0
votes
1answer
45 views

Why do we encrypt ephemeral Public key in Encrypted Key Exchange

Encrypted Key Exchange can resist off-line dictionary attack Protocol : A ---> B : Ep (PK) B ---> A : Ep(Epk(K)) K is Session Key generated by B PK is an ephemeral public key ...
4
votes
3answers
567 views

Protected excel sheet is unprotected without permission in google spreadsheet [closed]

I created an Excel spreadsheet using Microsoft Excel 2013 with password protected cells (only particular cells. Other cells can be edited). When I open this spreadsheet in Google spreadsheet, I am ...
0
votes
0answers
15 views

PC in VMWARE can ping Host computer but host computer can't ping the VMWARE machine [migrated]

I'm creating PFsense lab with this diagram The Webserver can ping the outside host (PC3) but the PC3 can't ping the webserver. The firewall i'm using is PFSense. I have disabled all Window ...
-2
votes
1answer
32 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
-2
votes
1answer
96 views

Who can help me decrypt [closed]

There is a string: 51141010379856000173550010000111151512908026 which after encryption becomes: l4yAOVWeHlk4tnNu3HlJnxMUppeOWCpIqmRKkUPQHlgNawdYMDK2mnieDazPkJuI ...
2
votes
5answers
166 views

Can we have https without certificates?

I apologize in advance if I am fundamentally misunderstanding something, but is it possible to have encrypted communication protocols (https, I suppose) without resorting to a certificate system? ...
1
vote
2answers
49 views

bscrypt,scrypt v/s iterative SHA-x [duplicate]

Both bcrypt and scrypt hashing algorithms are designed to increase the resources required during the computation. Hashing passwords with these algorithms can be beneficial as it makes the task of an ...
0
votes
2answers
48 views

Sign SSL certificate with root certificate using openssl

I have created a root certificate, My Root Certificate, with a private key, RSA Private Key 1, using the openssl terminal command. I would like to make a certificate chain such as the following: My ...
0
votes
2answers
84 views

Open email accounts on public computers

When I use a public computer at a certain location, logging into the workstation and going to a site like gmail.com (to check my email) I find that another user is already logged in. Same happens for ...
2
votes
1answer
22 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
-5
votes
0answers
56 views

Hacker uses my IP for cover [closed]

Yesterday, my credit card got hacked and the bank won't allow me to use my Visa card.. When I checked the history I found out the hacker used my IP for cover as he was hacking me, and others, I am in ...
3
votes
4answers
184 views

How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.

I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students; It used to use EAP, allowing students to enter their ...
4
votes
2answers
109 views

In what situations does parameterizing a query NOT prevent SQL Injection?

While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic ...
27
votes
1answer
2k views

What questions should be asked when joining a new security team? [on hold]

I've accepted a position at a different company working on their security team and have been mentally putting together a list of questions to ask so I can rapidly get up to speed in the environment ...
0
votes
0answers
38 views

Malware or exploit kit without escalation kit

Does anyone know of any malware or exploit kit that do not use a privilege escalation kit and just do malicious things with an unprivileged permission?
-4
votes
2answers
46 views

What is the best exploit of XSS within 100 characters? [closed]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
-1
votes
0answers
36 views

I was hacked and know the ip address, what can I do? [duplicate]

My microsoft account was hacked and I know from a security page on their website the hackers ip address, or at least the 'zombies' ip address. I live in the USA and the hacker came from turkey, so I ...
1
vote
1answer
58 views

Safe to disable UAC?

I have programmed my own Windows kiosk application (.NET) which requires admin rights from the OS to ensure certain services are running (amongst other things). However, this causes the UAC prompt ...
0
votes
1answer
16 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
2
votes
1answer
30 views

Strange requests coming from EA4350 Linksys routers

I have had two Linksys EA4350 Routers for a week or so being used internal my network as wireless access points, and all of a sudden I started noticing requests from them once per minute (care of my ...
3
votes
1answer
123 views

XSS: terminology [closed]

Where does the name XSS come from? Why "cross-site"? Also, the book "The Web Application Hacker's Handbook" says that the name XSS is a misnomer when talking about "stored XSS" or second-order XSS ...
0
votes
0answers
27 views

SSO which works well with build tools [closed]

My company started growing rapidly recently, which means we have a increasing amount of internal services. Each of these service use a custom apache module for authentication/authorization purposes, ...
3
votes
1answer
141 views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
1
vote
2answers
46 views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
-1
votes
0answers
37 views

How do I get the IP address and location from an email

Good sirs of Security Stackexchange, I'm a bit in a pickle as I believe that I have become victim of computer fraud where some ruffian stole my ID. I was wondering if perchance there is a way of ...
1
vote
0answers
14 views

Ipsec connection fails

I have two system with fedora12 installed Host1 IP address - 10.1.0.1 Host2 IP address - 10.1.0.2 Then configured IPsec in both machines as below Host 1 config (/etc/ipsec-tools.conf) #Host 1 ...
2
votes
1answer
50 views

Is return oriented programming applicable to pure Java code?

I'm interested in ROP in the context of Java. For now, I don't consider the native code of the Java virtual machine. Is return oriented programming applicable to pure Java code?
0
votes
1answer
50 views

How come PBEWITHSHA256AND128BITAES-CBC-BC violates the 128bit key limit?

In my Java application (which use StandardPBEStringEncryptor by jasypt), when i use the PBEWITHSHA256AND128BITAES-CBC-BC algorithm instead of something weaker such as PBEWithMD5AndDES, i get an ...
17
votes
3answers
2k views

How does Bayesian poisoning work?

This answer mentions Bayesian poisoning in passing and I've read the wikipedia page but don't feel I've fully grasped it. The first case, where a spammer sends a spam with a payload (link, malicious ...
0
votes
0answers
62 views

sniff https traffic and grab credentials with ettercap [closed]

how to access a website with the session id ? thanks very much!! I have the session id but I don't know how to use it
0
votes
1answer
48 views

Securing live Ubuntu USB drive

Live Ubuntu USB drives are used for the purposes of secure transactions e.g. banking, payments,etc in the absence of live CDs since the devices do not include CD or DVD-ROMs. Since there are regular ...
0
votes
2answers
77 views

Trust relationship between domains

I am working in a organisation where it has a structure of parent company and Subsidiary. Both are individual domains without Trust. I work for Subsidiary Requirement is Subsidiary company should ...
1
vote
2answers
98 views

Will CA's still validate internal IP's in SSL certs?

Just wondering what Certificate Authority (CA) policy is nowadays on validating someone's internal IP address in a certificate? I have heard that some CA's used to do this but won't anymore.
0
votes
2answers
36 views

Why does IP address need to be listed as a DNS name in SAN/UCC certs?

I have heard that when creating a CSR that if you want to validate an IP address that you should list the IP as a "DNS" name and not "IP Address". I have actually had to re-create CSR's like this to ...
1
vote
3answers
79 views

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but ...
4
votes
1answer
96 views

What is preventing us to start using scrypt in production ?

After a lot of reading the expert opinion on password hashing, I understand that scrypt (which is both memory hard and CPU intensive) is a good candidate for password hashing. But I saw the experts ...
1
vote
1answer
73 views

Will ios8 encryption fail on forced shutdown?

I understand that IOS 8 data can be encrypted when the phone is locked, and decrypted for use when the phone is unlocked. But let's say the phone was unlocked (and thus the data is decrypted), and ...
2
votes
2answers
159 views

What's the difference between X.509 and PKCS#7 Certificate?

Am I correct calling file with .p7b file extension saved as 'Cryptographic Message Syntax Standard - PKCS#7 Certificates (.P7B)' in Windows - a 'PKCS#7 certificate'? Or is it better called 'X.509 ...
2
votes
1answer
118 views

Key's random art image is mostly black

I have generated an SSH key on Ubuntu 10.04 with ssh-keygen -t rsa -C "example@example.com" and the key's random art image comes out mostly empty (modified slightly): +--[ RSA 2048]----+ | ...
-1
votes
0answers
18 views

Service_KMS.exe Trojan [migrated]

I found out recently that my computer is afflicted with the Service_KMS.exe Trojan. I detected the Trojan with Avast Free Antivirus. After running a boot-scan Avast deleted the files associated with ...
-1
votes
0answers
25 views

Which PCI DSS SAQ applies when you store only the last 4 digits of the PAN and the expiry date? [closed]

Which PCI DSS SAQ applies when you store only the last 4 digits of the PAN and the expiry date?
1
vote
2answers
71 views

What is the best way to run MitM attack on my wireless network?

For research purpose, I want to launch a MitM attack on computers that are connected to my wireless network. I wonder what is the best way to do so. Notice that I control the router, and do not want ...
-2
votes
2answers
36 views

Get the Signature algorithm from a public key? [closed]

When I do PublicKey.getAlgorithm(), it only returns me RSA. Am looking for something to return Sha1RSA. Basically to identify if it is a sha1 or sha2 algorithm. Any help is appreciated. Thanks,
1
vote
1answer
41 views

Do PHP/SQLI Prepared Statements Need Special Character Escaping?

I'm using php/mysqli queries such as this: $stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)"); $stmt -> bind_param('iiis', $uid, ...
0
votes
1answer
26 views

Is there an AES 256 LUKS encryption option in Fedora? [closed]

I have certain information on my drive that I don't want anyone (not even me ;) ) to gain access to. I read recently that Fedora only offers EAS 256 LUKS encryption. This just isn't secure enough ...
2
votes
1answer
101 views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
4
votes
4answers
136 views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
3
votes
1answer
91 views

How is a Tor hidden service authenticated based only on trusting the address?

While being fascinated by how it is possible to create hidden services with Tor, there's a few details around the address collision issue I can't seem to wrap my head around. Quote from Hidden ...
1
vote
1answer
46 views

How can you check if a private key and certificate match in OpenSSL with ECDSA?

I know how to do this with RSA keys (see this article: Determine if private key belongs to certificate?) however I do not know how to do this for ECDSA certificate / key pairs. With RSA keys, the ...
1
vote
1answer
75 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...

15 30 50 per page