1
vote
1answer
57 views

How dangerous is reflected request query strings?

I have discovered a possible security flaw in a login for a site that many people rely on. I won't say the site but in the URL there is something similar to ...
1
vote
2answers
65 views

How to prevent phishing mails from being successful? [duplicate]

I'd like to know what the best methods are to prevent success of phising mails. This question contains the following subquestions: What are the best ways to determine incoming phising mails (on a ...
1
vote
0answers
36 views

Why the victim used the server instead of the client?

I just finished creating my own remote administration tool "a server to multiple client one" using System.Net.Socket, - "Watch Dogs fan :P" then I try to search on google how they make or design ...
1
vote
0answers
12 views

ArpON not working

i'm trying to setup ArpON on my laptop running Ubuntu 14.04. I have a DHCP network so in the configuration i uncommented the DARPI line, then set RUN to yes. Then i started the daemon with sudo ...
1
vote
2answers
265 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
1
vote
1answer
26 views

Webrtc privacy issues?

I've been reading about WebRTC, and I'm interested in using it for a drawing web application that uses real-time collaboration. However, as I understand, WebRTC communication requires all parties ...
0
votes
1answer
51 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
1
vote
1answer
38 views

Security during data transfer

I am downloading a file from a http site on an wifi network. Is it possible(even theoretically) to change the contents of the file(or replace it with a malicious variant) during the download process? ...
0
votes
3answers
72 views

How to protect from DoS on get method?

Suppose I have a website and I want to make sure that a hacker isn't making my server down by utilising a DDOS attack on my website. I thought of getting IP address and revoking the access, but it ...
5
votes
2answers
80 views

apple.com exploit attempt?

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to ...
1
vote
0answers
17 views

gpg is trying to sign with an old signing sub-key I no longer have

I got a new smartcard (yubikey neo) and generated a new signing key on it. so now my public key mentions both the old one and the new one: pub rsa3072/B50A93EA 2015-08-13 [expires: 2018-08-12] uid ...
-5
votes
0answers
40 views

Tunnelling for security [closed]

I want to tunnel HTTP over DNS over IPSEC over PPTP over Telnet over PNG (imbedded via Steganography) over HTTPS How to do dis? EDIT: Software I am using is notepad.exe I have tried to do ...
6
votes
3answers
127 views

Using Lynx on potentially malicious websites

After needing to refresh how to unpack an android ramdisk, the site I remember having good information comes up with something similar to this: Being cautious, but still wanting to get what was on ...
0
votes
0answers
32 views

Clicked on an email from past acquaintance [closed]

I received an email from a person I met on a trip. The email asks me to click on a link to get an important file. I clicked because I knew the email address was from the person I knew. When I ...
-2
votes
0answers
59 views

Is it possible for hackers hack my PC [closed]

Please help I don't know those MAC addresses, and when I [lock to folder shared] I see all my information shared without my permission.
-2
votes
0answers
57 views

Did I just get a virus by visiting this site? [closed]

WARNING! This may contain a virus: bestfooz.blogspot.com.br How do I know if I was infected when I clicked that link? (I was using Chrome) There was no pop-ups and I didn't see any download, but ...
1
vote
1answer
48 views

WiFi Network Whitelisting?

At school we have a school-wide LAN network. It connects all the wireless devices to the internet. I've gotten the wireless pass code and have successfully connected to the network, yet I can't use ...
76
votes
5answers
9k views

Can simply decompressing a JPEG image trigger an exploit?

The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords. However, this struck me as unrealistic: Gragg's e-mail contained a poisoned JPEG of ...
3
votes
2answers
57 views

TCP- or UDP-based Port Scans, IP Fragmented Packet

Is this normal or is someone trying to hack/attack me? How can I stop this? My router is a Cg3000v2 netgear provided to me by Optus. [TCP- or UDP-based Port Scan]411 Wed Aug 26 00:28:08 2015 ...
2
votes
2answers
84 views

HTTPS POST request header versus request body

Is there any security difference between placing sensitive data, such as an API key in a POST request header versus the POST request body assuming the API server is HTTPS-only? While you frequently ...
1
vote
1answer
32 views

Finding ecc private key from plaintext and public key

I am working on a message authentication scheme using libsodium and ed25519. The messages range in size from 256bytes to 1k plus the 56byte signature. With a potential of 90,000 to 350,000 ...
1
vote
2answers
52 views

How secure is CodeIgniter 3.x?

How secure is the CodeIgniter 3.x framework? I have read that people discourage usage of CodeIgniter because it is unsafe. The problem is: These posts are old and is mainly pointed to the 2.x versions ...
0
votes
0answers
25 views

How do I identify sensitive information in a Minidump file? [on hold]

I suspect Minidump files contain sensitive information, and I'd like to inspect a file for such information. What approach should I take? Assume that the minidump references either an internally ...
0
votes
1answer
48 views

Is algorithm used to sign defined by certificate?

Using pfx certificate to sign or cypher, the algorithm used (rsa-1_5, rsa-oaep-mgf1p, etc) is defined inside pfx certificate? Certificate has information about algorithms used? Or it's totally ...
3
votes
1answer
65 views

Can I safely and securely store hash(sessionId) in application logs?

I'm considering storing a hash of a user's session ID in our applications logs on each request. This would allow users sessions to be easily tracked back to actions in our logs. I understand that ...
3
votes
1answer
84 views

Exchange encrypted messages on public chatroom

Not so long ago, I was chatting with a friend on our university's accounts, and the discussion went to an interesting subject: what if the administrators have access to our messages? So we had the ...
0
votes
0answers
77 views

Is CASP recognized by the IISP? [closed]

I am Security+ certified (Thanks to SE infosec), I am not considering CISSP for two reasons: An employer looking for a CISSP for an entry-level position does not know what they are doing. For the ...
-4
votes
0answers
70 views

Am I in troubles? [closed]

So I've done a job as a game developer and as payment I chose an origin game (which costs aroung 20 dollars). To that end I've created a new blank email account and a new origin account. Both of those ...
2
votes
0answers
74 views

Impact if password is visible on interceptor in case even we deployed HTTPS [on hold]

Our application is on HTTPS but password is visible on interceptor while when we check it via Wireshark it's encrypted. Is there any risk in it? And what kind of impact it can have?. We provided the ...
3
votes
4answers
77 views

Is CORS helping in anyway against Cross-Site Forgery?

I've been reading in the last couple of days about CORS and in a lot of places it's mentioned as it is a "Security" feature to help the world from cross domain forgery. I still don't see the benefit ...
7
votes
1answer
77 views

Incident Response - Which logs are of most interest following a social engineered remote desktop attack

Unfortunately, someone in my family fell for a phone scam after data was leaked from TalkTalk. As a result, they allowed remote access to two computers and transferred money from their bank account to ...
-6
votes
0answers
31 views

NETWORK SERVICES HIERARCHY [closed]

I want to draw NETWORK SERVICES HIERARCHY of my organization.The organization has IT Department with different sub-sections i.e. Information Technology Governance, Information Technology ...
2
votes
1answer
50 views

Why my XSS attack's onerror method not firing?

I have been able to inject an onerror event to the HTML. In the image you can see onerror has been injected, but it never fires.
0
votes
1answer
59 views

Is mgicinjs.info a virus or malware site? How to get rid of it?

Today I noticed that almost all of my web project (published or in localhost) have a set of weird script references in their pages: And they are all automatically generated - they doesn't appear in ...
1
vote
2answers
58 views

What is the real benefit of a three tier architecture?

As per title, what is the real advantage of using three tiered architecture, where the user interface in one layer, the second layer for application and third layer for database? I can understand that ...
0
votes
3answers
55 views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
0
votes
0answers
36 views

Identify if a server is currently accessed via Remote Desktop Connection [migrated]

For instance I have a server that is used by 4 people and there is only one account in that server. We know that when someone is already accessing it and another user accessed the server, the current ...
1
vote
2answers
42 views

Is it possible to safely watch a specific folder with virus scan on Windows Server?

I have a website that must allow numerous file types to be uploaded, some of which could possibly be dangerous, such as a word document. There's only a single website on this server that allows this. ...
0
votes
1answer
71 views

Active directory authentication and authorization for an application

Currently all our applications are web based and our authentication and authorization mechanism is always through the database. eg database logins and access controls defined at database. However now ...
4
votes
2answers
85 views

Is encryption possible for simplex (one-directional) TCP/IP, and if so, how?

As explained in the TCP/IP Guide, it is possible to configure TCP/IP to operate in simplex mode and this mode is utilized, among other things, in communication from satellites. One consideration with ...
2
votes
5answers
82 views

Best practice to guard against an app copying private ssh keys stored under ~/.ssh?

Given that any application running as the logged in user will have read access to that user's ~/.ssh folder, it seems trivial for the application to copy that user's private key and send it over the ...
-1
votes
2answers
69 views

How can I defend against a data theft attack without shutting down my server/services? [closed]

According to information I've gathered on this site, no perfect defense is possible in the area of webserver security. The underlying software and / or maintainers of the system can be exploited to ...
2
votes
1answer
82 views

Can I completely impersonate another wireless device?

I recently decided to fix up an old laptop by replacing some missing parts. I installed Kali 2.0. I also figured the most secure OS should be an OS designed for use by security professionals; ...
0
votes
0answers
23 views

How to protect against SQL Injection in Jaggeryjs?

I am working with Jaggeryjs now which is a server side JavaScript like Nodejs. When I tried the example mentioned in the documentation, They have provided simple example just like Statement in Java. ...
2
votes
3answers
45 views

Layer model for information security - scientific name?

Some days ago, I was talking with a friend about the Snowden revelations and its impact on Infosec awareness and how quite a number of (supposedly) secure alternatives to established services have ...
9
votes
1answer
160 views

New social engineering tactic that uses printer serial numbers?

We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company). Basically, the flow of events is this: ...
0
votes
1answer
77 views

“If encryption has not been implemented, a comparable alternative has been implemented” [closed]

What constitutes as a comparable alternative to encryption? I know that password keepers and other services are not comparable and are not considered encryption. If the context is authorized access ...
4
votes
1answer
150 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
4
votes
2answers
116 views

Usage of Ephemeral Diffie-Hellman ciphers in 2015 and beyond

In determining TLS standards for my company, I have come to wonder why all recommendations still suggest the use of the Ephemeral Diffie-Hellman TLS ciphers starting in TLS_DHE_xxx Background and ...
2
votes
2answers
31 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...

15 30 50 per page