0
votes
1answer
35 views

Does nmap help to know if firewall is turned on?

Is it possible to know firewall status using nmap? How?
-5
votes
0answers
43 views

How to be come a ethical hacker? [closed]

I'm an undergraduate of Plymouth security. I need to know, get be for Certified Ethical Hacker course, what I should learn
1
vote
1answer
47 views

Is ExpressVPN using Taboola?

I am running on Windows 7, version pro. I have just started paying for the vpn service ExpressVPN. From that point, I noticed that ExpressVPN software was running a nssm.exe process (non-sucking ...
1
vote
2answers
43 views

Potential worm damage on a physically isolated Tor system

I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), and I'm concerned about methods a worm could use to infect my OS. In the ...
0
votes
1answer
48 views

Windows Passwords

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account ...
0
votes
0answers
38 views

Designing a security system for road pricing

It's my first semester with Information Security and I still feel a little lost. Sorry in advance for stupid mistakes I may have made. the examples in round brackets below are my own ideas, wrote ...
0
votes
0answers
17 views

Why are 301 redirects misrepresenting true search results ? [closed]

Since I am a layman, but now have some understanding about 301 redirects,302 redirects, and how URLs from page 1 can be moved to let's say page 2 by doing what the following author wrote: "At the ...
0
votes
1answer
48 views

How does crypto help poor people in the third world? [closed]

This is a soft question that I feel is relevant here due to the expertise of this community in practical crypto. The main applications of crypto are government/military — which if anything oppresses ...
0
votes
0answers
15 views

How do I secure a Windows machine via the Advanced Firewall [closed]

I am trying to secure my Windows based machine via the Advanced Firewall and so far I have blocked ICMP and ICMPv6 Echo Requests since I hear a DoS can be done in this sort of way.What other rules can ...
-2
votes
0answers
29 views

Is it possible to locate an AP by knowing its SSID? [closed]

I am doing a research project about data leakage in probe requests. As in these probe requests it is possible to see some SSIDs, I was wandering if it could be possible to locate them. For example, if ...
2
votes
1answer
39 views

Why does SSL/TLS MAC the Master Secret?

At the end of the SSL handshake both the client and server send a MAC over all previous messages and the master secret. However, why do we need to MAC the master secret? The master secret is computed ...
-1
votes
0answers
46 views

LAN cable unplugged but still connected to network. How is this possible without WIFI Card? [closed]

Using Windows 7 on a PC with only LAN cable connection (no wireless card installed) to a Wireless Router with a Laptop using Windows 7, 2 latest model Android Phones, & a SMART TV connected ...
4
votes
2answers
58 views

Securing anonymous website posts

Can a website allow users to securely post anonymously, while still allowing these posts to be edited by the original author at a later time and preventing editing by other users? In this context, ...
3
votes
3answers
63 views

How do I prevent SSD file recovery?

I use a Kingston V300 SSD (specifically SV300S37A) According to this answer The 'best' modern drives support a vendor-specific secure erase functionality. Examples of this are Intels new 320 ...
1
vote
0answers
14 views

using crt for encrypting files/texts [duplicate]

I work with GPGTools under Mac where, after creating a public/private key pair for myself, I usually get .asc from other users, import it and then I'm good to go. Now, I got an actual certificate from ...
1
vote
1answer
20 views

SSL connection between MySQL, Apache and the User's device

I set up SSL connection on my apache web server and I just would like to find out is it enough to secure my connection between the MySQL server, the apache web server and the user's device. Because I ...
1
vote
1answer
26 views

How does union select statement output vulnerable columns

How does union select statement output vulnerable columns in sql injection Consider a SQL vulnerable site. Let the number of columns in the query be 3. So the statement goes, ...
0
votes
1answer
38 views

Website Loading Content from Malicious Sites

I own a website. Now today I find that when I load the site, Chrome shows "waiting for xxx.com" and some other unknown sites. I never added content or links from these sites. The website is running on ...
1
vote
3answers
78 views

Which kind of Wifi is safe to use ?

I travel a lot, so I most of the time get Wifi from Hotel or Cafes. I payed attention to the fact that some Wifi does not have security password ! Here is a screenshot of the type of security I found ...
9
votes
1answer
420 views

What are the problems with creating an own CA for intranet?

In the comments to Creating my own CA for an intranet several people strongly advise against creating your own CA for an intranet. Especially: don't do it. Nope. Bad idea. Buy $10 CA signed ...
1
vote
0answers
33 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
6
votes
3answers
188 views

Why does the SSL/TLS handshake have a client and server random?

In the SSL handshake both the client and server generate their respective randoms. The client then generates a pre master secret and encrypts it with the server's public key. However, why can't the ...
6
votes
3answers
375 views

Is there any security reason that mail services like gmail or yahoomail limit the size of file attachment?

Despite the fact that Email standards such as MIME don't specify any file size limits, but in practice email users will find that they can't send very large files(more than 20 or 25 MB). Some experts ...
1
vote
1answer
18 views

Expand user login in Path - Filter malicious values

I have a function that takes a pathname and substitutes every occurrence of '%u' with a given String. For my scenario this given String is the login that a user/attacker enters via ssh during ...
1
vote
1answer
22 views

Connection between “Security Requirements Engineering”, “Risk Analysis” and “Threat Modeling”

I am trying to figure out how the above concepts fit in together. As i understood it Security Requirements Engineering (SRE), Risk Analysis (RA) and Threat Modeling (TM) are methods that ultimately ...
2
votes
3answers
45 views

What can I do as a user to minimize the risk of online banking?

My bank uses a security system based on a card reader for online banking. The card is the same as used for ATMs and payment in shops. There are several known attacks on this system, for example as ...
2
votes
1answer
25 views

Does Ransomware on one computer put entire network at risk?

I was visiting an office recently where one computer had become infected with a ransomware variant and turned off until the 'network guy' could come take a look (I don't know which one as no one took ...
2
votes
1answer
25 views

What is susceptible to Kon Boot hack tool?

I just learned about Kon Boot (from this YouTube video) and am wondering, how is such a hack tool guarded against? In the video the presenter claimed he had full disk encryption but was still able to ...
0
votes
1answer
76 views

Decrypting SHA-256 with known plain text

If i have a SHA-256 hash and I know what could be the crypted string is it possible to decode it faster? Lets say I know the string is formed like this : %d-%d-%d-%s %d being numbers from 1-25 %s ...
0
votes
0answers
10 views

Should I add signatures to the Netscaler Application Firewall for Exchange, Cognos, etc?

This link describes that I can use Cenzic, IBM AppScan, Qualsys, Trend Micro and Whitehat files to create an application filter for various products. I'm looking for filters that apply to commonly ...
1
vote
1answer
27 views

What are the alternatives to null byte injection attack?

Now that Null byte injections no longer work on PHP, what are the alternative attack strategies used by attackers for remote file inclusion ?
0
votes
0answers
28 views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: ...
-4
votes
1answer
39 views

What kind of hash is this? [closed]

What kind of hash is this, wherein there's a hash and there's a key with it? eg., fe9387012723dcc0f91c687130fcce6e:lreto Is that Blowfish or something? e_e I'm just asking whether these kind of ...
-1
votes
0answers
10 views

Is there any default directory for “nikto” to save all its scaned data [closed]

I am using kali linux to scan my site using nikto . I was wondering is there any default directory where nikto saves its scanned data ? While scanning the site , my laptop restarted . As scanning is ...
0
votes
1answer
29 views

QR-code based credential retrieval?

This is a sort of design review question that I'm hoping is suitable for this site. I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile ...
0
votes
1answer
23 views

SQL Server Asymmetric Encryption Keys

I have used SQL Server database with data to be encrypted and I will use symmetric key for encryption and will encrypt it by asymmetric key now comes the question how to give user permission to ...
0
votes
0answers
13 views

SQL Server Format-Preserving encryption

I have old system with database that has table with column of type char(20) and the customer decided to encrypt that column for some business needs however for some system integration needs the ...
-2
votes
0answers
53 views

Need help with malware [closed]

Hello I have a very weird malware. It infected my android phone and other pcs. I tried to track down the IP with processhacker and wireshark but it's connecting to localhost from localhost on many ...
4
votes
1answer
106 views

SQL Injection explain this query

' 1=1 GROUP BY CONCAT_WS ('~',version(), FLOOR(rand(0)*2)) having min(0) 1>> My first question is what is CONCAT function is being used for in this query 2>> And Why do we use having min(0) in ...
1
vote
1answer
33 views

How to test for CSRF if there are many hidden fields with different values?

Wanted to test specific hidden fields with different values for each with test case of cross site request forgery. How would one do so? Both manual and an automated approach would do. Exclusion ...
0
votes
0answers
17 views

ISAKMP Allows Weak IPSEC [closed]

I have a Sonicwall NSA 4500 firewall and on a PCI scan done a report came back saying "ISAKMP Allows Weak IPSEC Encryption Settings". Best I can find is this might be a false positive related to ...
-1
votes
0answers
37 views

Malware analysis blogs [duplicate]

I'm learning about malware analysis and reverse engineering. I already reversed some simple malwares but I would like to see how other people address malware analysis, so I was wondering if anyone ...
2
votes
0answers
42 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
2
votes
3answers
135 views

Completely encrypting virtual machine (for free) [closed]

I know in VMware workstation there's the option to encrypt a virtual machine. Is there a free way to do this without VMware workstation? I'm aiming for the fullest encryption and encapsulation ...
3
votes
3answers
51 views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
12
votes
5answers
639 views
+500

Creating my own CA for an intranet

I need to create my own CA for an intranet and unfortunately it seems there's no good answer about this on Security.SE. There are many resources online about this, but all of them are different and ...
1
vote
0answers
34 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
1
vote
1answer
50 views

Where to start with api security testing? [closed]

I have the backend api of an iOS application. I would like learn api testing on this. How to begin with api security testing?Please suggest some tutorials and tools available online.
0
votes
0answers
32 views

Dangers of not using VLAN VS dangers of a virtual firewall appliance

We are hosting some customers on vps. Theses customers can access their vps with root access. We do not manage their vm, unless they request assistance. We recently build a high availability cloud ...
3
votes
1answer
69 views

Is there a full disk encyption software that shows different content depending on what password has beeen used? [closed]

I'm searching for a 256-bit full disk encryption software that allows me to access different content on the same disk with different passwords. Like: Password A opens partition 1, password B opens ...

15 30 50 per page