0
votes
0answers
23 views

Would encrypting a signed JWT prove viable to secure claims payload?

I am working on a server-client web application, and as an authentication scheme, I am issuing base64 encoded json web tokens. Consider the following token... ...
0
votes
2answers
51 views

What's the best place to hide long lived encryption keys

I am considering encryption options for a new Sybase project (internal facing only, sitting in our intranet) for a client that has a security policy that requires all sensitive data to use DB ...
0
votes
1answer
47 views

Detecting datasets that were affected by sql injection

Assuming that I know that one of my applications was attacked by an sql injection, how can I identify edited or selected data sets? On obvious source are webserver logs. This should allow us to ...
0
votes
1answer
24 views

Using virtual server for backing up files

I've purchased a virtual server which I need to run some custom tools every once in a while. I actually don't use any server features of my virtual server, I really just need a Linux machine which is ...
0
votes
1answer
107 views

Why is storing usernames in cookies bad? [duplicate]

A commonly repeated advice over the web is not to store usernames in cookies. However, I don't really understand the problem. What I'm doing in my web application is: I generate a 16-byte (converted ...
0
votes
0answers
3 views

Can I block porn sites using OPEN DNS service or Windows-10 built in tools? [migrated]

I bumped into this site after weeks and even years of frustration as no one seems to know. Paid $10 a year for 4 years for OpenDNS service and thought it was doing what they claimed to do all along ...
0
votes
4answers
88 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
1
vote
1answer
55 views

OpenSSL brute-force attacking and file size

I use OpenSSL with aes-256-cbc to encrypt a 30 GB tar file containing a recent backup of my hard drive. Now suppose somebody wants to run a brute-force attack on this file, trying out all possible ...
0
votes
0answers
52 views

Can someone who owns the wire read my SSL? [duplicate]

This question is regarding internet telecoms when the companies themselves are not to be trusted / cooperating with censorship-oriented governments, etc. Question: Assuming that a telecom owns the ...
2
votes
0answers
43 views

Angular XSS not evaluated

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS. ...
-1
votes
1answer
39 views

Remote Help HTTP GET Request Format String Denial Of Service Vulnerability

Is there any solution for "HTTP GET Request Format String Denial Of Service Vulnerability" in the Remote Help software? I have referred many places but I could not find a solution. Please refer the ...
-4
votes
1answer
81 views

If I am an admin of a WiFi router can I learn the password when it gets change by other admin? [closed]

I have a Huawei WS319 router. The admin password is known to me and my friend. Is there any way to learn WiFi password (through automatic notification) if it gets changed in the future, given that I ...
0
votes
1answer
2k views

A fake Snapchat account has been created in my name [on hold]

A fake Snapchat account has been created in my name, and it is currently being misused. How can I figure out who created it? Going to the cyber cell is a big task. I just want to know how I could get ...
0
votes
0answers
40 views

How to run a GUI program on windows as administrator on a user account? [migrated]

I am making a test program called ResourceManager(RMTest) that tries to access an image "resource.jpg" in the same directory. resource.jpg has access set to deny for all non administrator accounts on ...
0
votes
0answers
66 views

What does this injected query achieve?

On this very good link you can see some SQL injection expressions for MySQL. Quick Detection Error Based SQLi For integer inputs: (select 1 and row(1,1)>(select ...
0
votes
0answers
37 views

Are the ciphers used in this OpenVPN session secure?

I think AES-256-CBC is generally seen as secure, but I'm a bit unsure about the TLS cipher used: Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key Data Channel Encrypt: Using ...
2
votes
1answer
22 views

AuthorizedKeysCommand of sshd_config getting called twice

AuthorizedKeysCommand paramter present in the file /etc/ssh/sshd_config. The bash script which i called using this command is getting called twice. The config file is as follows #RSAAuthentication ...
-4
votes
0answers
122 views

Rank these ciphers in order of difficulty to attack/crack. Explain your reason? [closed]

Caesar Cipher Vigenere Cipher Rail Fence Transposition Columnar Transposition One-Time Pad
0
votes
1answer
28 views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide ...
2
votes
2answers
55 views

Why do I have to do manual XSS testing in addition to using tools such as Burp Suite/XXSer/Xenotix?

At what point does manual testing for XSS come preferred to an automated attack like one through Burp Suite? Looking through bug bounties and various exploits and it's not clear where there is a ...
0
votes
0answers
54 views

Question about the best Security oriented Operating System [closed]

I have a question out of curiosity about the best security oriented OS in the opinion of most in this forum. Of course there are TAILS and the less well known Ubuntu Privacy Release (UPR) which are ...
0
votes
0answers
73 views

Information security career [closed]

I am a fresh Computer Science graduate and passionate about cyber security. I did some research and found out about OWASP for web application security and read quite a lot about it. I have also found ...
1
vote
0answers
30 views

Can I use BitLocker to encrypt my main SSD without a CMOS battery? [migrated]

I removed my CMOS battery because it was dead and the laptop wouldn't start. I have no ability to purchase a new one, but the laptop works properly without it. Can I enable BitLocker on my hard drive ...
0
votes
1answer
74 views

Handling user login using asymmetric cryptography

Is it possible to implement a login protocol with asymmetric cryptography instead of the hashed password method? For example, while creating an account, the client generates a private/public key pair ...
0
votes
0answers
21 views

Add new vulnerabilty module on honeypot dionaea

I want to install dionaea but i am not sure about it's capability to collect modern malware. I see that it use old vulnerabilities modules. My questions are: 1) It is possible to add new ...
6
votes
4answers
232 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
-1
votes
0answers
28 views

Exploiting User Input in Excel File

I'm doing the most basic of basic development projects having taken over someone else. There is an export that happens from a MySQL DB to a XSLX file. If I put my name in as =A1&A2&A3 then ...
-3
votes
0answers
45 views

Bluetooth security when non-paired and/or paired [on hold]

I was reading about Bluetooth security online and, seeing the lack of papers about it (especially when compared to Wi-Fi security), I was under the impression it was secured. More specifically, my ...
-1
votes
0answers
25 views

How secure is this OpenVPN script? [closed]

In my attempt to set up my own vpn server using openVPN, I ran across the following script to automate the setup process: https://github.com/Nyr/openvpn-install What are the risks in using this ...
0
votes
0answers
26 views

Validate Code Signing Root Certificate Offline

I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that. I have no control over the ...
-2
votes
1answer
78 views

An alternative to obfuscation

Recently I devised a way to avoid obfuscation of a jar file, here is how it works: Renamed the abc.jar file to xyz.so Placed it in system folder something like /lib/bdevid/ where other .so files ...
1
vote
1answer
38 views

What is the difference between capture traffic from inside and outside of my network?

I'm thinking to use Wireshark tool to packet capture in my Wireless network. I read something that tells I can capture from inside or outside of my network, just making my wifi board working in ...
1
vote
1answer
32 views

How are DNS requests sent when using ovenvpn? Are they encrypted?

I use openvpn in thru the gnome network manager. When my computer is connected to the vpn do DNS requests look like they come from the vpn exit ip or from my real ip? Are the DNS requests sent in the ...
0
votes
0answers
28 views

is it normal that the alert file of snort is empty?

I installed snort on an ubuntu machine, then I created a simple rule to alert on ICMP packets. I started snort: snort -c /etc/snort/snort.conf -A console -l /var/log/snort and I sent a ping from ...
-1
votes
0answers
54 views

Hacked site/hosting? Or hacked browser?

I need some help. I have a security plugin installed and I received an email notification telling me that A file change was detected on my system for my site. I logged in and noticed no unusual ...
-1
votes
1answer
56 views

How do Bots Spam Where Outgoing SMTP is blocked

I have read,that bots in an internal network talk directly to External Mail servers instead of going through the Internal Mailserver to deliver spam. Query If it's true, than how do Bots spam do so ...
3
votes
0answers
26 views

How to mitigate risk of X11 buffer ghosting on window resize and X server shutdown

The Buffer "Ghosting" Phenomenon It is possible to observe contents of (old and currently used) graphics buffers on a monitor under certain circumstances, posing an information disclosure risk, when ...
0
votes
1answer
42 views

X509 / SSL certificates in practise

After learning the theory behind cryptography I'm having quite some problems understanding how SSL or X509 certificates works in practise and I simply cannot find useful information in the internet. ...
2
votes
2answers
114 views

How do I know that malware on the client computer does not modify data transmitted to my webapp?

I am working on a web application and have had an idea of a new feature I would like to add. The feature includes getting data from the user on their open system and receiving it on my server. For the ...
1
vote
0answers
17 views

Is it safe to use DOMParser to parse client side XML files

Some javascript frameworks or libraries use the DOMParser API to parse XML files from the client. Is it safe to do this. Malicious code can easily be embedded into the XML file (in either the ...
0
votes
2answers
88 views

Is encrypting a CRC with the plaintext ok?

We're using encrypt-then-mac for authenticated encryption, and recently added a CRC32 to the plaintext. Are there any security problems with using a non-authenticated hash mechanism (for example, ...
0
votes
0answers
5 views

Contents of Users\Default folder in Windows [migrated]

Can you help me with two things: On a Windows machine, what does the folder named 'Default' (Found under Users\Default) contain? I have a slight idea that it serves as a template for different user ...
3
votes
1answer
124 views

Browser exploits based purely on HTML + CSS

In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3. This led some to say that the combination of HTML + CSS3 is Turing complete. Regardless of whether HTML + CSS3 is technically ...
0
votes
0answers
24 views

How to create meterpreter session with multi/handler for WAN without LPORT, over VPN?

Actually, my router's WAN IP address is private so i cannot port forward. Is there any way to create metasploit's meterpreter session without specifying LPORT using VPN (i have hotspot shield ) or ...
0
votes
0answers
24 views

Linux server just as RAMdisk [migrated]

I want to setup an anti-forensic Linux server to protect my users. My aim is to have the Linux distro and everything inside of it running from RAM, never storing anything permanently. It is possible ...
0
votes
1answer
85 views

Is Qt framework is under attack or it has something suspicious (only in free version)

I was trying to download Qt framework. I went to its Official site (I'm sure, I checked in Wikipedia) for Visual Studio. But when attempting to download Qt for Windows, my Firefox shows this message: ...
5
votes
0answers
59 views

Is rowhammer comparable to faults caused by radiation?

As far as I know, both rowhammer and radiation based fault injection, can cause arbitrary bit flips in the memory. Are there any differences in matters of possible outcomes of both "attacks" on ...
4
votes
1answer
77 views

How to prevent directory traversal when joining paths in node.js?

I have a node.js webapp in which I need to concatenate two paths in a safe way. The first one (leftmost) is a constant, and the second one (rightmost) is relative to the first one and comes from ...
72
votes
8answers
17k views

How is 'Removing RAM' a security risk?

Today I was watching a video on 'Ethical Hacking' where, while discussing hardware attacks, the narrator said: Removing RAM or components from a desktop or a laptop Here's a screenshot: I ...
3
votes
1answer
58 views

Is there value in slowing down retries on a fingerprint lock?

My phone has a fingerprint lock and it sometimes fails to identify my fingerprint (for example, if it wasn't positioned correctly). If I fail fingerprint identification 5 times in a row, I'm locked ...

15 30 50 per page