1
vote
3answers
117 views

Why not fix Android root exploit? [on hold]

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
1
vote
1answer
53 views

Cloud-based IM protocols / services saving messages encrypted on server which is decryptable only by user? [on hold]

I am looking for a cloud-based (i.e. not end-to-end) secure IM protocol or service. The first one comes to my mind is telegram. Here is a quote from telegram's privacy policy: Cloud Chats ...
-3
votes
0answers
38 views

How do I decrypt a RSA-SHA1 code? [on hold]

I am working on one project where I am having a RSA-SHA1 modulus code and Exponent value only. which is as follows: Modulus: ...
1
vote
0answers
58 views

Knowing the MAC adress of a stolen laptop [migrated]

Recently my HP 1000 laptop was stolen, is there any way to find its MAC address? I connected my laptop to a PTCL EVO (Pakistan) WiFi USB dongle, but in the device options there is nothing I could ...
4
votes
2answers
524 views

Confidentiality in Digital Signature

Recently I have been working on Digital Signature. Some common reasons for applying a Digital signature to communications are Authentication, Integrity and Non-repudiation. Does Digital Signature also ...
2
votes
2answers
206 views

Can malware provide hidden remote access to a user's desktop?

Is there a possibility that malware on a computer could be providing remote access to an external party without the computer user being aware? I.e., some kind of hidden active remote access tool? ...
1
vote
4answers
88 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
1
vote
1answer
166 views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
2
votes
3answers
135 views

Email confirmation techniques in major sites

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email. If they have not verified ...
2
votes
1answer
41 views

Is FileVault 2 HIPAA compliant?

It looks to me like FileVault 2 uses AES 256 bit encryption for the desk. Does that mean that it meets the HIPAA "data at rest" standard? Is there something else I need to check about it?
1
vote
1answer
33 views

Can Hydra and Crunch be used in combination for HTTP-get-form? [on hold]

I'm trying to recover my router username and password without resetting the router for educational purposes. I read that Hydra can be used for "brute-forcing" http-get-form authentication that most ...
-1
votes
0answers
52 views

Do you know any tip to accomplish this xss? [closed]

I have the following scenario: Test A: https://target/srv;?q=pwn%0Aalert(1);//&ref=B The result: <script type="text/javascript"> if ("pwn alert(1);//" != "") ...
1
vote
1answer
25 views

Why FATCA IDES “protocol” does not use RSA encrytion directly on Zip archive ?

Here is the context: to transmit FATCA data to US IRS service the IDES protocol defines the following steps sign the XML Payload.xml file with enveloping signature, SHA-256 with RSA private key, as ...
1
vote
2answers
68 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
3
votes
1answer
56 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
4
votes
0answers
253 views

Firebug and cURL [migrated]

I have been using Firebug and cURL for quite a while. Firebug is amazing to capture HTTPS POST request as opposed to a network analyser as it is aware of SSL/TLS negotiation. And cURL is amazing to ...
1
vote
1answer
56 views

DDOS Server Attacks & Domain Names

I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs ...
0
votes
1answer
39 views

vpn and strong authentication, how does the two work as a pair?

Dont know. maybe I was to unprecise.... I basically am asking if a SSL-VPN solution is solving both the encryption and the authentication, like that the user authenticates himself to the vpn-client ...
0
votes
1answer
43 views

VPN and authorization [closed]

I wonder, if one should implement two factor authorization and encryption in a client-server solution, how is it done? Of course there can be many ways but some examples would be great. I imagine the ...
2
votes
0answers
37 views

Decrypting Bluetooth application data with the link key

I would like to read the application data exchanged between an Android device and a peripheral. I have managed to log the Bluetooth communication using HCI logger and open the corresponding .cap file ...
1
vote
1answer
14 views

Query on IPS reports

In the IPS reports i see multiple counts of the same exploit from the same source ip. I wonder why would someone continue to attempt exploiting a vulnerability when he must have realized in the first ...
1
vote
0answers
14 views

How to access files or getting rights access with NJrat

When I'm using NJrat to control my own computer, I can't delete, open or move some files. Are there some kind of security access I need to stop first? How can I change this to allow full access?
1
vote
0answers
29 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
1
vote
1answer
37 views

LogJam hardening OpenSSH and testing it [duplicate]

I would like to harden my OpenSSH (clientsite) after the LogJam attack. I read this article https://weakdh.org/sysadmin.html and there is one paragraph, which says how to do that. Is this enough and ...
-4
votes
0answers
41 views

How to convert a 6 byte hexadecimal MAC address to a floating point using the equation REDACTED? [closed]

Is it converting each byte to integer and adding them?
1
vote
1answer
39 views

OpenVPN -cipher vs -tls-cipher?

I'm currently using the -tls-cipher command on server to only allow the cipher I want (TLS-DHE-RSA-WITH-AES-256-GCM-SHA384) but there is the command -cipher too, and OpenVPN's man page is not really ...
1
vote
1answer
23 views

Is it possible to assign different UIDs to subkeys for the purpose of having multiple identities?

Many people advocate generating new primary keys for each identity they wish to have. For example, creating one primary key and associated subkeys for workplace use, and a completely different ...
-4
votes
1answer
63 views

How block SPAM effectively? [on hold]

There is a spammer wrecking havoc in my company. The SPAM emails is not created by any automatic means, but by someone who changes his email every so often after we block him by email address. Any ...
-1
votes
0answers
51 views

Guide me in building a successful career in cyber security field [closed]

I recently watched Mr.Robot tv show and i'm very impressed with elliott-cyber security engineer. I like the way he does all those protecting the servers thing :D I am very interested to know what it's ...
-1
votes
0answers
47 views

Good Places To Learn Penetration Testing With Test Server [closed]

I am an experienced programmer and I want to get into penetration testing. I am looking for a place that has videos and I want something that comes with access to a server to test on. I don't mind ...
2
votes
3answers
104 views

AppSec interview questions?

I am preparing for a technical interview for an AppSec pen-testing position. For those of you that have had AppSec positions, what sharp-shooter questions do you think I can expect? What questions ...
1
vote
0answers
36 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
1
vote
0answers
11 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
1
vote
1answer
28 views

What's the signature structure in TLS server key exchange message?

I'm writing a TLS server. While handling ECDHE-RSA cipher suite, the server key exchange is needed. According to Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) ...
0
votes
1answer
43 views

How to securely derive a second password specific to an user

I'm giving each of my users an unique Blocktrail wallet that is protected by two API keys (which the server knows) and one passphrase (unique to each wallet). I want the wallet's passphrase to be ...
1
vote
2answers
66 views

How to crack `salt + SHA256(salt + password)` hashes with JTR?

I have a set of password hashes. Sample: 9e74437e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806 From the source code of the application generating this hash I learned that the salt ...
-1
votes
0answers
53 views

TeamViewer issue [migrated]

Today I had the stupidity to grant full access to a stranger on my TeamViewer. Don't ask me why, such a foolish thing to do. So once done, he/she created an admin account on my laptop and blocked my ...
-1
votes
0answers
39 views

When will Chrome be patched to eliminate the Logjam exploit? [closed]

I see IE is patched - when will Chrome also be patched to eliminate the Logjam exploit?
-2
votes
2answers
45 views

What IP address is a new email account associated with? [closed]

If records are subpoenaed from google will they reveal internal IP or external IP addresses of a email account? For example if an email address is made and an email is sent using and iPad and home ...
1
vote
0answers
13 views

Volatility Framework 2.4 - No suitable address space mapping found [closed]

I made some dumps with different formats (.DMP and some file made by LiveKD utility) in Windows 8.1 x64 OS. The first one is a explorer.exe dump file which was created by TaskManager->Create Dump File ...
-3
votes
2answers
50 views

How to ensure website from hackers and more? [closed]

I'm really new to security in Websites, for example... So can someone give me somewhere to start please? Sorry if it's not the right place to ask... :|
1
vote
1answer
37 views

How to securely install web applications on untrusted hosts?

In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption. But how to deal with web applications? For example a forum software like ...
2
votes
2answers
213 views

Why is there a “des-ede3-cbc” in my rsa private key?

I have created an OpenSSL RSA private key and certificate request with 4096 bit with the following command: openssl req -newkey 4096 When I view the private key with openssl asn1parse -in privkey ...
2
votes
0answers
35 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time ...
2
votes
1answer
93 views

SSH like promiscuity for HTTPS

I want to build something, but I haven't seen it before. Maybe you have? I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would ...
1
vote
1answer
25 views

Machine readable, user non-readable - XML file

I need some advice as I have been unable to find anything useful via the web - (Google search). I have used the application EventGhost so as to create a custom shell, that I run using the Windows 7 ...
2
votes
2answers
66 views

PHP hack base64 code uploaded and sending mass emails

cPanel server with Exim MTA and Dovecot. Some hacker is finding old scripts at different users public directory, and uploading base64 encoded files then using it to send massive spam. How do I block ...
5
votes
2answers
158 views

Potential employer wants me to email my SSN with an application form, is this a major security risk?

I'm job hunting at the moment and I've come across several potential employers that have PDF's that you would download, fill in, and then email to them. I feel EXTREMELY uncomfortable sending my ...
3
votes
3answers
726 views

Enumerate the subdomains of a given domain - what's the point?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
1
vote
1answer
30 views

Is there a way to sign a 624 bits message on 256 bits

I'm looking for a way to sign a 624 bits message on 256bits (sig length = 256 bits) with an asymmetric keys system? I'm trying to sign a qrcode so a client can be sure that this qrcode has been ...

15 30 50 per page