0
votes
1answer
29 views

metasploit+openvas error

switched to openvas a couple days, is open and does the job.. so far so good, but I hit a wall.. with metasploit I load the module, I log in, fine.. but when I run some tasks I get some errors.. I ...
5
votes
1answer
117 views

Why do certificates need thumbprints?

I recently learned mechanism of certificates. But I can't understand why a "thumbprint" is included in a certificate. For intermediate and end-user certificates, it is verified by its issuer. so it ...
-1
votes
2answers
41 views

Block requests containing URL of other websites

GET / HTTP/1.1" 200 166113 "-" "Mozilla/5.0 (compatible; dsada/2.0; +http://www.asd.com/search/asddd.html) I found this request repeated continuously in my logs. How can I prevent this (requests ...
-3
votes
0answers
49 views

Is someone attempting to hack one of my accounts?

I set up a Skype account from my phone. (I have no idea if this has anything to do with it.) Then about 2-3 seconds after that I got a text message from the number 732873 saying Microsoft Verification ...
0
votes
1answer
22 views

Beef conection timeout problem [closed]

I'm unable to get the connection back from the victim in beef framework when the victim clicks the beef exploitation link. Anyone know what I might be doing wrong?
3
votes
2answers
78 views

Card number leaked, any consequences?

Someone I know made their credit card number available for a large audience. As described in this question, one can bill without CCV code. So, given the card number and no other info (no CCV, no ...
0
votes
2answers
29 views

Wondering about open port found while using VPN service

I have noticed during port scanning that my "anonymous" IP has an open port (111) while I am using VPN. Does this make me vulnerable as user or is it the provider's failure? Should I change ...
4
votes
4answers
855 views

Could technical controls prevent vehicle ramming attacks?

We've just seen another attack where a vehicle was used as a weapon. My thoughts are with all those affected by the tragedy. Many people are wondering how such attacks can be stopped. It's hard for ...
3
votes
2answers
124 views

Why does DISA STIG recommend “Deny access to this computer from the network” for Domain Admins?

For Windows systems, the U.S. DISA STIGs recommend enabling the Deny access to this computer from the network for the Domain Admins and Enterprise Admins groups: https://www.stigviewer.com/stig/...
0
votes
1answer
55 views

How does malware downloaded by JavaScript get executed, and why would you distribute malware in a .js file?

I have two questions about JavaScript as an infection vector. The first one is about a user getting infected while visiting a website, and the second is about getting infected by e-mail via attachment....
0
votes
1answer
57 views

Should you use Radius and LDAP together?

For example I'm reading something right now that says: "The authentication server is a RADIUS server, which authenticates virtual machines through a Lightweight Directory Access Protocol (LDAP) ...
0
votes
0answers
13 views

gnupg: Use specific key for symmetric encryption of stdin [migrated]

I'm looking for a way to use gpg2 to symmetrically encrypt stdin and send it to stdout. echo "Unencrypted" | gpg2 -d -symmetric klgkljfgkls... [encrypted] I could not figure out how to specify ...
0
votes
0answers
22 views

Does the CASB protect cloud applications and its data end-to-end? [closed]

CASB definition from Gartner site is here. From its definition, one can see the CASB covers most of enterprise security requirements which are mandatory on any deployments (cloud or on-premise). ...
-2
votes
1answer
43 views

is there any way to get the cookie from another tab or iframe's parent in browsers?

i was given a task to find a working way to bypass windows and android browsers same origin policy to be able to get the cookie of an open Tab in victim's browser (like Gmail or ... cookie). but as ...
0
votes
0answers
12 views

Advantages and disadvantages of two-party ECDSA [closed]

I have to study two-party ECDSA and evaluate it. I understand how it works, it uses paillier crypto system and that affects its performance. I need to evaluate it more precisely, so can you explain ...
-4
votes
0answers
27 views

What to do/report for unnervingly generic phone call? [closed]

I glanced at Extremely suspicious phone call -- what to do? and I think I have a slightly different call setup. Basically, from the time I called back (the number shared my U.S. local area code), it ...
0
votes
2answers
105 views

Can someone trace me from mobile phone IP?

I have mobile phone, on which I am using internet. My phone number is registered under name of my employer, because they give you services like cheaper call fares, etc. I also purchase internet ...
-1
votes
3answers
54 views

How to deal with suspected Router infection? [closed]

While connected to my router, whenever I open any web page in a browser, on any device, it opens 3 tabs of ads instead of the page I want. "Clean" devices that I connect to the same router also ...
0
votes
1answer
57 views

What is the weakness/Flaw in ransomware that security researchers use to make a decrypter? [closed]

I have question about the weakness/Flaw in ransomware. From reading the write-up of security researchers who find a weakness/Flaw in ransomware I know that to make a decrypter researchers should find ...
0
votes
0answers
45 views

Stored XSS confirmed both by Netsparker and Acunetix

Both Acunetix and Netsparker are warning me about stored XSS. Acunetix URL encoded POST input langSelected was set to 1' onmouseover=prompt(973181) bad=' The input is reflected in www....../home....
0
votes
0answers
33 views

Security Analysis, Examples

Im currently looking for a Bachelor Project and got a proposal that would entice security/risk analysis of a device. The security analysis would be around 70 percent of the project. I got an abstract ...
0
votes
1answer
37 views

Where to expose flaws in security? [duplicate]

Some websites have ridiculous security flaws. Thankfully the public is slowly becoming more aware, and many sites are fixing the more obvious ones, like lack of HTTPS, poor password creation ...
-3
votes
0answers
27 views

how to find a demolition software that run on android using adb? [closed]

Is it possible to find some demolition software that runs on my android device using only adb ? So i want to use adb to see if there is malware on an Android device. I mean that i want to see all ...
0
votes
1answer
10 views

Is it possible to use custom DH parameters for IKEv1 / IKEv2 /IPSEC?

While researching how to deploy TLS for web servers most securely, I have learned that using custom DH parameters is one of the key aspects. Now I am in the process of deploying IKE / IPSEC. As far ...
0
votes
0answers
9 views

Where can I find sample logs/ loggin templates or generate them ?

I am trying to build an environment that will generate simple data, basically simulating small client environment. I have a tool that can generate data from sample log files and modify them/replay ...
0
votes
0answers
12 views

Medical Device - FDA compliance [closed]

what are industry best practices to secure servers and IT infrastructure within a medical device industry ? Looking to compare what we have to the industry standard or compliance body.
0
votes
0answers
17 views

Reuse key to encrypt signed content

I am developing an application which generates JWT tokens which are signed using HMAC-SHA256 algorithm during their generation and later on encrypted using Fernet library. Since the signing and the ...
80
votes
9answers
14k views

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
0
votes
1answer
31 views

Password generated from keyword [closed]

I have some keywords and the respective passwords. They are all in the same format, keyword is like 12345 and the password 00aa11bb. Given a long enough list os keywords and passwords is it possible ...
-3
votes
1answer
52 views

Do current eCommerce systems provide sufficient security? [closed]

eCommerce systems are increasingly gaining importance in modern digital markets. Since most electronic transactions occur on a range of platforms, securing e-commerce transactions using Mobile Agents ...
0
votes
0answers
13 views

Are JWT secure for a REST API? What should I look for?

I am develloping a REST API in node.js, and chosed to use JWT for authentification. What I do so far is: Use the standard JWT library. Verify the token for each request. Set a short lifetime out ...
0
votes
2answers
23 views

Kali Linux: wrong kernel. What to do? [closed]

What does this mean : Unable to boot- please use a kernel appropriate for your CPU what do I have to do ?!
0
votes
1answer
79 views

Should the password be stored in a variable before encryption?

I am currently writing an App using CodenameOne, and there is a login screen, where the user needs to insert their account and password. Now I was wondering, what would be the best way to access the ...
2
votes
2answers
88 views

TLS Version specific cipher suites

I have come across that GCM, CCM, SHA-256 and SHA-384 Cipher suites are TLS 1.2 only. So TLS handshake can not be performed with lower TLS version using these suites. I am trying to figure out ...
0
votes
1answer
71 views

How does ISP intercept web traffic?

My question originates from following articles: http://www.theregister.co.uk/2016/07/14/cloudflare_investigating_mystery_interception_of_site_traffic_across_india/ and https://medium.com/@...
0
votes
0answers
44 views

How can I identify this (I think) symmetric encryption? [closed]

I'm working on a CTF and I'm trying to decrypt some cipher text. I've got a key and the cipher text, but I'm not sure how to determine the algorithm used. Key: ...
-1
votes
0answers
32 views

RC4 Encrypting Plaintext, Key of 3 Bytes [closed]

Good afternoon! I tried to Encrypt a Plaintext of length of 3 Bytes with the Key of length of 3 Bytes, but it gave a wrong Ciphertext as I can't receive same Plaintext during Decryption process. I ...
-1
votes
1answer
68 views

Track employee browsing on mobile broadband

We've a few employees to whom we need to give mobile broadband dongles (along with laptops) on a regular basis. I'm tasked with finding ways to track employee browsing outside of our company's domain ...
28
votes
6answers
3k views

Is there any reason I shouldn't make a GPG-encrypted file publicly-accessible?

I'm working on a project where we need to keep a few specific files easily accessible, but encrypted. My idea for accomplishing this is to have the files available in the project's public website, ...
0
votes
0answers
7 views

What are the security implications of external call by moviecliploader.loadclip(externalUrl)

I want to use a piece of Actionscript in this fashion var loader = new moviecliploader(); loader.loadclip("http://" + imageLocation, imageHolder); The web application firewall will keep out any jar:...
-1
votes
1answer
56 views

Using old router as wi-fi extender/extra security on shared network?

I just moved into a building with three apartments, all of which split an internet subscription. There is only one router, however, in one of the other apartments. For security/privacy purposes, I'd ...
2
votes
2answers
78 views

Is there such a thing as application-specific encryption?

I am looking for a way to encrypt certain files (.jpg, .pdf, standard file extensions) such that they can only be opened by a certain application (assuming this application will have the relevant file ...
0
votes
0answers
19 views

Trying to access code segment of a program in c [closed]

How do i access the code segment of a program in c? I am trying to write a virus in c. So i need to be ablw to copy the hex dump of my own code into another exe.
0
votes
0answers
23 views

Where should I store a refresh token

I'm building an oauth 2.0 protocol. I'm wondering how the refresh token works exactly. My understanding is that the use of a refresh token enable short lived access token and therefore limits the ...
1
vote
3answers
44 views

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully ...
1
vote
1answer
42 views

Do not trust all intermediate certificates

I have a trust store containing SSL certificate chain up to Root CA certificate: Root CA -> Intermediate CA - SSL certificate According what I saw as a best practice, only Root CA certificate should ...
1
vote
0answers
20 views

Nessus 6.7.0 global.db file growing exponentially

We upgraded from Nessus 5.x to 6.7. Our old global.db file was only ~300kb consistently before the upgrade. Since we upgraded, it has grown exponentially to a couple of GB in only a month. Has anyone ...
-3
votes
0answers
18 views

How to extract gsm elements? [closed]

I want to extract "to know " MCC MNC LAC CID of a phone by a it's number or a fragment msg (url that extract it) And ill be thankfull
10
votes
3answers
927 views

What is the difference between a RADIUS server and Active Directory?

Why would I need a RADIUS server if my clients can connect and authenticate with Active Directory? When do I need a RADIUS server?
-1
votes
0answers
76 views

RSA 4096 Malware [closed]

my personal computer was attacked by RSA 4096 malware and i have try using tesla decryption but noting has happen and my file are still encrypted. How can i decrypt the encrypted files to get my data ...

15 30 50 per page