0
votes
2answers
376 views

What browser plugins (ActiveX, or those for Chrome/Firefox/Safari etc) pose the most risk for your company?

I'm looking for a list of risky browser plugins that we should prevent their use on the desktop. It's probably safe to assume that old versions of Flash are on the list, but what versions? What ...
0
votes
2answers
195 views

Create a certificate signing request [closed]

can someone please tell me a few tools that can be used to create a CSR ?
0
votes
4answers
29 views

Generating SSH keys and sending the private key

I've been looking up on how to set up public key authentication between two hosts on my LAN. I am going to be using a pass phrase with my key pair. A lot of tutorials instruct me to generate the key ...
0
votes
1answer
35 views

Setting the HTTPOnly flag for PHPSESSID cookie [on hold]

I am getting this message from my security audit: Cookie name: "PHPSESSID" Cookie domain: "xxx.xxx.xx.xxx" If possible, you should set the HTTPOnly flag for this cookie. How can I set ...
0
votes
3answers
46 views

Should I be worried about SQL Injection for Internal Web Apps?

I've been working a lot lately with writing report generating forms at work. The reports sometimes require input provided by a drop-down list and sometimes require data to be entered by key. My ...
0
votes
2answers
79 views

Finance with the multitude of “Secure Browsers” [closed]

[Thanks for the great answers! But it was put on hold so I've edited my question to be a lot less opinion-based. Based on the answers already given, though, I am getting the sense that booting off a ...
0
votes
1answer
33 views

Is there a way to change the creation date of a GPG/PGP cert

How can I modify the creation date of a GPG/PGP key? I can set the Creation-Date while creating a key. But can I change this Creation-Date after the key was created? I cannot find how to do this.
0
votes
1answer
57 views

Are deleted SMS still retrievable from Android-based phones? [closed]

I'm wondering whether deleted SMS on Android phones are retrievable? If so, how is this done? How can one avoid it?
0
votes
2answers
34 views

TLS Certificate domain-expectation

If I request the Cert from example.com and the server answers with the (legit) certificate from notexample.com, will the browser throw an error?
0
votes
2answers
51 views

Is there a way to give out secure tickets wihout storing them?

I'm building a website on which I want to make it very easy for users to create pages anonymously and later be able to come back and edit those pages. One way to do so is to give out confidential ...
0
votes
2answers
65 views

Is it necessary to use SSL for MySQL?

I have a MySQL and Apache web server (both are installed on the same machine). Users will interact with it by a VB.NET application and the web. The server is accessible by the Internet. VB.NET ...
0
votes
2answers
68 views

Does SSLv3 uses SHA256 as hashing algorithm?

I understand that SSLv3 has multiple cipher suite combinations and for hashing it may use either SHA or MD5. What version of SHA does it exactly use SHA-0 or SHA-1 or SHA-2 (SHA256, SHA512 etc)..
0
votes
2answers
53 views

Protect SSL connections from MITM for users with modified clients

I'm working on a web app that uses SSL. I'm afraid that some people might access the app via a network that uses a proxy to intersect and inspect the SSL traffic [MITM]. Some people might access the ...
0
votes
2answers
55 views

FREAK attack - why doesn't Finished message prevent it?

Here is my understanding of FREAK (let me know if I'm right please): 1) Client wants to use modern RSA in ClientHello 2) MITM forwards Export_RSA 3) Server says ok and sends an export RSA key, ...
0
votes
2answers
123 views

LUKS HDD Encryption crack [closed]

I need help. I actually encrypted two mouths ago my external HDD with LUKS but know i have lost my password. I am so depressed because, all of my life is on this HDD. Is there any possibility to get ...
0
votes
2answers
49 views

Generic term for certificates and keys

Is there a generic term to designate both public and private keys, certificates and maybe even passwords?
0
votes
2answers
73 views

can this be canceled [closed]

Limi1.com put up a malware alert on my computer, with an accompaining number to call. it stated for 29.97 it would be fixed. this was last night today I called my credit card, and was told a charge of ...
0
votes
1answer
49 views

Does nmap help to know if firewall is turned on?

Is it possible to know firewall status using nmap? How?
0
votes
1answer
143 views

Decrypting SHA-256 with known plain text

If i have a SHA-256 hash and I know what could be the crypted string is it possible to decode it faster? Lets say I know the string is formed like this : %d-%d-%d-%s %d being numbers from 1-25 %s ...
0
votes
1answer
77 views

Moving /tmp to an encrypted tmpfs

BLUF: I'm using an SSD on my system, so my primary reason to use tmpfs to increase the life of my drive by moving high read/write files to volatile memory. But from a security point of view, I'd also ...
0
votes
2answers
66 views

How to secure yourself against jQuery preventDefault phishing?

This is bugging me for a while now due to the potential security risk it involves. Basicly by accident I discovered that this code is perfectly valid and works without a problem: jQuery: ...
0
votes
2answers
67 views

How much of a certificate is actually covered by the CA's signature?

One of my devs recently had an issue with the compatability of a certificate, and we rooted around for a bit until we came across a a similar problem on SO. Once I understood the developer's initial ...
0
votes
2answers
159 views

How do google or facebook know I'm behind a man in the middle proxy?

Whenever I'm behind a man in the middle proxy such as burp, and try to access either google or facebook, I get an alert message telling me that the connection is not reliable and blocks the page from ...
0
votes
1answer
123 views

Burp Suite is not intercepting JSON responses [closed]

I am trying this video and this video to learn pen-testing using JSON injection. Burp Suite is able to intercept the request from the page, but not getting the JSON response. How to solve that?
0
votes
3answers
80 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
0
votes
1answer
41 views

Why aren't the TLD registries the TLS CAs?

Here's one thing I don't understand - why is it possible for a Chinese organization to forge an SSL certificate for an American website and the other way round? What led to a design decision of ...
0
votes
1answer
95 views

Does it increase the security if we split data to n pieces and encrypt each one with different key and different algorithm?

For example: a 10 MB file will be sliced to 10 pieces (each 1 MB) and then dispersed between network nodes. Each node will encrypt it with its own key and different algorithm (AES, TwoFish, Blowfish, ...
0
votes
1answer
146 views

What are the main differences between a Metasploit vulnerability/exploit attack and a “R.A.T.” attack?

I explain myself: To attack with a vulnerability & exploit it with Metasploit, you have first to find a vulnerability listed. Then once you have it, you set up the whole thing and end up with a ...
0
votes
3answers
137 views

How does Nessus send remote commands on Windows without RDP? [closed]

I would like to know how Nessus sends remote commands on Windows. I have a scan with credentials launched on a Windows machine without RDP enabled, and Nessus can launch commands (.audit with the item ...
0
votes
2answers
131 views

Is it possible for hackers hack my PC by creating fake AP that my PC probed

I heard that hackers can create fake AP that my PC is probing. As soon as my PC found the Fake AP, it will connect automatically. So To clarify, is it possible for hackers create the Fake AP that my ...
0
votes
2answers
255 views

How hash ensure integrity of data? [duplicate]

I understand what a hash is, basically we calculate a hash and append it to the message and send it to the receiver. If someone alters the message, the receiver will know because there would be a ...
0
votes
1answer
74 views

What is the risk of using SHA1 in PGP email signatures?

SHA-1 is being phased out by a lot of major companies due to vulnerabilities. For example Chrome no longer considers it safe for public web PKI. Is it insecure to use SHA-1 for PGP email signatures?
0
votes
1answer
51 views

Can video feed be used to track location of an IP?

I dont know if it is possible but i read that while a user is viewing video, the location of user can be traced without sharing its knowledge to the user. Even when user has disabled the option to ...
0
votes
1answer
102 views

php- is my code secured enough to protect from remote command execution when using shell_exec()?

I am using shell_exec function on the following variables to execute commands on the shell: fname (characters only) fpack(characters only) email (a valid email address) My code is: <?php ...
0
votes
2answers
45 views

Is there standard guideline on how the sanitized input should appear in the error message?

Let us say your web app is sanitizing bad input and displaying the user what the bad input was. Before XSS measure was put in place web app is spitting out malicious script as is. For example Bad ...
0
votes
1answer
66 views

Is it possible for a successful domain hijacker to fraudulently use the certificate issued to the real owner of the domain name?

In other words, while visiting https://www.mybank.com, for example, can I always trust the site as long as I click the padlock in the address bar of my browser and find no problem with the ...
0
votes
2answers
79 views

Login account check [closed]

Suppose you want to create a new account in any website (let's make it Facebook), how do they check the Gmail ID or any mail ID we entered is a valid mail ID? I observed that some websites are ...
0
votes
2answers
137 views

Why use anything other than RSA for transmission encryption?

Being fairly new to the cryptography and data security space, I have sampled a few "Introduction to cryptography" sites/textbooks and they all seem to start in the same general way: This is a Caesar ...
0
votes
1answer
103 views

Cyber Security Training v. Cyber Security Education for Middle to High Schoolers [closed]

In my community, we have one state university that offers cyber security training once a year to high school students that show interest. Last year a student, after receiving this training, hacked ...
0
votes
1answer
89 views

How can I secure my server to ensure pre-login calls are originating from my app?

I have a .NET Web Api servicing a Cordova based mobile app and web front end written in AngularJS. I have done a ton of research and most sources don't give a great answer or one that's huge overkill ...
0
votes
2answers
94 views

Could someone stop another from accessing their own online account?

Suppose Alice isn't able to break into Bob's email account, but Alice can still do damage to Bob (a VIP) if she can stop him from being able to use his own email (or any other online) account to send ...
0
votes
2answers
143 views

SQL injection at work [closed]

We have a web form that can be filled out with text fields and then they get emailed to us at work. Today we got some SQL commands it looks like in a bunch of emails. I just would like to have a bit ...
0
votes
2answers
77 views

Is there a Standard Verification process for Certificate Authorities to follow?

So the premise of the question is to quantify the risk of wild card certificates versus regular certificates. From my research the greatest fundamental danger of wild card certificates is the ...
0
votes
3answers
132 views

How to validate report given by a white hat hacker

I give a contract to find vulnerabilities in my site to a white hat hacker. According to him he performed several attacks on my site for 15 days and find that there is no any security threats. I am ...
0
votes
2answers
128 views

Initialization of a LUKS encrypted partition with cipher or /dev/urandom

I've created a few encrypted devices with LUKS and cryptsetup on Linux and am pretty comfortable with disk encryption in this regard. I've seen it mentioned in many different places that when setting ...
0
votes
1answer
98 views

Operating system scanner

I am confused about Operating Systems scanner vs Network Scanner. Usually a network scanner such as Nessus can already check for operating systems vulnerability. So what does an operating system ...
0
votes
3answers
112 views

Can the packets of a wireless network be sniffed by a user who is not present in that network?

1.If an user knows the frequency used by a wireless network, is he able to collect the packets from that network? Those packets may be encrypted, but can he collect those packets? 2.If the user has ...
0
votes
2answers
316 views

Is an >=2048bit key with Asymmetric encryption secure enough to negotiate a Symmetric encryption key?

Let's say that a client app already knows the public key of the server to which it needs to communicate with and the client app needs to connect to the server using a normal non-secured internet ...
0
votes
1answer
314 views

Can I create an SSL certificate on windows signed with the machine's certificate?

From MMC > Certificates I can see there's a certificate for the current machine under 'Trusted Root Certification Authorities > Certficates'. e.g. on my workstation called 'RoryWorkstation1' there's a ...
0
votes
1answer
138 views

Can HTTPS be compromised by first contact?

Let's say I am behind my PC and want to go to any secured website (HTTPS). I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ). The packet ...

15 30 50 per page