1
vote
1answer
191 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
1
vote
1answer
66 views

Why do heap overflows/int overflows/stack overflows/buffer overflows only happen in higher addresses?

I read somewhere that these type of attacks are susceptible to addresses that are higher and not lower in the stack/heap/buffer. Why is this?
1
vote
1answer
338 views

What evidence is there that SpiderOak is significantly different from Lavabit?

In 2013 Lavabit shut down because a US agency was demanding access to its private SSL keys and basically the deets on whatever users the US was interested in. Lavabit shut down rather than give the US ...
1
vote
2answers
88 views

What do we have to keep in mind when opening up our data to a third party?

We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and ...
1
vote
2answers
316 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
1
vote
1answer
386 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
1
vote
2answers
745 views

How to avoid referer information leakage during password reset

Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
1
vote
2answers
2k views

How to call webservice securely in Android

Hello I am working on an Android application in which I'm required to execute a few https web service calls. All my web-service URLs and Web API KEYs are in the code plus the IP address of the server. ...
1
vote
2answers
365 views

How to create secure portable firefox?

When I need to access our school web portal I need to access it with my certificate (pfx). Since certificate needs to be installed in browser, I'm thinking (out of security reasons) to create a ...
1
vote
2answers
136 views

Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better? [duplicate]

It seems to be commonly accepted nowadays that all internet communication should be encrypted. (For example, this is evident in how the HTTP 2.0 standard outright requires HTTPS.) However, I have a ...
1
vote
3answers
104 views

What information can be taken by submitting an online form?

Sorry I'm pretty clueless with this stuff.. I know that vpn hides your IP address when just browsing websites, but how about submitting an online form, such as when you send an inquiry? Would my IP ...
1
vote
1answer
2k views

Different between arpspoof command spoof only target and both target and gateway

Is there any different on case 1 arpspoof -i <interface> -t <target> <default gateway> case 2 arpspoof -i <interface> -t <target> <default gateway> arpspoof -i ...
1
vote
2answers
2k views

nginx recommended ssl_ciphers

I am looking for some advice on setting the ciphers for nginx with SSL. What would you recommend for a good compromise between security and compatiblity at the moment? I have made some research but ...
1
vote
1answer
72 views

Securing sesitive data from developers

I have an enterprise application running that uses both MySQL and Mongodb datastores. My development team all have ssh access to the machine in order to perform application releases, maintenance etc. ...
1
vote
2answers
134 views

Moving /boot to USB and Preventing booting from other USB devices (Allow boot from only one USB)

I'm going to move my /boot/ folder to a USB to as a security measure to protect against Full Disk Encryption exploits. My question is, is it possible to only allow boot from USB from a single USB ...
1
vote
2answers
128 views

Access token vs. UserID + access token

My goal is to associate (authenticate) hardware devices to users in the database. The access token is generated via webinterface. It is then entered into the hardware device by the user, and the ...
1
vote
1answer
296 views

Do PHP/SQLI Prepared Statements Need Special Character Escaping?

I'm using php/mysqli queries such as this: $stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)"); $stmt -> bind_param('iiis', $uid, ...
1
vote
2answers
182 views

Viruses From Email Attachments

My company just got a worm. The specific one is beside the point, but I linked a couple pages that I think describe the worm / virus below. We're getting lots of emails to Outlook asking us to open ...
1
vote
1answer
426 views

Tracing a text message

Good afternoon, Is there anyway to trace a text message? As far as the real phone number that the text is being sent from? Or the location of where the text is being sent from? I've been getting ...
1
vote
1answer
195 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
1
vote
4answers
89 views

Would this be considered an XSS or an RFI or nothing?

I'm a beginner network security student and as practice my dad let me look over his personal business online store website. I found a script called image.asp which when fed a file parameter returns a ...
1
vote
1answer
240 views

John the Ripper password cracker is viable?

Is this still viable? I remember using this when it just worked in shells. http://www.openwall.com/john/
1
vote
2answers
763 views

Are there any good tools to test the encryption quality of data?

I am trying to increase my understanding of data encryption, and I was wondering this. It would be really nice if there were any good tools to test how secure my encrypted data is, for example how ...
1
vote
2answers
159 views

Segregating Offline Server and Internet Connection in one pc

What I want to do: Setup a PC with two routers. One router is directly connected to the internet, the other is connected to an offline workspace server. My client will be connected to both via a ...
1
vote
4answers
826 views

Is there any defense against Brute-Force done on a local encrypted file?

Let me start off by saying I don't know very much about encryption, hashing, cracking, etc. I'm just a typical computer enthusiasts, programmer and researcher with many questions. So, I've discovered ...
1
vote
1answer
431 views

How to make a decent Certificate Signing Request (CSR)?

I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate. With recent exploits as POODLE on SSLv3 and such, I'd like to ...
1
vote
1answer
555 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.
1
vote
1answer
248 views

Where does /dev/random get its entropy?

I read over and over about how /dev/random gets its entropy from "hardware events." What exactly are these hardware events and how can we be sure that it is random enough?
1
vote
1answer
123 views

Assuming malicious admin, what threats does a dedicated server mitigate vs VPS?

We host several dedicated servers and VPS instances containing sensitive data with 3rd party hosting providers. We understand we have to trust the providers as they have full control of the hardware, ...
1
vote
1answer
196 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
1
vote
1answer
2k views

Need Help with decrypting the “client key exchange” captured in wireshark

I am trying to understand how the SSL handshake happens for HTTPS. I did the Following: Captured the packets for a HTTPS connection using wireshark. examined the Client Hello for cipher suites ...
1
vote
1answer
803 views

sslv3 is still showing in openssl result even after disabling from sslprotocol [closed]

We are trying to disable sslv3 for poodle vulnerability.so i disabled in ssl.conf SSLProtocol -ALL +TLSv1 -SSLv2 -SSLv3 and tried to connect using tlsv1 using openssl command. openssl s_client ...
1
vote
1answer
100 views

Communication between two open endpoints, is this secure enough?

I'm building a (very simple) tool to communicate between two servers. I started by asking if there was a better alternative than making a home made scripts and we came to the conclusion that for ...
1
vote
2answers
679 views

What's the benefit of hybrid cryptosystem vs asymmetric for small data blocks?

It's a common belief hybrid cryptosystems are better than asymmetric only. Is that allways like that? What's the benefit of using symmetric and asymmetric encryption for small data blocks (< 100 ...
1
vote
1answer
103 views

How long can a pkcs#8 passphrase be?

A program is using a private key to read messages. To improve security, besides randomness, I'm trying to create the longest passphrase that makes sense. How long should it be? After which amount of ...
1
vote
1answer
197 views

What is attacker trying to do with my server?

Some is trying to access this link (and similar ones) frequently in my site: http://example.com/upload/RS=%5EADAJVxZ5NB.GMTgFV3EMEJX3sN22Jw- Note that my server doesn't have an upload folder inside ...
1
vote
2answers
382 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
1
vote
2answers
784 views

UEFI secure boot and rootkits

I heard that with UEFI secure boot enabled a custom kernel module that is not signed will not run, hence a rootkit might be difficult to install. Can a secure boot really block rootkit modules from ...
1
vote
1answer
183 views

Clarification about the post: Russian hackers use ‘zero-day’ to hack NATO, Ukraine in cyber-spy campaign

I have encountered the following article on Washington post: Russian hackers use ‘zero-day’ to hack NATO, Ukraine in cyber-spy campaign. As always in such kind of articles the publication sounds ...
1
vote
2answers
258 views

owasp esapi php implementation for xss attacks

I searched extensively for good materials for prevention of xss attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XSS ...
1
vote
2answers
732 views

Debian encryption is as safe as Truecrypt. Is this correct?

When I try to install latest debian to my pc, the wizard ask me to input a password to do FDE(full disk encryption). My questions are: What algorithm does Debian use? (Truecrypt = AES) Can I change ...
1
vote
3answers
271 views

Will checking the CSRF token on the header and the form's hidden be enough?

From what I read here, CSRF tokens from the cookie header cannot be read because of the same-origin policy. Is comparing the CSRF token on the cookie header with the form's hidden element be ...
1
vote
2answers
95 views

Vulnerability or Threat?

I have a practice question here: A business is going to determine the dangers to which it is exposed. What do we call a possible event that can have a disruptive effect on the reliability of ...
1
vote
1answer
106 views

Can a known MD5 hash limit the search space for SHA1 collisions?

For a course in game theory, we are dealing with BitTorrent and alternative strategies (roughly alternative clients) we can employ to maximize our download speed. One strategy is to over-report the ...
1
vote
1answer
403 views

Exploiting shellshock

On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses ...
1
vote
2answers
261 views

How does DHCP starvation work? How to prevent it?

Is it the same as DHCP exhaustion? Can LANs be vulnerable to such attacks or it's against WiFi only?
1
vote
1answer
131 views

How can we represent SSL and Firewall in OSI Model? [closed]

I want to draw an architecture diagram for a general ERP application. In that I have come across a confusing point: where should I place the SSL and Firewall? I tried to figure out exactly where ...
1
vote
2answers
815 views

Shellshock plus sudo/su environment whitelist bypass - big problem?

The question is: How big a problem is this? Looks pretty big to me. With the shellshock bug it is possible to bypass the whitelist of known-harmless environment variables in sudo, as well as other ...
1
vote
2answers
3k views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
1
vote
3answers
3k views

Are Citrix Netscalers vulnerable to shellshock bash command?

My enterprise environment is "protected" with reverse proxies, how safe am I?

15 30 50 per page