0
votes
0answers
14 views

How to configure Proxychains in backtrack? [migrated]

I am trying to configure proxychains.conf file but when i run any application from proxychains like firefox, it can't open the webpage and also terminal is showing "need more proxies !" ?? I have ...
2
votes
1answer
50 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
0
votes
0answers
9 views

How to store hexencoded ciphertext in Java [migrated]

I am tasked with finding the secret message and I believe that I will have to XOR the different ciphertexts, but I don't understand how to store a ciphertext in a variable in Java. I could not find ...
0
votes
1answer
32 views

Is encrypting and subsequently sending a known clearext string after a Diffie-Hellman bad design?

I'm writing a small protocol that relies on a DH handshake, generation of a shared secret, and subsequent AES encryption/decryption using that generated secret. I want to add a built-in test message ...
2
votes
2answers
81 views

What problem does ECC seek to fix compared to RSA?

Elliptical Curve Cryptography (ECC) is one of the newest encryption schemes to challenge RSA cryptography. What problem does ECC seek to fix compared to RSA? Would you have any qualms with using ECC ...
0
votes
1answer
22 views

In TLS1.2 AES-GCM mode, what happened when input is not exactly the multiple of its block size?

I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate ...
1
vote
1answer
42 views

Is there an example of a web server that does steganographic watermarking?

You could imagine a web app that serves subtly different versions of a page to each user. For example, it might encode the identity of the user in the images it serves. This would be a per-user ...
3
votes
1answer
91 views

PUT vs. POST for password update

I am writing a User Management system that has to include a change of password utility. We don't front end hash passwords (hopefully we will soon). As a result passwords are passed over https in the ...
1
vote
2answers
45 views

Using Free AV to meet PCI Requirement 5

I am looking for some opinions on using free AV for meet PCI requirement 5. The way I read this for version 2.0 is that it's entirely possible for a client to meet their AV needs with the modern free ...
2
votes
3answers
69 views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
3
votes
1answer
71 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
3
votes
1answer
43 views

How does malware hooks ASEPs?

What are the operations made by malware to hook the auto start extensibility points in order to be able to run at the startup of the computer that runs Windows operation system ?
0
votes
0answers
725 views

Can one tamper with flight recorder data? [closed]

I am assume all of you guys heard of the Flight MH17 catastrophe. It would be interesting to know if the Boeing use any Information Security related defense in their black boxes? I think they ...
2
votes
1answer
69 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
1
vote
1answer
60 views

How to post comments on websites without being traced back

Just trying to get some general sense about the security on internet now-a-days. There are so many websites I go and comment on different things. If some comments are political and they don't like, I ...
0
votes
2answers
53 views

HTTPS - ssl error bad cert domain

When I try to visit some websites with HTTPS , I get the error that the SSL is self-signed and that the SSL is only valid for another domain, and that SSL is actually invalid. If the SSL is valid only ...
0
votes
0answers
35 views

Forensics in wireless networks, anomaly detection and beyond? [closed]

Next year I'm gonna be working on my final project in computer security, I have to build a wireless forensics tool that can analyse a data capture and scan it for attack possibilities or weird ...
-3
votes
0answers
48 views

How are hardware anti tamper mechanism usually defeated? [closed]

What are the commons attacks used to compromise/defeats/bypass hardware anti tampering mechanisms ? With anti-tampering mechanism I mean all the mechanism deployed in: box board chips used to ...
7
votes
4answers
1k views

Should the password of a password protected channel be hashed?

Let's take a chat system, where any user can create a channel with a password protection. Thus, other users may only join using the channel password. This password is therefore known to every person ...
2
votes
1answer
71 views

Proper way to ask for parameters renegotiation with SSL

Given a specific SSL/TLS connection, I would like to know what is the proper way to launch a parameter renegotiation, asked from client side. 1) Are they any requirements from the previous handshake ...
1
vote
2answers
80 views

How does Network Address Translation (NAT) increase firewall effectiveness

Truth or bald-faced lie: the cheap $50 router you can pick up at your local electronics store for your home broadband Internet connection is actually a pretty effective firewall. Why or why not? How ...
0
votes
0answers
35 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
0
votes
1answer
50 views

Pivoting without meterpreter [closed]

Is there any way other than Meterpreter to pivot into the network? If yes, then please guide. I already know about Meterpreter, just want to know manual methods other than this.
0
votes
2answers
61 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
3
votes
1answer
49 views

How to intercept requests/responses from Smart Phone while surfing internet?

I have used Burp Suite Penetration testing tool in my computer to intercept requests.Assume that I am using Smart Phone. So Is it possible to intercept my smart phone requests into my computer?
0
votes
0answers
20 views

How to use the Suricata IDS to monitor the entire network? [migrated]

I have the following 3 PCs connected to a router via Ethernet: PC1 – 192.168.1.101 (Linux Ubuntu) PC2 – 192.168.1.100 (Windows) PC3 – 192.168.1.1 (Windows) All PCs can ping each other. PC1 has ...
0
votes
1answer
36 views

Receiving strange data over SMTP where body is one line of random characters

I have a website that has an smtp server open on port 25. There is no outbound functionality on the smtp server. We just parse attachments from our users, then 'queue' the email in a dummy queue. So ...
0
votes
1answer
58 views

can I trust Boxcryptor closed source software? Encryption of files for cloud hoster

Boxcryptor https://www.boxcryptor.com is not Open Source. Can I trust this? Is it secure? No government backdoor? Because there is no alternative for OS X and iOS.
7
votes
1answer
73 views

What considerations should apply for self service Renewing, Revoking, or Unrevoking a certificate?

I need to design a self service portal for renewing, revoking, and unrevoking a certificate and have come up with the following rules*: Renewal Certificates have a short term validity and need to ...
2
votes
4answers
95 views

How Can I Capture Packets of LAN device in Wireshark?

I want to use my computer to capture packets sent by my Android phone in applications: e.g. YouTube. I captured http requests coming from the machine where Wireshark is installed already, now I want ...
2
votes
0answers
27 views

How do I verify a GPG symmetrically encrypted file? [migrated]

I created an encrypted file with symmetric encryption. gpg -c 50GBfile Now I want to delete the original. Before I delete the original, I want to verify the integrity of the encrypted file. Does ...
0
votes
1answer
21 views

Can JS templates for admin-only pages be public

In my page admins-only section is very responsive, so I have to use both server and client side templating. Obviously server side templates are stored outside of web-root and routing takes care of ...
0
votes
0answers
19 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
0
votes
2answers
71 views

How can I identify this hash? [closed]

I'm trying to decrypt my router's root password, since I only have access to a simple admin account that doesn't have root privileges. Here is the passwd file: 0:F.bCrWv/Oxp6.:0:0:root:/home:/bin/sh ...
0
votes
2answers
119 views

Online Shopping password keylogger risk

Suppose I do an online shopping they are asking me to enter my card details like four digit number(whatever related to that) and they are asking me to enter the PIN number too. If I enter all this ...
1
vote
0answers
74 views

HTTP headers of Gmail [migrated]

I just examined the headers of HTTP requests and responses regarding to Gmail. First, I submitted username and password and examined the headers. Then deleted an email from inbox and examined again. ...
0
votes
1answer
77 views

WPA/WPA2 vulnerabilities [closed]

What are the vulnerabilities in WPA/WPA2? I know only WPS brute force. Are there any other vulnerabilities?
1
vote
2answers
86 views

How can I make a read-only filesystem read/write?

I recently hacked into my router which runs BusyBox v1.9.1. I want to edit some files in my web GUI interface which will allow me to get hidden options in it. I'm trying to edit a .js file and replace ...
2
votes
1answer
39 views

MAC vs DAC vs RBAC

Someone can suggest me a real situation in which is better to use MAC (Mandatory Access Control) instead of DAC (Discretionary Access Control) or RBAC (Role Based Access Control)? And in which DAC is ...
0
votes
0answers
19 views

How to simulate an UDP / TCP / Multiple Ports via Honeyd daemon?

I am using honeyd daemon to simulate TCP port on a Linux Ubuntu machine using honeyd.conf file which was configured to do so with the following script :- 1 create default 2 set default personality ...
1
vote
1answer
96 views

How can illegal downloads (not file sharing) be detected?

I understand that copyright holders can identify illegal filesharing over BitTorrent by simply taking part in the sharing process and noting IPs of peers. But how do they detect illegal downloads ...
1
vote
1answer
31 views

series of SSL errors across multiple sites — reason for concern? [closed]

Rebooted my rMBP late 2013 recently, and saw a set of SSL errors (unable to verify certificate) across a wide range of sites (google, gmail, mubi, medium) and also in the Calendar app as it tried to ...
0
votes
1answer
49 views

Using ECC like RSA, to Encrypt/Decrypt

Is there any way to implement encryption/decryption using ECC, like RSA does? For example, say some user wants to send a message containing a symmetric key to user X. Then, in RSA, I could just ...
1
vote
0answers
30 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
1
vote
1answer
42 views

Can any malware access the OSX keychain data

I'm working on a security project. I have sensitive data that I would like to store in OS X's keychain. I'm able to add the data programmatically into the OS X keychain by using RHKeychain. But after ...
1
vote
0answers
67 views

Traveling abroad with encryption software on my computer [closed]

I have software installed on my computer that has encryption capabilities. This is the case both for things like VPN/SSL, and also GPG. I don't really use GPG (there are not that many people I can use ...
0
votes
1answer
42 views

How do I report a vulnerability? [closed]

How would I report an international security vulnerability which could cause a lot of damage? I am asking how & where I would report this vulnerability, not now to create a simple vulnerability. ...
-2
votes
1answer
80 views

good books for learning network and web security? [closed]

I am reading "Hacking The Art of Exploitation" book . i have read till chapter 2 programming but most of it has gone above my head . I want to learn basically cryptography , network security and web ...
0
votes
2answers
75 views

Cryptography protocol suitable for two-way radio communications

Specifically talking about walkie talkie radio networks. Suppose there is a group of up to 16 persons, each equipped with such a unit. Typically, one person will be talking with one another ...
0
votes
0answers
32 views

Sector of small data encryption and transmission

I'm not sure my question is right for this site but still, since its information security so here it goes, I really want to know is there any sector of data encryption that allows or deals with very ...

15 30 50 per page