0
votes
1answer
253 views

Understanding CSRF vulnerability in Web Application?

I want to understand what is CSRF vulnerability. I use authorization system in my web application and found CSRF. What should we do to solve it? Actually I want to create simulation for this ...
1
vote
2answers
650 views

Issues with using a mail server that doesn't support authentication to send mail?

I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through. I understand you easily spoof sender address' in emails, but I'm ...
4
votes
2answers
2k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
6
votes
2answers
214 views

HTTP daemon and Webroot permissions

We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user. I have ...
19
votes
3answers
3k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...
0
votes
1answer
500 views

Data Retention Laws for ISPs in North America

I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
8
votes
3answers
1k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
2
votes
1answer
877 views

Web application penetration testing resources? [duplicate]

Possible Duplicate: Best resources to learn web security attacks? I'm very interested in web application penetration testing. I went over every good Youtube video on that subject and most ...
13
votes
3answers
12k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
2
votes
2answers
148 views

Any solution to passing a penetration test for an outdated php web application without upgrading the application?

A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from ...
0
votes
3answers
782 views

What is the most cost effective way to comply with PCI requirement 6.5, developer training?

We are a small company that is coming increasingly under pressure to be PCI complaint. Our main product is an API that move cardholder data between a customer and a supplier. I am in the process of ...
20
votes
2answers
5k views

What is a YubiKey and how does it work?

How do YubiKeys work? Are there any alternatives?
2
votes
3answers
271 views

Why would it be a good idea for someone to get or not to get a Yubi key [closed]

In what uses would it be smart to get a Yubi key?
0
votes
2answers
528 views

Anonymous proxy over SSL [closed]

Can you name any anonymous proxy software that don't use VPN connections? Basically, I'm analyzing different encrypted traffic and now I need to analyse a simple anonymity proxy traffic. I'm analyzing ...
5
votes
2answers
455 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
1
vote
1answer
935 views

on stack execution on windows 7 :: metasploit :: meterpreter :: executable crypter

I posted this on stackoverflow, was advised to move it to security section. I was writing an executable crypter as an exercise with goal of Antivirus evasion, now the problem is the final executable ...
4
votes
2answers
1k views

How to create an Apple Installer Package Signing Certificate

How can we create a certificate with the following Extended Key Usage extension using OpenSSL? Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code ...
1
vote
1answer
8k views

Encrypting string in JavaScript and decryption in Java [closed]

I would like to know if there is any library to do encryption in JavaScript and decryption in Java. I have already tried many APIs, but am not getting the same values in Java. I want public-private ...
3
votes
1answer
2k views

What are the methods to find hooked functions and APIs?

Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
6
votes
3answers
1k views

Computer decryption algorithms and knowing the solution

This is a general question about using computers to decrypt information. It has puzzled me for a while. The question is really two parts: How does a computer check if a "guessed" key is the correct ...
2
votes
0answers
95 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
1
vote
2answers
146 views

Looking for a taxonomy of web attacks

I am working on semantic representation of firewall rules but could not find a good taxonomy of Web attacks in terms of HTTP protocol. I do find web attack classification i.e XSS attack, SQL attack.
1
vote
2answers
387 views

Custom font protection?

I have a custom characters that to most people it appears as chinese, arabic or just some random symbles, it is a simple way I make sure that my written notes are readable just by need. I have grown ...
9
votes
4answers
4k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
5
votes
2answers
693 views

Workarounds for :visited CSS History reconnaissance

Several years ago it was possible to use a:visited { background: url('/log.php'); } to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
-1
votes
1answer
137 views

Would this be plausible for a metamorphic virus? Not repeatedly infecting same system

Would this be plausible for a metamorphic virus? When a new generation (for lack of better word) is created it would hard code a random file name, that would be checked to see if the system was ...
0
votes
3answers
380 views

Can a batch file download a file to infect a computer?

Is it possible to write a batch script that can download some code from the web and infect a computer? Can you explain it briefly?
3
votes
2answers
564 views

Signing data bigger than allowed RSA Block size?

I've enountered a small problem while implementing a modified version of the Station-to-Station protocol (STS). Say we have two principals A and B, where both of them knows the other's public key: ...
13
votes
8answers
28k views

Is it possible to Identify a VPN user by finding relations in traffic?

If I am using VPN service to protect my identity, can my traffic be used to identify all my traffic? For example, if I am accessing two services: Some service A, where I do not leave any ...
17
votes
2answers
767 views

Is there a real possibility of getting malware by “drive-by”?

I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage or clicking a link and getting one? Assuming using only Firefox / Chrome and ...
2
votes
2answers
2k views

What are the most common infection vectors for personal computers?

We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers? A few example vectors: Social engineering ...
-2
votes
2answers
362 views

How to secure passwords when site is opensource [duplicate]

Possible Duplicate: How to securely hash passwords? How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for ...
2
votes
3answers
5k views

windows firewall turns OFF automatically

It seems pretty weird but for some reason, the Windows 7 firewall turns off. After I turn the firewall on in the control panel, it seems that it turns itself off when I go back to the control after I ...
7
votes
3answers
3k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
2
votes
2answers
154 views

Are these email captchas legitimate?

The last week, I've been getting this kind of emails to addresses that I don't use: Dear Sir, Madam, For security reasons and as part of our ongoing fight against spam, it is our policy not ...
3
votes
4answers
547 views

Is there any explanation (other than storing plaintext) for case-insensitive passwords?

I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view. Is there any explanation for why ...
80
votes
11answers
12k views

“Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?

Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
4
votes
4answers
431 views

Is it secure to use similar password over different accounts?

I have a strong password which is a long, unfamiliar word phrase. I would like make other account use a password with similar level of complexity but I don't like to remember so many password over ...
5
votes
1answer
2k views

Any reason not to use same key for multiple SSL domains on one server?

Assume I've generated a server key for use by Apache for SSL. The server will be handling several different domains that use SSL via unique IPs (no SNI). I want to generate a CSR for each domain from ...
32
votes
7answers
11k views

How can crackers reconstruct 200k salted password hashes so fast?

I'm researching for a small talk about websecurity and I found one article about the formspring hack, which made me curious. They claim to have used SHA-256 + salt We were able to immediately fix ...
0
votes
1answer
188 views

Windows security policy analysis tool [closed]

I have several security policy files (INF exported from different Windows machines) which I need to audit. Is there any automatic tool you know of, that can analyse those files according to best ...
3
votes
2answers
2k views

Java Applet for mutual authentication with smart card

I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client). In order to do this I thought the following scheme: 1.Tomcat (server) send ...
-2
votes
3answers
7k views

How do I hide files inside an image without using any steganography tools?

I want to hide files inside a picture. The files may be music or video. Is it technically possible to do this? If so, how? I searched on Google to find methods. Please suggest some methods for ...
4
votes
3answers
688 views

Are there DNS analysis tools that could detect bad DNS results?

Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results? It would be very simply to detect an attack along the ...
0
votes
2answers
402 views

Can a man engaged in phishing be prosecuted if I know his IP?

My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
10
votes
4answers
67k views

How to recover a lost zip file password

I have some files I was given by my teacher at University, I could chase him up, but I may as well try getting blood from a stone, his response rate isn't great and I completed my degree a year ago! ...
4
votes
1answer
149 views

Strategies for signing sections of a text file to prevent tampering

I'm looking for suggestions from the community on the best way to approach this problem of securing a text file while still making it fairly shareable: I have a collection of chef recipes in git, ...
2
votes
2answers
236 views

What may a Hungarian employer do with the employee monitoring logs?

Employers often monitor employee network access, even install keyloggers on their computers, etc. But the articles I found on the internet, is about the monitoring but not what they may do with the ...
5
votes
3answers
27k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
4
votes
2answers
13k views

Lost passphrase recovery for SSL

Today is friday and I'm a desperate sysadmin. I issued a demand of certificate for an HTTPS server, and just received it after more than a long week of waiting, but while my request was processed I ...

15 30 50 per page