0
votes
1answer
35 views

Is there a method to decrypt *.p7m file without key?

I need open .p7m message from my old PC, but I lost my old certs. Is there any method how to decrypt it without key?
0
votes
0answers
12 views

Backup and restore SRK from/into TPM device

Is it possible to store SRK (Storage Root Key) into the file (blob) and restore it from the blob back into the TPM? The question assumes that this operation must be performed on the same TPM device. ...
1
vote
0answers
41 views

How secure is the native browser password autofill?

Safari, Chrome, Firefox, Edge, and IE all either have a suggest-password feature, or password archival feature. How secure are these passwords when stored on a computer? If replicated, how secure ...
0
votes
0answers
12 views

How to enumerate smartcard logon attempts in Windows?

I need to provide my users with feedback when they log on at their workstations. This feedback needs to include: Date/time and workstation id of last successful login Number of unsuccessful login ...
0
votes
0answers
10 views

How can I decrypt data stored using the android KeyChain API? [migrated]

I have an android application that stores secrets using the KeyChain API. I have root access, and I know all of the credentials for the device. I should theoretically be able to decrypt the files ...
1
vote
3answers
59 views

Is it secure to have only https binding in IIS?

I have an API that I want to be accessible only by HTTPS. I know I can use URL-rewrite to force a redirect, but don't want to install additional modules. I was wondering whether only providing an ...
0
votes
0answers
17 views

Risk from browser add-ons?, from external sources [duplicate]

Can a user agent switcher read my passwords? what if it is not mallicious but weak, could it be a faultline for others to hack me?
2
votes
0answers
21 views

Restricted bash circumvention via SSH command execution [migrated]

There seems to be a trivial rbash circumvention, whereby an SSH user can simply request that bash be executed. The environment consists of a restricted $PATH, with a tiny subset of commands available....
0
votes
0answers
22 views

Mobile access is blocked on wireless router [on hold]

My corporate wireless router has blocked mobile devices to connect to it and access internet. I can connect my laptop to the wireless and get internet access. But I want to use internet on my mobile ...
0
votes
0answers
19 views

sql - Select boolean strictly true [on hold]

I want to select a row Ad as boolean which is strictly true. I am using the following SQL statement. SELECT 'user' AS username, 'pass' AS password, true AS Ad FROM users LIMIT 1; However the above ...
3
votes
4answers
948 views

Convert SHA-256 to SHA-1 and MD5 - Increase bit length/entropy? [duplicate]

I know this is a real dumb question and I am certainly talking complete rubbish, but let me explain: We have a long SHA-256 hash, e.g.: ...
1
vote
0answers
36 views

AES256 key exchange

I'm trying to get a secure way of exchanging keys between my client application and the server. The goal is to encrypt all XML messages with AES256. These XML's will be transferred to the server ...
0
votes
0answers
13 views

DNSSEC implementation questions (BIND 9.10)

I am planning to sign multiple DNS zones with BIND and have the following questions which I could not answer by reading the latest BIND 9.10 Reference Manual. How can I use the same ZSK with ...
0
votes
0answers
19 views

viewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem

I am facing the problem "MyViewcontroller using a NULL baseURL argument with the loadHTMLString baseURL method : data theorem"- i have successfully completed my task and all are working fine. Issue ...
0
votes
4answers
160 views

How to block all porn websites from firewall?

I want to block all porn websites and similar contents in my Windows 7 PC using Windows firewall. Till now I can block it by inserting sites one by one. Is there any category defined for such sites or ...
1
vote
2answers
81 views

SQL injection to login when there's no record in the database

I have a question to solve. Well there's no records of username and password in the database and so one cannot Log in without inserting any records. Is there anyway to exploit the following code and ...
0
votes
0answers
13 views

How to tell whether a 802.11 DATA packet uses WEP or WPA?

i am playing with the 802.11 header, trying to figure out the encryption type of incoming 0x08(DATA) packets. 1) I capture the 0x08 type packet (DATA). 2) I find out that a WEP bit is set (2nd ...
1
vote
2answers
50 views

Does PCI-DSS require that the telnet client be uninstalled from a server

Often(not always) I see with my clients' PCI vulnerability assessments the telnet client being installed coming up as flagged, for both Windows and Linux based servers. I understand why a telnet ...
0
votes
1answer
71 views

How can I trust a mobile app? [on hold]

Nowadays we are putting a lot of trust in mobile apps in order to survive in a globalized society. We are even under a kind of peer pressure which madly drives us to use these new applications. One ...
5
votes
1answer
365 views

How to trace and single out this Malware in Browser Extensions? Chrome/ Opera?

There have been lot of articles about legitimate chrome/ opera extensions that get sold out to malicious parties that end up pushing the wrong kind of code down the pipe, since by default these ...
0
votes
0answers
16 views

Log access to one specific file [migrated]

Newbie here, so apologies in advance if my ignorance outshines your brilliance. In my small business, we have a very basic network (4 PC's running Win7). We have a virtual drive on one system that ...
0
votes
0answers
8 views

Sending Probe Request Frames | Receving Probe Response — Scapy

OBJECTIVE Send probe request frame subtype=4 and receive probe response subtype=5 with Scapy Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames ) The object ...
-3
votes
1answer
67 views

Logging into another another person's account [on hold]

There were instances in the past where I logged in with my own credentials, but it showed me as a different user after logging in. How does this usually happen?
-3
votes
1answer
45 views

Which WYSIWYG editor has the best security reputation? [on hold]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
4
votes
1answer
48 views

If my company receives credit card statements showing credit card number, does it have to be PCI compliant?

I understand PCI requirements on the storing, processing and transmitting of credit card information (PAN, expiration date, no on CVV, etc.). However, I found nothing about receiving PAN (no ...
0
votes
0answers
25 views

Authentication in WPA from a user's perspective

I have read several articles that discuss the differences between WEP and WPA but I haven't seen an answer to my question, which is : How is the authentication used in WPA different from that used ...
3
votes
1answer
35 views

Security of “secure messaging” services

There are multiple vendors that offer so-called "secure messaging" services, designed to allow secure e-mail without the need for technology such as PGP, S/MIME or strict TLS between mail servers. The ...
0
votes
2answers
41 views

session credentials on the client

I am developing an IE11 based application running on a web server inside our corporate network The application makes calls to a 3rd party API which requires client certificates and username/password ...
0
votes
0answers
84 views

View the access code, access token, and id token from Google during an OpenID Connect flow

Situation We're wanting to use an HTTP logger/proxy/analyzer to inspect the access code, access token, and id token that are part of the code flow. The flow is happening among Google (the ...
0
votes
0answers
4 views

Can I wipe a password reset disk? [migrated]

Say I made a password reset disk. However, I found it best not to exist, I remember my password quite well. Now, how do I make sure that Windows doesn't prompt "Reset password", make the disk blank, ...
28
votes
5answers
5k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
2
votes
3answers
76 views

Can attackers leverage a sites SSL to “hide” attacks from a IPS?

I am running an IDS on the outside of my firewall (I know not ideal) and an IDS on the inside of my LAN running the same detection algorithms and definitions. My website auto redirects all HTTP ...
1
vote
1answer
34 views

Is Telegram E2E Still Insecure?

This was already asked here, but I have questions about the answer. http://security.stackexchange.com/a/49802/118071 I'm not sure if that answer applies to the full E2E mode. Another answer states: ...
1
vote
2answers
39 views

HTTP session fixation

According to wikipedia, Mallory the attacker gets her own SID and then forces Alice to visit a site with the SID. Why wouldn't Mallory just take Alice's SID, if she could MITM Mallory? Also, is this ...
0
votes
1answer
71 views

How to create a server certificate from a letsencrypt.org certificate?

I have created a letscrypt.org certificate using letsencrypt run which works fine as a SSL certificate on apache2. How can I create another server certificate signed (and thus trusted) by the ...
0
votes
0answers
8 views

How should I manage the output of Scallion?

Scallion outputs a large XML file (depending on your regex settings). What is the most sensible way to sort, and prioritize the best names for the public key? For example, I would need to convert ...
1
vote
2answers
72 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
3
votes
3answers
118 views

What can be done to secure passwords that might be stored in plain text or hashed inside a git repository?

I've heard a lot lately about coders being really bad at security. For one they store passwords and sensitive information inside Git repos which are often not secured well enough. Someone then comes ...
0
votes
0answers
40 views

How do I decrypt Facebook's Messenger SSL traffic on Android?

I would like to investigate the Messenger chat protocol, and to do so i need to see it in clear... I've been able to successfully sniff the (not encrypted) traffic with the 'Shark for Root' but it ...
-4
votes
0answers
14 views

How do provide the android sandbox security to application? [on hold]

I want to know what is android sandbox security and how implement it in application? I want to provide the internal security to application so no other application can check the memory status and ...
0
votes
1answer
56 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
-1
votes
0answers
17 views

An alternative to Echosign with certificate support? [closed]

I'm trying to find some business-friendly solution for digital signature circularization, capable of signing documents using external digital certificates. While Adobe EchoSign-like software does ...
21
votes
5answers
5k views

What is the best way to respond to phishing emails sent from a government domain?

In the past day or so, I've received two emails from different .gov addresses that purport to be from Intuit and encourage me to click on a link to "restore access to your QuickBooks account." They ...
1
vote
2answers
45 views

Should each service running on a domain have a separate certificate?

I have a domain name with dynamic DNS (DDNS) for my home server on which I expose multiple services (web server, wikis, issue trackers, etc.) online. Some services are hosted by the same software (e.g....
4
votes
3answers
229 views

Can CloudFlare be DDoS-ed and issn't the actual DDoS mitigation limit, financial resources?

CloudFlare (known for fighting DDoS-attacks) is explaining quite a lot about DDoS on their website cloudflare.com/ddos. In an article named The DDoS That Almost Broke the Internet they write about a ...
-1
votes
0answers
34 views

Alternatives to Windows Internals [closed]

The shiny new book on Windows 10 internals is coming on December 29. Until this date, what other (official) source(s) can I use/research to deepen my knowledge in Windows domain? Keep in mind that not ...
0
votes
1answer
28 views

Smart Card private key usage

How does an application get the private key from a smart card in order to sign some data? I presume that the data is being signed by a code running on the main OS (Windows/Linux) and not on the smart ...
-4
votes
1answer
71 views

Blocking HTTPS web sites on LAN [closed]

How can I block HTTPS web sites (e.g. Facebook) in our Local Area Network without using a firewall?
-3
votes
0answers
30 views

How to achieve end-to-end security in a Browser-Server architecture?

Let's assume a typical web application with a back-end and a front-end(e.g. a MVC framework using PHP or Python). As far as I have studied and please correct me if I am wrong, it is not a typical ...
0
votes
1answer
36 views

How do I resume a dictionary attack using a custom starting number?

The script below generates 8 digit strings using a combination of characters 0123456789 from number 00000000 to 99999999. crunch 8 8 0123456789 | aircrack-ng -a 2 'HOME-TC-FILE-CAP' -e 'ESSID' -b '...

15 30 50 per page