0
votes
0answers
15 views

How to set size of RSA key in aspnet_regiis [migrated]

How do i set the key size of my rsa key. Creating the key: aspnet_regiis -pc "test" -exp -size 4096 Exporting the key: aspnet_regiis -px "test" "c:\myKey.xml" -pri this does not give me key size ...
0
votes
0answers
24 views

Snoop-it crashes on iOS6 [on hold]

I'm trying to run Snoop-it on an iPhone 5 running iOS 6.1.4 but it crashes immediately after starting: Feb 25 14:18:56 Sogetis-iPhone Snoop-it Config[745]: MS:Notice: Injecting: ...
0
votes
2answers
24 views

How To Keep Data Private Where Software Requires An Online Check

When software forces a user to verify online(Phone Home) before use, it creates an opportunity for private data created with this software to be physically connected to the Internet. This may not be ...
0
votes
0answers
6 views

What are the ssh-keygen -D and -U parameters for? How are they used with smartcards? [migrated]

The ssh-keygen manpage lists the following two parameters: -D reader = Download the RSA public key stored in the smartcard in reader. -U reader = Upload an existing RSA private key into the ...
0
votes
0answers
45 views

Tools to create dictionary with word-combos? [on hold]

I'm studying to take a job as a pentester, and specifically how to crack wpa/wpa2 security. I've been able to use aircrack/airodump to capture a handshake, and I know at this point it's just a matter ...
0
votes
0answers
34 views

What can Android Antivirus apps really do? [duplicate]

I am studiying about android development and given the permission restriction between apps and isolation that the operating system itself imposes, I was wondering what can an antivirus app distributed ...
0
votes
0answers
5 views

lsarpc LSA_DELETE failed: What does this mean? [migrated]

I have been noticing the following error on our samba server: smbd[30271]: api_rpcTNP: \lsarpc: LSA_DELETE failed. I haven't had any luck figuring out what it is, and my experience with ...
0
votes
0answers
15 views

HTTP DoS prevetion with UFW firewall [migrated]

I am trying to creator an HTTP DoS attack on my servers using UFW firewall using this Resource. I edited /etc/ufw/before.rules to get the following rules. # # rules.before # # Rules that should be ...
0
votes
0answers
34 views

Any resources for learning about fuzzing [on hold]

I want to ask for your help. I was interested in fuzzing and anything related to it, but since I was new to it or maybe I've did something related to fuzzing but I never know the name, so I think I ...
0
votes
1answer
61 views

How can the Equation Group HDD firmware malware help bypass FDE?

There is currently a lot of discussion going on across the Internet about the "Equation Group" family of malicious hard disk drive firmware. One thing that has me wondering is the claim that ...
0
votes
0answers
14 views

keytool commands to replace existing SSL certificate? [migrated]

I've a linux centos server running glassfish 3.1.2 app server. The default certs coming from GlassFish install for ports 4848 and 8181 are 1024 bits. I need to replace these with 2048 bits versions. ...
0
votes
0answers
29 views

iptables - How to remove connection tracking [on hold]

I'm using this command for redirect all web traffic (http) into my local web server iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.11.100 Then i test, access a website and got ...
0
votes
0answers
13 views

List of certificate authorities for opera 9.64 [closed]

Where do I get a list of certificate authorities for my opera 9.64 I'm looking specifically for an certificate by "Over the Rainbow Tech."
0
votes
0answers
5 views

Tunneling EAP-TTLS over EAP-TTLS?

This question may come across as slightly (completely) absurd, but please entertain me as I believe it may have some pedagogical value, or if not at least some mild distraction on what is normally ...
0
votes
0answers
36 views

Symantec Endpoint Protection vs System Hardening [closed]

My IT Team is of the opinion that since they have installed Symantec Endpoint Protection software on my work laptop, there is no need for additional system hardening. They claim that SEP completely ...
0
votes
0answers
15 views

theHarvester not exporting report [closed]

./theHarvester.py -d targetdomain -l 1000 -b all -f output I am using theHarvester python application to gather data on a site for pentesting purposes. Which works well. Accept I am unable to save ...
0
votes
0answers
16 views

TLSv1 dosnt work witout enabling the sslv2 [migrated]

I'm using Apache 2.2.4 version. i already know this version only support the sslv2, sslv3 and tlsv3. but something wired happens when i use it: when sslv2 is disable: the web browser (internet ...
0
votes
1answer
93 views

Is it possible to detect a keylogger, when placed? [duplicate]

Can you detect a keylogger when it is placed? Would it be possible to do that via a keyboard removed event, expecting the keyboard is not removed regularly? So that you for example get a pop-up/alert ...
0
votes
0answers
16 views

Best practise Managing Key Material Securely in Memory in android

I am aware of the issue of user entered pass phrases being left in memory if stored in Java Strings (due to String being immutable). Which takes me onto using char arrays. However, I am wondering if ...
0
votes
0answers
29 views

List of Phishing, Virus(ed), Malware Sites For An Anti-Spam Site [on hold]

I'm looking for a list or database of phishing, full of viruses and malware sites which I can use to test the credibility of my current project I'm working on. Any source where I can find bad, ...
0
votes
0answers
7 views

How do I trade an OAuth token for a Fedauth token with Azure AD? [migrated]

I am trying to access a resource that's secured with Azure Active Directory. I can see from the HTTP traffic that my browser uses a Fedauth token when accessing the resource, but I need to access this ...
0
votes
0answers
100 views

How actually Lenovo's Superfish works in general (step-by-step)?

There isn`t a clear, step-by-step explanation about Superfish adware here, all questions and answers are kind of specific for different aspects of it, but nothing in general. So, how Lenovo's ...
0
votes
0answers
20 views

Spoofing OS userAgent via CUrl; am I approaching this right? [migrated]

So my school seems to be shaping traffic based on the OS of a device. For instance, I access a course video on my desktop (windows 8.1) and it works just fine (downloading the video at about 400k/sec) ...
0
votes
0answers
24 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
0
votes
0answers
22 views

How to monitor upload/download on multiple machines [migrated]

There are 3 windows machines on my home network. I'm hard wired to the router whilst my parents and younger sister are on wifi. I've noticed the occasional drop in connection speed recently and I ...
0
votes
0answers
36 views

Self signed certificates and SBS 2008

I have been researching certificates for the past few days and one of the things I don't understand is how certificates created by SBS (Small Business Server from Microsoft) are validated when trying ...
0
votes
1answer
21 views

How to generate a CSR via command line/openssl

I am looking for a handy cheat sheet/cookbook recipe for how to locally generate a solid Certificate Signing Request in OS X (10.9; Linux would be of course similar if not the same), that I can use to ...
0
votes
0answers
10 views

How to start msfweb on kali linux? [migrated]

I want to start msfweb service on my kali linux but this service isn't in my kali how I can install it?
0
votes
0answers
22 views

authentication token not stored in DB

I am implementing a webserver and the guideline I am following suggests: - to create token by a Serializer that takes the IdUser, a symmetric key and an expiry date - provide it to the user but not ...
0
votes
0answers
3 views

Unable to log into encrypted root drive after running virtual machine [migrated]

I am unable to log into my encrypted hard drive on the host which is Ubuntu 14.04 LTS desktop. This all happened after I did the following. Ran VirtualBox Created a VDI drive Installed Kali Linux ...
0
votes
0answers
21 views

Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network

I am aiming to lock down a web service that accesses other services and has a publicly facing UI. I have a hosted service on a network that requires 2-factor authentication to access. This service's ...
0
votes
0answers
9 views

Application Security Domain and Working with MNC's? [closed]

I am new into this community and I hope you all had been on your upwell health. Regarding my portfolio, I am a web application security analyst with little to 4 years experience on the application ...
0
votes
0answers
19 views

What is the link between ssl ciphers I use (string length, strength of ciphers) and nginx performance? [migrated]

All is in the question. I am wondering whether how using each ciphers or another would impact performance. Is there a huge impact ? Is the impact linked to the type of content deserved ? (static or ...
0
votes
0answers
37 views

How to turn off need for bitlocker to go on Windows 7

I am the system administrator of my local computer (Windows 7) and I am unable to write to an external hard drive if it is not encrypted using Bitlocker to go. The local computer is not encrypted and ...
0
votes
1answer
39 views

Storing bank account information to send payment [closed]

I'm creating a staff system for my event company which obviously requires employees to do paid work. Do the standard PCI compliance laws apply to just storing a sort code & account number? The ...
0
votes
0answers
16 views

VPS cloud data security encryption [closed]

I have a vps for personal projects, holding a blog , notes , some test applications Some of the notes etc have personal info. I have configured apache-ssl with snake-oil for transit. Should I do ...
0
votes
1answer
83 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
0
votes
1answer
27 views

Is it valid to have more than 1 <saml:assertions> in a SAML Token response

I am trying to provide compatibility between an existing SAML token system with JWT token schema. The current system generates SAML tokens with a structure as follows: Is it even valid to have more ...
0
votes
1answer
43 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
0
votes
0answers
24 views

nmap results to find open ports for SIP [migrated]

I suspect that a firewall, or other security, on either the router, or on tleilax or doge is causing a problem with SIP calls. How do I establish that the connection is allowed and not being blocked? ...
0
votes
0answers
20 views

Start a Windows app without user interaction just after installation on Windows Phone [migrated]

I read that on android all applications, upon installation, are placed in a "stopped" state. This is the same state that the application winds up in after the user force-stops the app from the ...
0
votes
0answers
30 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 ...
0
votes
0answers
33 views

How can I send an email using a GPG public key? [migrated]

I would like to send an email (on Windows), which I would like to encrypt using a GPG public key. I tried to use a Thunderbird plugin, but it requires both the public and the private key. But I have ...
0
votes
0answers
63 views

Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?

From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. postmaster@example.com, admin@example.com) or by sending on ...
0
votes
0answers
30 views

Metasploit Framework console misencodes text

I am running the Metasploit Framework (v4.10.2) on Kali Linux 1.0.7. Some commands return this weird, misencoded (I think) text instead of what it should be returning. What can I do to fix this? ...
0
votes
0answers
25 views

SSL certificate for Web App + website [migrated]

I have a WordPress + WooCommerce online store which is hosted on a managed hosting. I just bought non-wildcard SSL Certificate for that online store. I am also developing a CherryPy Python Web App ...
0
votes
0answers
35 views

Strict-Transport-Security header set, but Firefox and Chrome still using HTTP [migrated]

My website makes use of Universal SSL from CloudFlare and I would like to have the browser redirect to HTTPS automatically. However, as not all browsers support the type of SSL cloudflare uses, I ...
0
votes
0answers
43 views

Why is the WLAN-Implementation so bad

If you are with your phone out of the house and you have wlan enabled. Your phone is screaming out to world i'm looking for the wlan with the name "yourhomewlanname". If someone has the router ...
0
votes
0answers
42 views

Clarification on a website security

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
0
votes
0answers
59 views

Brute-forcing a RSA private key password vs. LUKS volume

I need to store various private keys for my clients. Given these options, what would be the least prone to brute force attacks: Encrypt the private keys using a separate RSA key (each user get its ...

15 30 50 per page