information relating to porn habits is quite telling, why wouldn't porn websites make the effort in protecting them?
1
vote
3answers
131 views

Can Google Chrome read/scan my ProtonMail inbox page?

If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
1
vote
2answers
94 views

Is it reasonable to make mandatory inside an organization (in the internal network) that all traffic were encrypted?

Is it reasonable to make mandatory that all traffic were encrypted inside an organization (in the internal network)? Usually, in the LAN of an organization some protocols are plain text, for example, ...
1
vote
1answer
133 views

Encrypting password string in C++

I have a client server based application where user is presented with login screen in the client. It then passes the credentials to the server which does the authentication. Client-server ...
1
vote
2answers
82 views

Why does nmap remotely show when I have port 6969 open, but not others?

Specifically, I was running a node.js application on port 6969 which I thought was strictly local. I discovered this was not the case when I ran nmap <myip> from a different computer and found ...
1
vote
1answer
131 views

How does letsencrypt's ACME work?

I found the technical paper on ACME's inner workings, but I still feel a bit confused about the ways Let's encrypt's Domain Validation works. From what I already know, verification can be performed ...
1
vote
3answers
128 views

Best way to keep private PGP keys?

What is the most secure way to store my private PGP keys?
1
vote
2answers
157 views

Can bad guys record phone conversations without the carrier's knowledge?

I know that, in most of the world, phone conversations are transmitted as digital data (whether frames in circuit switched protocols or packets). I know that several companies offer products which ...
1
vote
2answers
67 views

Is a SHA-256 signature required on a CSR in order to generate a certificate with SHA-256 signature?

I've heard conflicting statements about this from certificate authorities and security groups and would like to confirm: Is a SHA-256 signature required on a CSR in order to generate a signed ...
1
vote
2answers
218 views

Is this some sort of scam or do I have stalker?

Sender: msmith11@mail.com Emails are from IP address:74.208.4.200 Emails are weekly. all text, no links, no images. Some Depict sexual fantasies in high detail directed to a female - which I am. ...
1
vote
3answers
445 views

Prevent or detect key copy

This question can be classified as somewhat two interrelated questions - or two goals. Main aim is basically to authenticate client to server, but remain secure even if someone steals the key from ...
1
vote
2answers
141 views

Does using NATO's phonetic alphabet increase password strength?

Given an alphanumeric password intended to be strong yet easy to remember, we change each alphabetic character by its NATO alphabet counterpart (e.g. 'cat' becomes 'charliealphatango'). I understand ...
1
vote
1answer
272 views

Sent images on company WiFi network by accident [duplicate]

I know this was stupid, so I don't need to be told that...here goes: I was at work and thought I was on 4G network on my Android phone but after sending a number of nude pics via a social media app ...
1
vote
2answers
135 views

Is my password visible on an SSL/TLS connection across unprotected wireless?

If I am using an insecure wireless network that has no security protocol at all and trying to connect to my encrypted online banking website, can an attacker who is sniffing the wireless network sees ...
1
vote
2answers
301 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
1
vote
2answers
126 views

How to deal with SMS spam? [closed]

Every few weeks, I get an annoying SMS trying to sell me something, or trying to get me to click something, or otherwise spamming me. I don't think it's a targeted thing- I think my phone number is ...
1
vote
2answers
119 views

Could I ever be legally required to decrpyt user information? [closed]

Suppose I host some web app which stores information about its users. In the interest of confidentiality, that information is stored in an encrypted format. Under what circumstances could a legal ...
1
vote
3answers
2k views

Tracing an email's MAC address

Can someone trace the MAC address of an email to the point of origin if the email address has been deleted? I received an email from an unknown sender regarding an issue at my work, and when I tried ...
1
vote
4answers
176 views

how can this prove a clickjacking vulnerability?

How does just putting a site link in an iframe (and when opens in iframe) indicate that the site is vulnerable to a click jacking attack? I have also read that if the site is a forum base, then the ...
1
vote
1answer
115 views

Which kind of SSL certificate is the big one?

Okay, so I just recently visited a couple of https (secure) websites and noticed that there was a difference with the way they were shown in Chrome. As you can see, the top one has some extra ...
1
vote
3answers
581 views

Is it possible to crack ransomware encryption if I have the original file?

Is it possible to crack ransomware encryption if I have 2 versions of a file: before and after the encryption? Are there any tools for such a thing?
1
vote
4answers
384 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
1
vote
1answer
221 views

Storing encrypted information in database vs partition encryption

Trying to search for answers like Database encryption or filesystem encryption? but did not found what I need. My database contains confidential information. What is better? To store encrypted ...

15 30 50 per page