6
votes
4answers
1k views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
2
votes
2answers
4k views

Force SSL/TLS client cert authentication even if server does not request it?

Usually the server specifies in the Server Hello message if a client certificate is needed/wanted. Does anybody know if it is possible to perform an authentication via client cert if the server does ...
2
votes
0answers
126 views

SAM Card deployment best practice

As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
4
votes
3answers
781 views

Application to monitor software activities

I am doing black box testing on a software which is installed in my local machine. I want to analyze and see the list of files and registry entries that software create/modify/delete. Basically ...
-5
votes
1answer
235 views

How can I crack ArrayOS password [closed]

I have some Array Load Balance device that the user password hash like: user "array" "XXXXXXXXXVkjTX9a1kYtNo". How can I crack the password or find out the algorithm of the hash?
-7
votes
2answers
2k views

Install Metasploit under Cygwin? [closed]

Is there a way to install Metasploit under Cygwin? Metasploit is meant to be run under a linux environment. The Windows installation doesn't have many tools such as msfpayload available. Please ...
18
votes
6answers
5k views

How to avoid scripts with hardcoded password? [duplicate]

I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hard-coded in the script. ...
0
votes
3answers
173 views

Security concept [closed]

How do we know that the systems that we are using are secure? At what point do we have to audit the software that we use? How do unknown security threats affect software over time?
1
vote
2answers
1k views

What is inside a Kerberos TGT ticket?

I would like to know what makes up a TGT ticket? The reason is that we've noticed the more Windows AD groups the account is in, the larger the size of the ticket. We've also noticed that when we clear ...
3
votes
1answer
2k views

What can be used to keep xp_CmdShell in SQL Server disabled?

It's a well known fact that anyone with "SA" privs can turn on xp_CmdShell and use it and that includes any would-be attackers that can gain access to SQL Server as a login that has "SA" privs. There ...
5
votes
1answer
2k views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
5
votes
1answer
530 views

Security differences between Passive and Active RFID tags

Most people are aware there are two types of RFID tags, active tags (ones that contain a power source of some kind) and passive tags (ones that are powered by the RF field). I'd like to know if ...
1
vote
1answer
226 views

AppEngine Sandbox

Does anyone know how the AppEngine sandbox is implemented? I heard they use a SecurityManager with Java but surely they are using another layer as well like LXC. I've looked at the whitelist and there ...
4
votes
2answers
970 views

How does YouTube prevent automatic piracy?

When I visit YouTube, my browser accesses the website and begins to play whatever video I select. By its very nature, this involves YouTube sending the content of the video to my computer. Not only ...
2
votes
1answer
1k views

How was Lulzsec caught? [closed]

I saw that the leader connected to IRC without using TOR and they traced their IP address, but the identity of each member was supposed to be unknown to the others. So even if the leader was acting as ...
2
votes
3answers
617 views

What do web trackers know about/think of me?

Many companies use HTTP cookies, flash cookies, and other analytics to track visitors on the web and classify them. How can I find out what my web profile is currently, and what these trackers are ...
-1
votes
1answer
96 views

Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]

Background: WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company. Alternative one ...
5
votes
2answers
406 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
1
vote
1answer
86 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
3
votes
2answers
179 views

Commonly observed attack patterns modelled in Honeypot configurations

(Judging by voting and answers, I failed rather badly at asking a question that in my head was superbly clear. Clearly I was wrong. I've since attempted to rephrase the original question to more ...
8
votes
2answers
420 views

Backup schedule for Encryption Keys

How often should encryption keys be backed up? Should this be done on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often. Perhaps ...
2
votes
2answers
440 views

Does glibc2 version of the crypt function still use DES for alternative hashing methods?

I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
68
votes
7answers
20k views

Touch Screen Password Guessing by Fingerprint Trace

After eating some garlic bread at a friend's who is not security-aware, she managed to quickly determine the PIN code to unlock the screen of my Samsung SIII. She figured this out by simply holding ...
2
votes
2answers
272 views

Shared vs unique credentials for remote support vendor accounts

I have a situation where my employer has a support contract with a vendor for an application we use. This application runs on a (Windows 2008 R2) server that does not store or have access to any ...
-1
votes
1answer
95 views

How to secure a script that generates an HTML file from other websites?

I have a ksh script (Korn Shell Script) that generates a static HTML file from websites. How can I ensure that the output HTML file will not contain any bad <script>'s (bad JavaScript)? It's OK ...
5
votes
2answers
615 views

Vim Modeline Vulnerabilities

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like: # vim: set someoption=somevalue and will then set those options. This is awesome if I'...
10
votes
2answers
1k views

Plain Text Password Reset Vulnerability

If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
-3
votes
1answer
230 views

w3af plugin development example [closed]

I'm new to w3af, and I would like to build my own plugin. I have searched on w3af web and googled it for some examples but no luck... Can anyone give me an example how to start building plugins or ...
20
votes
6answers
4k views

Malicious Links that Respond to Browsers but not curl or wget

There are some emails with links to people's cracked websites with a malware download Like this kind of email: fake DHL pack station email ... the links often take the form of: http:// www....
-7
votes
1answer
2k views

Hack a LAN with low security [closed]

In our university users have to use VPN to connect to internet.But for local works(like login to university website,checking their university accounts) VPN is not needed.And as I know we have ...
11
votes
2answers
4k views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
1
vote
1answer
86 views

Password Verification Server

I posted a question here... Protecting Password Hashes with Store Procedures? ...where I asked about denying a website's database user CRUD access to the tables that store password hashes except ...
1
vote
1answer
16k views

Unsolicited Password Request from Facebook

Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email ...
5
votes
3answers
3k views

Designing a Sandbox for Windows

I am thinking about the design for a sandbox, which is able to execute arbitrary unmodified, untrusted binaries. The goal is to implement an application Unlike something like e.g. Google Chrome's ...
21
votes
2answers
3k views

Is it possible to write shellcode in C++?

Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of ...
0
votes
3answers
473 views

What does the question mark in nmap output indicate?

In the following nmap output: $ sudo nmap -sS -sV -vv -n -Pn -T5 x.x.x.1-255 -p80,23,21 -oG - | grep 'open' Host: x.x.x.x () Ports: 21/closed/tcp//ftp///, 23/open/tcp//telnet?///, 80/filtered/tcp//...
4
votes
2answers
676 views

How can I find the malicious/backdoor codes without knowing the last modified date?

Last night my website got hacked and attacker edited the main index.php. I was wondering even he edited that file, the last modified date did not change. so I just worry if he would put the backdoor ...
1
vote
1answer
3k views

Certificate authentication with jQuery's ajax() function

I need to sync with my server with the client certificate abc.pfx which is generated by the server using Ajax. How do I send my certificate with Ajax object. Can I do this certificate authentication ...
4
votes
4answers
4k views

Block unauthorized user from getting access to intranet

What's the common way to block users from accessing intranet? Right now, whoever plugs in a cable can access any intranet server freely. I want to change this behavior. But given that we run not only ...
0
votes
2answers
579 views

Tools to extract code comments from sites? [closed]

I often come across sites that have way to many comments included in their source code, sometimes these comments offer valuable insight into whats happening in the code, the logic of functions, unused ...
7
votes
1answer
2k views

How can I spoof the Mimetype of a file upload?

There are posts that says php mimetype isn't secure, or can be bypassed. How do people spoof the mimetype?
11
votes
5answers
2k views

Data needed for why not to load third party JavaScript on web page with credit card form

My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...
4
votes
2answers
2k views

Security test lab setup [closed]

I want to setup a testing lab in my basement for penetration/vulnerability testing & offensive/defensive security skills. I believe I have all the equipment that I need, and if I'll need something ...
5
votes
3answers
547 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
4
votes
1answer
685 views

Nessus HTML5 version 5.0.3 - PCI Scan

I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I ...
0
votes
1answer
640 views

Wireshark Decode HTTPS Root Certificate

I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
0
votes
2answers
720 views

Bruteforce Passphrase of Dictionary Words

Consider the all lowercase passphrase: "lazy fox haggles treaty" Assume all four words are in a dictionary of 2000. Bruteforcing word combinations, how long does it take to crack this password at ...
4
votes
3answers
290 views

Source where you can find if a CVE has a patch or not

I'm wondering if there is a source available which has a list of CVE numbers and shows whether they have been patched or not (and maybe a link to a relevant patch). I know Secunia has something like ...
0
votes
1answer
727 views

Securing my firewall (both dedicated and iptables-based) [closed]

I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection". My iptables look like this: *filter # Allows all ...
-3
votes
3answers
3k views

Database connection from front end

I want to know why calling a database from the front end is considered a bad practice for security. It is really so bad as to justify building an application layer with all its drawbacks: costs, ...

15 30 50 per page