2
votes
1answer
101 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
2
votes
0answers
95 views

A fledgling idea: Relational Encryption [closed]

I've been spending my spare time coming up with the basis for an encryption algorithm. I am completely unfamiliar with computer programming, but my time as a Network Technician left me incredibly ...
2
votes
2answers
228 views

How secure is loging into internet banking via an https library?

My bank does not have an API so I want my server to log in and check incoming payments to notify me if a client has paid or not. I would like the server to log in and scrape using Beautifulsoup and ...
2
votes
2answers
531 views

Practical steps for encrypting an encryption key for data stored in MySQL

So I'm working on my first project where user data is stored as encrypted using the user's password as (part of) the key. I have read many similar things about best practices, but the details seems to ...
2
votes
3answers
378 views

How does Facebook really identify requests?

Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular ...
2
votes
0answers
46 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network.
2
votes
1answer
227 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
2
votes
0answers
75 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
2
votes
0answers
2k views

Just how intrusive IS Cortana? [closed]

According to Microsoft's privacy statement: To enable Cortana to provide personalized experiences and relevant suggestions, Microsoft collects and uses various types of data, such as your device ...
2
votes
0answers
408 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
1answer
235 views

Use RSA Encryption With ASP.NET

My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to ...
2
votes
0answers
90 views

Where to search for vulnerabilities in a WordPress theme? [closed]

I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection (...
2
votes
0answers
64 views

Failure analysis to avoid locking permanently online accounts [closed]

(I reposted here a question I previously asked in SuperUser, I think this section is more appropriate) Back in the days defining a path leading to loss of data or loss of online accounts was easy: ...
2
votes
0answers
40 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
2
votes
0answers
52 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
2
votes
0answers
59 views

Can high network usage be detected and prevented in Tor? [closed]

I've already asked this question here but as of yet it has no views/answers. I was wondering if there is any way for Tor to detect high network usage in the context of transferring large files using ...
2
votes
0answers
390 views

Using .apk files to reverse_tcp and exploit on android? [closed]

I have been able to install and run the application that I plan on exploiting. Once the app is running I am able to exploit the application. In my testing environment I am able to do this just fine. ...
2
votes
1answer
492 views

Using RSA for Web Application Authentication

I have a network that is only accessible through bastion servers over ssh. In it, I am developing web applications that are exposed to end users via GUI's served up over websockets. All traffic into ...
2
votes
0answers
159 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
2
votes
0answers
49 views

Risks when connecting Public WLAN networks [closed]

I want to refer with my question directly to a question posted on the forum before. wifi topic I am running teamviewer on my android which is not rooted and i am not using a firewall on it. I guess ...
2
votes
0answers
150 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
2
votes
0answers
35 views

Nation-state digital signatures - how is my public key linked to an identity? [duplicate]

A bitcoiner trying to understand the nation-states. When I use my eID (I'm swedish and I have 'BankID'), and I sign something with my private key that's in the 'eID-file' that I've got on my laptop, ...
2
votes
0answers
116 views

Is there an iframe attack surface to webcache.googleusercontent.com?

I've noticed that one of my web-sites shows up pretty much blank when viewed from Google Cache at webcache.googleusercontent.com, because Google apparently must be inserting the following extra header,...
2
votes
0answers
109 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
2
votes
1answer
100 views

How would a nation-state provide an API for its citizens to verify their legal identity online? [closed]

An official nation-state institution, like the Swedish Skatteverk, could easily let their citizens verify themselves online. O-auth tokens could be created by the nation-state institution, generated ...
2
votes
0answers
84 views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
2
votes
0answers
197 views

Hydra - Possible to follow redirects

I'm trying to use Hydra on an ASP web application. Their login page uses the following method: site/Login: username/password If successful, I am redirect back to site/Login but with a newly set ...
2
votes
0answers
109 views

Ways to prevent traffic injection by ISP [closed]

I live in a big brother country (Egypt, but valid to many other countries), which apparently bought Hacking team and fin fisher software since couple of years. After reading about the very-easy ways ...
2
votes
0answers
198 views

DNS Server Recursive Query Cache Poisoning Weakness “Bounce DoS”

Tenable Nessus states that if there is a DNS Server Recursive Query Cache Poisoning Weakness the host allows recursive queries via UDP, then the host can be used to 'bounce' Denial of Service attacks ...
2
votes
1answer
119 views

How can I detect subnets? [closed]

Given a WAN, which is connected to the internet via a single exit point. Inside this WAN, I don't want to have any subnet structures. Every user gets his own access point, which he can expand via ...
2
votes
0answers
58 views

Where should I store encrypted data so as to have app-exclusive access?

I am using windows Data Protection API (DPAPI) to protect private key used in my application. I cannot hide entropy used in DPAPI call because my application needs to be open source. Where should I ...
2
votes
0answers
148 views

How to do side channel attack on smart cards? [closed]

Assume that I have a smart card and I want to do a differential power side channel attack on its mutual authentication mechanism. This is the mutual authentication mechanism that my card using(Let ...
2
votes
0answers
128 views

Should Mozilla SSL3/RC4 whitelisted sites be blacklisted by admins/users? [closed]

As of Firefox 39, Mozilla has dropped support for SSL3 and RC4... and whitelisted 519 (!) non-compliant sites: (https://mxr.mozilla.org/mozilla-release/source/security/manager/ssl/src/...
2
votes
3answers
142 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
2
votes
0answers
90 views

A simple HMAC question

Suppose I use a key (and IV) to encrypt a piece of binary data with AES-256-CBC to produce the corresponding encrypted data. Suppose I then throw this encrypted data into HMAC-SHA512 using the same ...
2
votes
0answers
187 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
2
votes
1answer
287 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
2
votes
0answers
86 views

How to access files or getting rights access with NJrat

When I'm using NJrat to control my own computer, I can't delete, open or move some files. Are there some kind of security access I need to stop first? How can I change this to allow full access?
2
votes
2answers
358 views

PHP hack base64 code uploaded and sending mass emails

cPanel server with Exim MTA and Dovecot. Some hacker is finding old scripts at different users public directory, and uploading base64 encoded files then using it to send massive spam. How do I block ...
2
votes
1answer
29 views

Is there an implementation of a trust on software on a host?

What I'm after is a trust that is established between the hardware and the software intended to use that hardware. This may require a certificate "burned in" to a specialized chip. The open SSL may ...
2
votes
0answers
52 views

Security implications of providing an encryption/decryption oracle

I need to provide a service that acts as a symetric encryption/decryption blackbox : the box get a secret key k users send datas d, and get ciphertext c = Encrypt(d,k) users send ciphertext c, and ...
2
votes
0answers
184 views

How do I sniff Z-Wave packets with a Zulu Transceiver [closed]

I'm trying to sniff the communication between Z-Wave devices. I have set up a "smart home" consisting of a few devices using Z-Wave technology, which use the frequency 868 MHz. I have been told that I'...
2
votes
0answers
125 views

Metasploit reverse_http(s) PAYLOAD for linux target

During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category. What ...
2
votes
0answers
333 views

Good Library for RSA-2048 in C with some restrictions [closed]

I'm looking for a C/C++ implementation of RSA with a 2048 bit key (preferably read from a file). My target is an embedded platform, so it comes with some odd restrictions. The hardware restricts us ...
2
votes
1answer
2k views

Nginx - SSL Website shows up on desktop but not mobile

So I bought a Comodo SSL from Namecheap and put my site up on a Ubuntu droplet on DigitalOcean on a nginx server. My default virtual host file on /etc/nginx/sites-available/: server { listen ...
2
votes
0answers
44 views

Potential hazards for reusing an X.509 private key for multiple services?

One thing I've been thinking about for a while is using a X.509 private key stored in a hardware security device (think YubiKey et al) on a one-per-machine basis. Theoretically, it should be possible ...
2
votes
2answers
133 views

Is it possible to encrypt a download twice, once with a different encryption method?

So without giving too much away, the basics are that I have a board that needs an operating system, so I go to an IPL server to supply that operating system. I have a verifier in the middle and my ...
2
votes
0answers
997 views

Convert RSA openSSH key/putty key to gpg key [closed]

Scenario Two work sites, site 1 and site 2. Two Linux servers, server A and server B. Server A is reachable from both sites, while server B is reachable from site 1 only. Two Windows workstations, ...
2
votes
0answers
62 views

Manual IPsec and session key(s)

I am evaluating IPsec. I have determined it is best for my case to not use AH (will use PSK for authentication). One issue I have is that at the start there will be no connectivity, so IKE will not ...
2
votes
0answers
45 views

Possibility of widespread deployment of IPsec

I want to know if IPsec is a candidate for a widespread deployment in the Internet. So far IPsec seems to be adopted merely in VPN networks. IPsec seems to have problems with NAT-traversal and another ...

15 30 50 per page