2
votes
1answer
320 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...
1
vote
1answer
40 views

Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment?

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production ...
0
votes
0answers
15 views

ASP.NET MVC XSS Validation [migrated]

We are using ASP.NET MVC 5.0 to build a website. If I enter into a textbox some javascript when I save I get a "potentially unsafe input detected" error page - great. However a couple of our screens ...
0
votes
1answer
20 views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
5
votes
1answer
1k views

How does an attacker know when he has the password?

An attacker gets a list of hashed passwords. How does he know when he has cracked the password(s)? He can't try millions of times on the comprised account. Attacker gets hashed password. How does he ...
3
votes
3answers
129 views

Would requiring multiple passwords enhance security?

I assume that it was considered at one point, and that there's a good reason for not doing it, I'm just curious as to why. I'm sure that there are many people who struggle to remember a single ...
1
vote
2answers
63 views

two factor authentication without TLS/SSL

It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds. Would the login be more secure if ...
4
votes
1answer
409 views

Firebug reports SHA-1 certificate error

For the script at the bottom of this post, Firebug reports the following error: This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that ...
0
votes
3answers
84 views

Disadvantages of disabling RC4 in SSL/TLS [on hold]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
1
vote
1answer
27 views

ASP.NET Machinekey encryption

In Asp.NET you can use the MachineKey.Protect to encrypt data. We are thinking of using this to encrypt some data which will be stored in a hidden fields within a web page, these hidden fields are ...
1
vote
2answers
40 views

Why Wordpress doesn't filter post_title?

Today, when I did some tests and found out that Wordpress doesn't filter the post_title. Respectively, I make posts with the titles: <?php while ( have_posts() ) : the_post(); echo 'Post Title'; ...
-2
votes
1answer
66 views

What is encryption by RSA with AES? [duplicate]

By visiting some websites, like bank websites, we can see for example: TLS_DHE_RSA_WITH_AES_128_CBS_SHA, 128 bits, TLS 1.0 I would like to know: What does mean CBC? TLS 1.0 is an old version, is ...
-4
votes
0answers
61 views

Attack trough a (pfsense) firewall with Kali Linux [on hold]

I am beggining with hacking with Kali Linux. I am not doing this because i want to hack but because i want to know how does hacking works. Well, i have tested some few things like making a trojan and ...
0
votes
2answers
64 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
1
vote
2answers
43 views

What is risk of having memcache in public interface?

To what extent a hacker can potentially cause harm to a server? Can you please give few examples? Recently, there was a data breach in my website and I found out this interface was public-facing and ...
1
vote
3answers
93 views

How to hack into a remote mysql database?

(Moved from Stack Overflow as other users said it was a security question) I have a mysql database sitting on a remote server. Nothing else, ie no web site using it, no server side scripts etc, ...
1
vote
2answers
54 views

Log shows many hits to non existing content - hacking?

I have a website with Joomla and 404shSEF installed. The component logs all 404 requests and the log is really interesting. The site is getting requests on components and also a file called this: ...
0
votes
1answer
61 views

What is safebrowsing.google.com ?Does it impact the security testing?

I recently security tested my web application using Firefox browser and while pentesting my webapplication i noticed safebrowsing.google.com,while i diged more about it ,i could able to retreive only ...
2
votes
2answers
86 views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
3
votes
1answer
84 views

Any tools like PuTTY for manually stepping through network communications?

Are there any tools that would allow me to "manually" step through the network-stack processes of a device connecting to a network and communicating with other devices? Similar to using PuTTY to ...
0
votes
2answers
66 views

can this be canceled [on hold]

Limi1.com put up a malware alert on my computer, with an accompaining number to call. it stated for 29.97 it would be fixed. this was last night today I called my credit card, and was told a charge of ...
4
votes
1answer
54 views

Where should a Vulnerability Disclosure Policy be published?

In 2014, the New Zealand Internet Task Force released a set of guidelines for Vulnerability Disclosure: http://www.nzitf.org.nz/pdf/NZITF_Disclosure_Guidelines_2014.pdf Part of the recommendations ...
0
votes
0answers
36 views

How to connect to a VPN, then to Tor? [migrated]

I know it's possible, but how exactly I can do that? I am not able to find any specific tutorial. And will this protect me even if the website is not using HTTPS? Thanks regards!
0
votes
1answer
291 views

How can American Express Serve login be PCI-DSS compliant?

Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process. Here are the steps involved: ...
1
vote
2answers
57 views

What are the pros and cons of using DNS to block unwanted domains?

There are many methods to block unwanted outgoing requests. Examples include browser settings and extensions, and .hosts files. While DNS blocking won't affect direct accesses to a numeric IP address, ...
0
votes
0answers
10 views

Software Defined Perimeter assumptions, properties, deployment scenarios

Since 2013, the Cloud Security Alliance has been working on an open protocol and open source code base for a "Software Defined Perimeter" (SDP). But the whitepaper at SDP Specification v1.0 : Cloud ...
1
vote
1answer
26 views

Angular security in $scope

For our app when a user logged in we are issuing him a token which is stored in session and we are using $rootScope to store his details. This what we are doing if(sessionStorage.loggedIn && ...
1
vote
1answer
78 views

Why doesn't the OS authenticate itself to me?

Sometimes it occurs to me, when doing something like a brew install, or really anything on a CLI (though I suppose this is also true of GUIs to a marginally lesser extent) that prompts me for a ...
-4
votes
1answer
65 views

what is today allowed, when I travel to USA? [closed]

Is there a list of prohibited devices, for travellers, when they travel as normal citizen into the USA, for a maximum of 3 months into USA ? Is it prohibited to carry the following in a bag: notebook, ...
0
votes
0answers
10 views

Speed up Truecrypt decryption with rescue disk [migrated]

Is there a possibility to speed up the decryption of a volume while using the rescue disk? My Windows crashed and I am not able to boot Windows. Unfortunately the decryption of my 300GB Hard Disk ...
0
votes
2answers
30 views

Separate web and app server windows authentication

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server. We provide solutions to clients within an ...
-1
votes
0answers
49 views

Hack/virus visual simulator [closed]

I am curently working on a small film project for my univerity and we are looking for a tool that makes your PC look like you are getting hacked. Like in all movies from cinema with folders popping ...
0
votes
0answers
12 views

Proxy authentication to Web APIs in SSO environment [on hold]

Suppose I have two web applications, A and B. Both A and B are SAML 2.0 SP's hooked up to the same IdP. So in the scenario where a user logs into A, then accesses B, they don't need to authenticate ...
1
vote
2answers
151 views

VyprVPN (from GlodenFrog.com) weirdly keeps sending unauthorized suspecious data even after uninstall [on hold]

Update: Check the VyprVPN's app developer answer below, seems this is okay and an uninstaller is added to new versions to prevent such issues. Original: I was working with VyprVpn a few months ago, ...
1
vote
1answer
45 views

Security of IFTTT

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
1
vote
1answer
32 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
1
vote
1answer
37 views

Secure socket communication between iOS device and 3rd party server

I'd like your advice on what is the best approach for the challenge in my hands... I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end ...
1
vote
2answers
45 views

Threat modelling tools and alternative threats

From looking at threat modelling tools which are available (Microsoft SDL for Threat Modelling is probably the prime example) they seem to consider only threats at a low level, and I get the feeling ...
0
votes
1answer
35 views

Does nmap help to know if firewall is turned on?

Is it possible to know firewall status using nmap? How?
-5
votes
0answers
43 views

How to be come a ethical hacker? [closed]

I'm an undergraduate of Plymouth security. I need to know, get be for Certified Ethical Hacker course, what I should learn
1
vote
1answer
47 views

Is ExpressVPN using Taboola?

I am running on Windows 7, version pro. I have just started paying for the vpn service ExpressVPN. From that point, I noticed that ExpressVPN software was running a nssm.exe process (non-sucking ...
1
vote
2answers
43 views

Potential worm damage on a physically isolated Tor system

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), and I'm concerned about methods a worm could use to infect my OS. In the ...
0
votes
1answer
48 views

Windows Passwords

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account ...
0
votes
0answers
38 views

Designing a security system for road pricing

It's my first semester with Information Security and I still feel a little lost. Sorry in advance for stupid mistakes I may have made. the examples in round brackets below are my own ideas, wrote ...
0
votes
0answers
17 views

Why are 301 redirects misrepresenting true search results ? [closed]

Since I am a layman, but now have some understanding about 301 redirects,302 redirects, and how URLs from page 1 can be moved to let's say page 2 by doing what the following author wrote: "At the ...
0
votes
1answer
48 views

How does crypto help poor people in the third world? [closed]

This is a soft question that I feel is relevant here due to the expertise of this community in practical crypto. The main applications of crypto are government/military — which if anything oppresses ...
0
votes
0answers
15 views

How do I secure a Windows machine via the Advanced Firewall [closed]

I am trying to secure my Windows based machine via the Advanced Firewall and so far I have blocked ICMP and ICMPv6 Echo Requests since I hear a DoS can be done in this sort of way.What other rules can ...
-2
votes
0answers
29 views

Is it possible to locate an AP by knowing its SSID? [closed]

I am doing a research project about data leakage in probe requests. As in these probe requests it is possible to see some SSIDs, I was wandering if it could be possible to locate them. For example, if ...
2
votes
1answer
39 views

Why does SSL/TLS MAC the Master Secret?

At the end of the SSL handshake both the client and server send a MAC over all previous messages and the master secret. However, why do we need to MAC the master secret? The master secret is computed ...
-1
votes
0answers
46 views

LAN cable unplugged but still connected to network. How is this possible without WIFI Card? [closed]

Using Windows 7 on a PC with only LAN cable connection (no wireless card installed) to a Wireless Router with a Laptop using Windows 7, 2 latest model Android Phones, & a SMART TV connected ...

15 30 50 per page