1
vote
0answers
295 views

Online Activation Succeeds, Website Registration of same Serial Key Does Not [closed]

I need to ascertain the validity of software I purchased. It passes one check (online activation) and fails another (registration of a software title at the manufacturer website). I am a belated ...
1
vote
0answers
323 views

What is the “crafted DBGCMD_LQUERYLV” in CVE-2014-8904

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8904 lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCMD_LQUERYLV ...
1
vote
0answers
55 views

Has Stackfield been security audited and is the metadata safe?

It appears that Stackfield is one of the only functioning applications that combines end to end encryption, messaging services and file sharing. Peerio has just been launched (literally a day or two ...
1
vote
0answers
37 views

AES and message properties

An active attacker changes the ciphertext which was made using the AES cipher algorithm. Which message properties are preserved even though that change was made. Choose one of the below: 1) Integrity ...
1
vote
0answers
214 views

Run a uploaded file with a double extension? [closed]

I tested some pieces of code from an old project. I found something that looks like it could be an exploit, but I do not manage to exploit it completely. Here is the code: $target = "folder/"; ...
1
vote
1answer
749 views

Bypassing file upload restrictions

However an exercise I do not manage to resolve, I have to bypass a check of extension of a form in PHP. It turns out that just the extension is verified, but certain special characters are replaced ...
1
vote
1answer
139 views

SAPE link injection into website

I currently have a WordPress website that has been updated to latest version 4.1, also latest theme installed. The problem is this SAPE Russian link network that is injecting malware code into the ...
1
vote
1answer
67 views

Is microsoft.com not using TLS/SSL?

On my way to Microsoft to download "security essentials", I noticed that the download page isn't a secure site. Is this legitimately the case, or an indication that I may be compromised in some way? ...
1
vote
0answers
72 views

Where can I find vendor neutral resources on using SIEM solutions? [closed]

I'm taking on new responsibilities in my current INFOSEC capacity and that includes exposure to a SIEM solution. Where can I find resources about learning the fundamentals behind SIEMs. Use cases, ...
1
vote
1answer
116 views

HMAC + AES to guarantee secrecy and integrity?

As an exercise, I am writing some code that accepts a list of possibly secret properties (e.g. user ID, password, IP address), adds a timestamp, encrypts it, and signs it. Here's a high-level ...
1
vote
0answers
108 views

Is there any security risk with adding a **root's** public key to the local user's authorized_keys (so root to login as a user non-interactively?)

Background: I want to try unprivileged lxc containers a try on my small web server (hosting 2-4 users). Since the server is shared among friends, we decided to separate our services from the machine ...
1
vote
0answers
42 views

Secure Third-Party User Forms [closed]

Hopefully this is the correct forum for this type of question. I work in a small not-for-profit in the UK. We wish to have a userform on our website that will allow customers to send information to ...
1
vote
0answers
126 views

Open redirection unique token bypass

I am currently analyzing one job portal web application in which there is an open redirect vulnerability. Vulnerability description is as follows: Request type: GET Vulnerable Parameter: dest ...
1
vote
0answers
115 views

Distribute S/MIME public keys and CA cert for email security

I have my own CA. I want to distribute S/MIME certificates for 10 different users. I saw S/MIME keyservers from http://wiki.cacert.org/KeyServers, but I don't want to use public servers. What is the ...
1
vote
1answer
87 views

SSL with client certificate authentication

can somebody explain to me if for example i use Server certificate, with 2048bit keys and client certificate with only 512bit strength, does this use in any way affect the security of the established ...
1
vote
1answer
261 views

Steganography - retreive secret text by comparing original and text containing picture

I have two pictures: st_original.png and st_secret_key_container.png . The second picture is the same as the first but contains a secret which is the MD5 checksum of some key I'll need to decrypt a ...
1
vote
2answers
254 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
1
vote
1answer
50 views

Banking card certificate

Does anyone have an idea of what kind of public-key technologies are used in the bank perimeter ? Does banking card embedded x509 certificate ? OpenPGP ? Perhaps a standard exists or a de-facto ...
1
vote
0answers
86 views

How does disabling sign in upon confirmation make devise any more secure?

Referencing reasons given in this question http://stackoverflow.com/questions/18655334/avoid-sign-in-after-confirmation-link-click-using-devise-gem Devise does not allow the immediate sign-in of a ...
1
vote
0answers
57 views

Deadbolt will not release key easily [closed]

My car was broken into recently and its left me feeling uneasy about my security. I live in an apartment complex that is getting repaired so the traffic is heavy in and out of the building daily. The ...
1
vote
0answers
159 views

Additional options to protect from bad USB devices in ubuntu

In addiition to the solution options in the other threads How to prevent BadUSB attacks on linux desktop Protecting against bad USB in ubuntu i wanted to ask if it is possible in ubuntu somehow to ...
1
vote
0answers
40 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
1
vote
0answers
34 views

THC-Hydra - one good pass = shows all valid [duplicate]

As in title. I'm testing my router security and I came up with problem. hydra 192.168.0.1 http-get-form "/:un=^USER^&pw=^PASS^:User Name or Password is incorrect." -L usernames -P passwords ...
1
vote
0answers
46 views

Setup local Certificate Authority & integrate with SCEP

I want setup local Certificate Authority and issue X.509 certificates under my CA. In order to achieve this I am exploring following options such as: OpenSSL/OpenCA BouncyCastle Cryptographic APIs ...
1
vote
0answers
64 views

Right security architecture for SQL Server access in a distributed Windows-based system [closed]

I am designing a software product for which multiple SQL Server databases will be accessed by multiple applications residing in different Windows environments. Some of the environments are process ...
1
vote
1answer
1k views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt [duplicate]

I had asked this question in the general forum I think it is more adequate to place it here. ...
1
vote
2answers
65 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? [closed]

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...
1
vote
0answers
99 views

Example of a hacking attempt that failed because of a bug?

We hear all the time in popular press (and increasingly, in government publications + scholarly articles) about how "cyberattacks" make us insecure, because we have so many vulnerabilities (mostly ...
1
vote
2answers
175 views

Why do I have to use multiple keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
1
vote
0answers
314 views

Is hacking my own account illegal? [closed]

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
1
vote
0answers
58 views

Snort only detect local issues [closed]

I have installed two physical machines with KVM virtualization using Red Hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 In h2 the virtual machines w2 , db1 and ids. ...
1
vote
1answer
389 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
1
vote
1answer
2k views

SHA256.DB30.com listing of email account

After searching a gmail account in Google I've found a result for the website SHA256.DB30.com. The page just shows the name of the gmail account and a list with major and minor hash. From my basic ...
1
vote
0answers
132 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
1
vote
0answers
59 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
1
vote
0answers
41 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
1
vote
0answers
156 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
1
vote
2answers
105 views

Quick question regarding suspicious disk space use: [closed]

Quite some time ago I used a friend's computer. I can't remember exactly what I was doing; but as part of whatever it was, I needed to use a USB flash drive. At a point in time soon after connecting ...
1
vote
0answers
71 views

Anything more i can do to be more safer? [closed]

Wi-fi security: WPS disabled WPA2-PSK + AES + 54.000 SECONDS(15h) Group Key Update Period UpnP disabled Spi firewall enable All ALG enable Ignore ping packet from WAN and Lan to router Default ...
1
vote
2answers
127 views

Limitations of botnets [closed]

My question is very closely related to this question but I didn't find my answer there. Specifically, I'm interested in whether the C2 server can modify aspects/properties of the malware and, if so, ...
1
vote
0answers
34 views

Cannot contact my realm for credentials

I have created a KERBEROS.TEST realm on my ubuntu 14.10 virtual machine and after addprinc root/admin also I added mu client machine as principal, I checked kinit and with sudo klist command I ...
1
vote
0answers
166 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
1
vote
0answers
93 views

Anatomy of a Cyber exercise and SOC

What exactly entails an incident response exercise (like a Red/Tiger team excercise)? How does it add value to a security operations center? Is there any good resource I can read up on how to set up a ...
1
vote
2answers
581 views

Websites visited on a VPN network

My residence provide wifi and I'm using my personal computer to connect to it. I use a login and password to have access to internet. Some websites are blocked on it. Sometimes I log into VPN(using ...
1
vote
0answers
66 views

Telling the difference between a prepaid card and credit/debit card

In order to stop people abusing free trials, we can make sure new users are not reusing data from existing users and therefore not just signing up with a new account every month. It is reasonably ...
1
vote
0answers
46 views

Use of RSA in Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
1
vote
1answer
66 views

Necessary components for PGP [closed]

I came across this question during an interview. I was asked: What are the two main components of PGP encryption necessary for it to work? I was thinking in line of Private and Public Keys but I am ...
1
vote
0answers
84 views

Collecting Pre-Authorized Debit (PAD) & Credit Card (PACC) Agreements Electronically

I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement ...
1
vote
0answers
137 views

Passing the hash with metasploit and psexec not working - why? [closed]

I am currently doing a penetratiion test, and have captured a bunch of NTLM hashes via NBSN spoofing. An example (this is not taken from what I captured, and is random but the format is the same) ...
1
vote
0answers
38 views

Who defined the term “fully homomorphic encryption”?

Rivest et al. proposed the concept of privacy homomorphisms, but did not distinguish between partial versus fully homomorphic encryption. Gentry seems to take for granted the idea that fully ...

15 30 50 per page