0
votes
2answers
120 views

Browser page “Not resolved” page hijacked by yandex [closed]

Any domain that cannot be resolved defaults to yandex right now, on any browser on my system. Helper objects or extensions are not installed. It turns out that the ISP (Turk Telekom) is employing ...
0
votes
2answers
179 views

Infected Drupal 6 website page with a php shell

I have a server with Drupal 6 which was hacked and now by accessing the main page i can see the php shell. The problem is that i could not find the shell. The site files are not infected because i ...
0
votes
1answer
157 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones)

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
0
votes
1answer
168 views

John the Ripper password cracker is viable?

Is this still viable? I remember using this when it just worked in shells. http://www.openwall.com/john/
0
votes
1answer
89 views

Who will fix the vulnerabilities found in Firewall

As a security guy, i run vulnerability scan and found vulnerabilities in firewall Like as follows SSL Server Allows Anonymous Authentication Vulnerability Solution SOLUTION: Disable support for ...
0
votes
2answers
66 views

What is the solution for handling exceptions in password hashing schemes?

There is a technique called password hashing that describes creating unique passwords based on a unique master key and a static and arbitrary hash value. Using this technique, the user only has to ...
0
votes
1answer
44 views

Is there a solution for runing processes in encrypted mode on runtime?

Is there any solution for securely running encrypted processes on an untrusted machine over the WAN? In public clouding, you can split your processes and send process request over the WAN, but you ...
0
votes
2answers
104 views

How can I be as anonymous as possible while on Tor? [duplicate]

I've started browsing the deep web recently and have seen a lot of illegal content. Now while I have no interest in any of the illegal content, I don't want to be caught on one of these sights because ...
0
votes
1answer
68 views

How to protect user privacy when sharing photos?

I have a web site that lets users upload a profile picture that is then visible to other users of the site. What steps should the site take to protect user privacy? For example, some Jpeg files may ...
0
votes
1answer
79 views

What are the major threats involved in storing the session identifiers in local storage instead of cookies?

I want to know the major security threats involved in storing the session variables in client side local storage, instead of storing it in the cookies. Can somebody give me a brief description?
0
votes
1answer
167 views

How to ensure a second hand computer is safe to use [duplicate]

I'm planning to buy a second hand computer (2012 Mac mini, which is no longer available in stores). Because I'm not sure if there is any malware in the computer so I will perform hard format several ...
0
votes
1answer
173 views

Shellshock used in CUPS

Some days ago I read about the Shellshock bug and I wanted to test a CUPS server for it and readed some example codes to build this code: () { test;};echo /"Content-type: text/plain\"; echo; echo; ...
0
votes
2answers
127 views

Does Google catches and keeps users typing patterns [closed]

Does Google catches and keeps users typing patterns for identifying purposes? for example when I'm logged in my Google account and Searching for things Google records my "Typing Pattern" like typing ...
0
votes
2answers
282 views

Recovery plan in case of lost Android smartphone with Google Authenticator?

So I am using Google Authenticator as my two factor authentication. I'm not a security expert, but I was thinking late last night as I was about to fall asleep: How can I login to my favourite ...
0
votes
1answer
159 views

Making 2 yubikeys generate the same password

Is their a way you can make two yubikeys generate the exact same password at the exact same time? (identical copy) I am wanting to purchase two of them so I am able to store a backup yubikey in a ...
0
votes
1answer
308 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
0
votes
1answer
133 views

Identify an unknown type of hash [closed]

I've come across an unknown type of hash value which looks like this: AAAAAATOM2KIII+kbR/Dqw3TLTw4PHsGPZft2c+b93rImFIuAQ== The corresponding hex string is: ...
0
votes
1answer
46 views

Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?

I have a very elementary understanding about encryption so this question may have false assumptions, Lets take an encryption algorithm that is impractical to break through bruteforce with today's ...
0
votes
1answer
70 views

Is Lock-a-Folder a secure and reliable way to encrypt information?

What are the properties of Lock-a-folder? does it create plain-text temporary files anywhere? (e.g. ntfs artifacts, etc) does it allow running a program from the folder as if it was a normal folder? ...
0
votes
3answers
143 views

One Less Password

I just came across this: https://blog.webmaker.org/one-less-password Basically a technique for eliminating passwords as the primary authentication mechanism for connecting to a website by replacing ...
0
votes
6answers
144 views

Wireshark Packet Capture

I need to capture/analyse the packets of another system connected to same network, is it possible with Wireshark? I have Wireshark installed on my system; what options do I need to capture packets of ...
0
votes
1answer
74 views

What is public key pinning [closed]

How does public key pinning work and what problem does it solve?
0
votes
1answer
130 views

Is it safe to use IP Addresses as an identity?

I have a website where users can generate links. I'd like to limit 10 links to a user, but would also like to avoid requiring a login/email. I was thinking about using the IP Address as an identity ...
0
votes
1answer
88 views

single sign on across two servers

I have been wondering how and what kind of tools are needed to do single sign on in the following scenario: 1) Alice is logged in to site X hosted by server W 2) Alice navigates site Y hosted by ...
0
votes
1answer
361 views

PHP sprintf vulnerability?

On some sites such as WriteCodeOnline, sprintf, vsprintf and other related formatted string functions are disabled for security reasons: Warning: vsprintf() has been disabled for security reasons ...
0
votes
2answers
385 views

future of graphical password authentication [closed]

I'm a student currently pursuing my Engineering in Computers. I'm planning to put all my knowledge in and try to actually implement something related to security. To be more specific I'm more ...
0
votes
1answer
55 views

Security Engineering Potential Threat?

I've been working on some security engineering problems and there is no solution provided so if someone can clarify, would be great. From the point of view of security engineering, which is not a ...
0
votes
3answers
150 views

Can you have Secure encryption with a backdoor, and still be secure?

Is it possible to have an encryption algorithm/implementation that has a "backdoor", that also wouldn't introduce flaws into the encryption? For instance, if you have a master password, once that ...
0
votes
2answers
167 views

Renting a bedroom in a house with shared wifi, how to secure myself? [duplicate]

I'm renting a bedroom in a house with shared wifi, and I'd like to secure myself against any network snooping. I know that using the wifi network basically opens me up to snooping of any unencrypted ...
0
votes
2answers
345 views

Bruteforcing blowfish

I am quite new to encryption and recently played around with blowfish (openssl's implemenation). I am using a 23 character password (case-sensitive alphanumeric random). I estimate the entropy to be ...
0
votes
1answer
53 views

Can I sign a new certificate with a previously paid for certificate [duplicate]

For the last few months, I have been using self signed certificates to provide ssl for a system that I have been building. We are now getting ready to start getting external users on the system, but ...
0
votes
1answer
1k views

WireShark only showing broadcast packets [closed]

So here is my setup Desktop booting a live version of Kali from a USB drive The standard distro of wireshark that comes with Kali A Ralink RT-3070L High gain antenna My home network as a sandbox. ...
0
votes
1answer
243 views

Can anyone with access to root CA private key decrypt HTTPS traffic?

Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ? and if yes do he need to be man-in-the-middle or just monitoring traffic is ...
0
votes
1answer
889 views

Is this a demonstration that the shellshock patch isn't working?

I am checking my systems with the following command: env X="() { :;} ; echo busted" /bin/sh -c "echo completed" Which gives me: "completed", with no "busted", which seems good. So I tried again ...
0
votes
1answer
98 views

How could SSL certificate affect the symmetric key length?

This article in GoDaddy support knowledge base says All of our SSL certificates support high-grade 256-bit encryption How would they not support it? The SSL certificate contains keys for ...
0
votes
1answer
52 views

Secure shuffles and the rand() function

I'm trying to understand one aspect of a secure shuffle using Fisher-Yates. For reference, here is Fisher-Yates to shuffle an array x of n elements (numbered from 0 to n-1) (from Securing a Shuffle ...
0
votes
2answers
689 views

Course Material for GPEN Certification?

I am planning for GPEN certification, although i have been extensively involved in penetration projects, still looking at the topics it seems a bit difficult.. what could be good study guide for ...
0
votes
2answers
219 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
0
votes
2answers
234 views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
0
votes
2answers
247 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
0
votes
2answers
65 views

Protect against malicious client with key derivation function (PBKDF2)?

Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and ...
0
votes
1answer
85 views

Secure log in without sending plain test to server

I know this question asked so many times, but here I am again with it. I am working on an application in which I need to log-in users but the question is it is not a good Idea to send user credentials ...
0
votes
2answers
198 views

Why does the finance industry uses 2TDEA instead of 3TDEA?

Why does the finance industry uses 2TDEA instead of 3TDEA; is there any historical reason or technical limitations like the support by HSMs used in the industry? The paper referred to here says ...
0
votes
2answers
77 views

Identifying Memorable Composition Rules [closed]

A single word can be transformed in so many ways to create the password. With any word of length l there are l! different permutations. Appending digits and symbols to the word create alphanumeric ...
0
votes
2answers
169 views

Finding the IP address origin of malware attacker behind VPN and proxies

I have a client that wants me to begin doing research on finding the origin of a persistent attacker to their network and employees. I haven't gotten the specifics yet, but I'm trying to think of ways ...
0
votes
1answer
216 views

Is addslashes + htmlentities sufficiently secure?

I have addslashes(htmlentities($userInput)). It gets inserted into my database. (NOT a mysql db) Is it sufficiently safe from xss? Thank you!
0
votes
2answers
716 views

How to mask my IP using a proxy server? [duplicate]

I heard that it is possible to use a proxy server to mask my true IP address and surf anonymously online. Also I have a list of valid Proxy IPs and corresponding ports. How can I use them to get ...
0
votes
1answer
107 views

How to identify hackers based on ip addresses and the pages that were accessed

I saw some suspicious errors being generated on my site based on pages that were requested. My error is logging the path that the user is trying to access. Because of these errors (and the paths that ...
0
votes
1answer
194 views

Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]

I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it. This would work as an (almost)zero knowledge proof for sending passwords that can ...
0
votes
1answer
119 views

Detecting port scans in OSX kernel

Is it possible to detect port scans on OSX at the kernel level? I would like to write a kext that detects the ip addresses of systems scanning my computers ports. How exactly does a stealth scan ...

15 30 50 per page