0
votes
0answers
7 views

Resources and Examples for Modeling Application Security Groups

I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry. I am interested in creating a visio-like diagram that ...
0
votes
0answers
9 views

encrypting chip data and accessing from other platforms [on hold]

i have a similar, yet somewhat differing question. I am not so interested in encrypting the phone per se, but the chip and data within it. I am interested in knowing if the bundled or downloadable ...
1
vote
0answers
15 views

In DNSSec, are Delegation Signer Records always SHA-1?

I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering) The Delegation Signer Record that was created is SHA1. Should I be concerned about this?
0
votes
1answer
28 views

understanding the vulnerability to write a snort rule [on hold]

I'm trying to write a snort rule for this vulnerability; http://www.exploit-db.com/exploits/36360/ however for me to be able to write a good snort rule I need to understand how the software is ...
5
votes
1answer
72 views

How to add certificate pinning for a certain domain to my web browser?

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted. Google's Chrome and ...
3
votes
0answers
33 views

Security risk: Digitally sign communications for SMB

I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: ...
2
votes
4answers
27 views

Is serialisation and HashMaps secure?

I've done some reading in this area and there is very little information about the security of a HashMap. The only article I could find was on IBM's Developer Works site. What hashing function is ...
0
votes
1answer
50 views

Java desktop app vs web service [on hold]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
4
votes
1answer
36 views

Do GPG and OpenSSH use key stretching on their keypairs?

Both OpenSSH and GPG can generate key pairs which are stored as files in well-known paths inside the user directory. A passphrase is always asked for during the generation process, which is then used ...
0
votes
2answers
135 views

Is this the most secure encryption/hashing system? [on hold]

I've been doing some research regarding password security and after reading several topics and the Kerckhoff's principle. I came up with what I believe is a really secure system regarding online ...
0
votes
0answers
13 views

Port mirroring with A LOT of Drops Tx on a 5406zl [on hold]

It seems hard to find info about this specific problem so ANY related input is appreciated (I tried HP-forum and stackoverflow but no luck). Question #1. I've set up port mirroring this way on my HP ...
6
votes
2answers
42 views

Could an attacker prevent IIS from logging requests

I've had an attacker try to gain access to one of my websites through a form using what looks like a blind SQL inject. It is a huge form, and every possible permutation of values has been tried - in ...
15
votes
9answers
3k views

Hide the fact of e-mail communication

Bob has a mistress. Her name is Alice. Bob`s wife Eve knows Bob is unfaithful, but she does not know who the mistress is. Alice does not know Bob is married. Bob needs to communicate with Alice over ...
42
votes
6answers
6k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...
1
vote
0answers
12 views

Mitigating the risk of disabling EPA on ADFS

I'm currently investigating the deployment of an Active Directory Federation Services (ADFS) server for providing Single Sign-on for various services. By default, ADFS enables support for Extended ...
10
votes
0answers
1k views

If you block all incoming connections, how can you still use the internet? [migrated]

If your ISP or firewall is blocking all incoming connections, how can web servers still send you data to your browser? You send the request (outgoing) and server sends data (incoming). If you block ...
1
vote
1answer
56 views

How valuable is a Cybersecurity major? [closed]

I will begin college next fall and have to make a choice between a Computer Science Major and a Cybersecurity major. Which of these two would be more valuable in the information security industry? ...
2
votes
1answer
85 views

Need help deobfuscating malicious PHP

Recently I had a shared hosting server that was hacked; the following line of code was injected at the top of every PHP file on the server: <?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { ...
-1
votes
0answers
48 views

How to solve this flag? [closed]

I'm training for a capture the flag and I'm having some troubles on a flag. I have 2 files (with several thousand hexadecimal chars each, different sizes). How can I discover something hidden in them? ...
0
votes
0answers
39 views

Locking down internet activities [closed]

I have an issue here. We have a bunch of programmers helping to develop code in a lab. However, sometimes they need to surf the web for materials. Our proxy (which is not managed by me and cannot be ...
1
vote
1answer
24 views

What is the relation between ANSI and ISO regarding ISO 27000?

So in one answer I was told that ANSI is a governing body (the only one in the world) for ISO 27000? I think I got something wrong, because I don't see ANSI mentioned anywhere when I read about ...
0
votes
0answers
18 views

Seafile putting mysql access passwords in clear text in multiple files [closed]

I just installed seafile (http://seafile.com/en/home/) and am shocked to see that these files: seahub_settings.py and (if one weren't enough...) ccnet/ccnet.conf do store your sql database ...
0
votes
1answer
15 views

How secure is my rstudio setup? [closed]

I am creating an Amazon EC2 instance to host an rstudio service. This service will be available through a reverse proxy through Apache server on port 443. I am a statistician and I am pretty ...
1
vote
2answers
38 views

Meterpreter and staged payloads

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions A staged ...
0
votes
0answers
21 views

Password vault - Technical Details [closed]

I have some questions about password vault (ex: Cyber Ark) implementations, with focus on Central Password Manager. How is the password vault protected ? Is encryption part of the scheme, or simply ...
0
votes
1answer
65 views

Microsoftonline.com, is this legit?

A couple weeks back I went to google and type in Office 365 to login and download the suite from my account after restoring my PC. ...
4
votes
0answers
125 views
+100

Naive implementation of Rainbow Table and/or Hellman's trade-off

This question is the same one I asked here. Since I haven't got any response or even a comment I will post it here as well. Is there any naive implementation of Hellman's cryptanalytic time memory ...
-1
votes
0answers
27 views

Understanding and trying out buffer overflow attacks [closed]

I came to read this article (It's a bit old) demonstrating stack based buffer overflow attack in an unpatched version of Windows XP Service Pack 1 (Later versions of Windows are reasonably secure to ...
0
votes
1answer
23 views

mod_security : affordable rule sets

I'm looking for practical advice on the OWASP rule set for mod_security. I've heard it has many false positives, and wondering if people have successfully applied it? I can't afford the TrustWave and ...
0
votes
1answer
44 views

Linux Updates to Shellshock

My question is about the community response to Shellshock. What improvements were made in either the Linux development cycle or in the recommendation to its users to prevent something like ...
0
votes
0answers
5 views

Connection Refused on Mac via FTP [migrated]

I have MAC OSX 10.9.5 and I'm new to FTP connection on Mac. I couldn't find a clear list of reasons that I cannot connect to a server. The server is running but when I try to connect through ...
-1
votes
0answers
50 views

How can I tell if someone is intercepting my cell phone signal using mobile signal tracking software?

I've been having many issues with my cellphone such as bad signal, dropped calls, spoofing, jamming, battery temperature over 115℉, can't make calls, not receiving or being received calls, and more. ...
1
vote
1answer
71 views

How to pen-test RAP applications

Has any of the readers here got experience with pen-testing RAP (Remote Application Platform) applications? I am particularly interested in testing on input validation. A cursory research at google ...
0
votes
0answers
16 views

WebGoat Ajax Security - DOM Injection exercise need help [closed]

When I attempt the DOM injection exercise in WebGoat Ajax Security section I get a 408 Request Time-out response. What I've done is type a character in the WebGoat textbox and intercept the response ...
1
vote
1answer
35 views

How someone would routinely email out a Google Doc [closed]

I have seen an issue where an account has been compromised and someone is routinely emailing out the contents of a google doc to another gmail account. The account password has been changed and the ...
-2
votes
2answers
114 views

Is it illegal to access a public file that contain private information? [closed]

There is a website that I was testing to see if they have any vulnerability. To my surprise I found that one of the folders, like /docs with index of /, and they have a file that will contain all ...
4
votes
2answers
74 views

What are you doing if you notice a MITM attack against a Linux server? [closed]

I got this question at a job interview, but I did not know the answer. I think they expected some shell command or packages, which can help react to the attack. Assume that, you are a system admin and ...
0
votes
0answers
4 views

JWT Signature Validation [migrated]

I want to verify the JSON payload for Sender using shared key. I went through some sites and came up with this simple code to just verify only signature. import java.security.InvalidKeyException; ...
0
votes
1answer
75 views

Safely encrypting data received through HTTPS

I am receiving sensitive data over an HTTPS connection and need to store this on disk, encrypted so no one can tamper with it, but for reading later on. Each user in the system has a password. The ...
2
votes
1answer
53 views

Tell if someone accessed my filesystem

In the organization I work for, the computers are connected in a network, and I can access each PC's filesystem via '\' if I state the "Master User" credentials, once the login window pops up. since ...
0
votes
1answer
107 views

Crypto Ransomware - How decryption is done when user accept to cooperate?

When you have been "hacked" and you accept to pay for decrypting your encrypted files, how the attacker do the job ? I understood that a symmetric key is used, itself encrypted by the attacker public ...
-2
votes
0answers
24 views

Security Tool To Control File Transfers on a Virtual Machine [closed]

We are a small small software development company. I want to create for each developer a virtual machine for the developments. Only the virtual machines will have access to the source codes which are ...
0
votes
0answers
24 views

Utimaco CryptoServer Simulator [closed]

I am trying to simulate an Amazon HSM using Utimaco CryptoSrever simulator, but I don't know how to do. I have been searching manuals in Utimaco Site and in the downloaded zip but only I have found ...
17
votes
6answers
2k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
0
votes
0answers
6 views

Key Confirmation Attack [Key Distribution Center (KDC)] [migrated]

Okay this is how I understood it according to this: Alice A establishes a connection to KDC and prepares for session key Exchange R1 A encrypts the request with her key kA(A, B) meaning "need a ...
1
vote
0answers
38 views

OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3

In my server application using OpenSSL, to prevent the poodle attack, I added an option to fully allow/prevent SSL3 protocol. SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); //Prevent SSLv2 ...
1
vote
0answers
67 views

How to remove yellow tracking dots from a document?

Assume I have a document which I supspect to have yellow tracking dots. How can I remove them while keeping the actual information on the document? Is making a b&w copy enough? Is the copy machine ...
21
votes
2answers
2k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
1
vote
2answers
325 views

XSS when some keywords are prevented on the server side

When I scan website with burp suite pro, I encountered a XSS. This XSS is <a b=c> When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters ...
-1
votes
0answers
21 views

Https and FTPS security [duplicate]

Since booth FTPS and HTTPS are protocols over SSL/TLS, is it correct to assume that both are 100% equivalent in terms of security? Or am I missing something?

15 30 50 per page